Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in

  FAQ | Search | Memberlist | Usergroups | Statistics | Profile | Log in to check your private messages | Log in | Register

[Solved]Is my openvpn ok or not?
 View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message
skorefish
Apprentice
Apprentice


Joined: 21 Jun 2015
Posts: 285
PostPosted: Mon Feb 01, 2016 12:14 pm    Post subject: [Solved]Is my openvpn ok or not? Reply with quote
hello,

i' m trying to connect 2 Gentoo boxes with openvpn

Code:
server 192.168.2.99, client 192.168.2.50
         
         server : * Starting openvpn ...                                                                               [ ok ]

         client:  * Starting openvpn ...                                                                               [ ok ]
                    * WARNING: openvpn has started, but is inactive

                    ....Mon Feb  1 12:59:15 2016 us=754287 Initialization Sequence Completed


         


openvpn.conf(server): https://bpaste.net/show/4d0dd3bf7cf7
openvpn.log(server): https://bpaste.net/show/edf2adcdb6f4

openvpn.conf(client): https://bpaste.net/show/08e6564916f9
openvpn.log(client): https://bpaste.net/show/ba882ed2b210

what am I doing wrong/ what do I have to do more ? ...



Code:


#pushing route tables
push "route 192.168.2.1 255.255.255.255"
#push "dhcp-options DNS 192.168.2.1"

user nobody
group nobody


Can someone explain me what this does? ok I found http://unix.stackexchange.com/questions/91071/openvpn-push-a-route-to-client-with-a-different-gateway

Last edited by skorefish on Sat Mar 19, 2016 8:25 pm; edited 1 time in total
Back to top
View user's profile Send private message
depontius
Advocate
Advocate


Joined: 05 May 2004
Posts: 3525
PostPosted: Mon Feb 01, 2016 4:29 pm    Post subject: Reply with quote
I believe I may have seen messages like that before, I can't remember now. This is a message from your client, so start the client and then run "netstat -Nr" to see what your routing tables look like. If you see the routes you're expecting, try it out. I'm not sure about this, but "started, but inactive" might mean that the tunnel is created, but not currently being used. I'll defer to other opinions on this, but so far there appear to be none.
_________________
.sigs waste space and bandwidth
Back to top
View user's profile Send private message
skorefish
Apprentice
Apprentice


Joined: 21 Jun 2015
Posts: 285
PostPosted: Tue Feb 02, 2016 1:53 pm    Post subject: Reply with quote
Kernel IP routing table
Code:

Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         192.168.2.1     0.0.0.0         UG        0 0          0 enp5s1
10.100.0.1      10.100.0.5      255.255.255.255 UGH       0 0          0 tun0
10.100.0.5      0.0.0.0         255.255.255.255 UH        0 0          0 tun0
127.0.0.0       0.0.0.0         255.0.0.0       U         0 0          0 lo
192.168.2.0     0.0.0.0         255.255.255.0   U         0 0          0 enp5s1


I can not ping 10.100.0.5 , is there something wrong with this table?
Back to top
View user's profile Send private message
depontius
Advocate
Advocate


Joined: 05 May 2004
Posts: 3525
PostPosted: Tue Feb 02, 2016 4:24 pm    Post subject: Reply with quote
skorefish wrote:
Kernel IP routing table
Code:

Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         192.168.2.1     0.0.0.0         UG        0 0          0 enp5s1
10.100.0.1      10.100.0.5      255.255.255.255 UGH       0 0          0 tun0
10.100.0.5      0.0.0.0         255.255.255.255 UH        0 0          0 tun0
127.0.0.0       0.0.0.0         255.0.0.0       U         0 0          0 lo
192.168.2.0     0.0.0.0         255.255.255.0   U         0 0          0 enp5s1


I can not ping 10.100.0.5 , is there something wrong with this table?


That third line doesn't look right to me, but I'm not certain. I'd have to look at one of my systems with OpenVPN running, to tell. I may have to bring my personal laptop to work tomorrow, connect on the vistors' network, and start OpenVPN to tell.

That is, unless someone else has better advice before then.
_________________
.sigs waste space and bandwidth
Back to top
View user's profile Send private message
skorefish
Apprentice
Apprentice


Joined: 21 Jun 2015
Posts: 285
PostPosted: Tue Feb 02, 2016 4:55 pm    Post subject: Reply with quote
depontius wrote:
skorefish wrote:
Kernel IP routing table
Code:

Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         192.168.2.1     0.0.0.0         UG        0 0          0 enp5s1
10.100.0.1      10.100.0.5      255.255.255.255 UGH       0 0          0 tun0
10.100.0.5      0.0.0.0         255.255.255.255 UH        0 0          0 tun0
127.0.0.0       0.0.0.0         255.0.0.0       U         0 0          0 lo
192.168.2.0     0.0.0.0         255.255.255.0   U         0 0          0 enp5s1


I can not ping 10.100.0.5 , is there something wrong with this table?


That third line doesn't look right to me, but I'm not certain. I'd have to look at one of my systems with OpenVPN running, to tell. I may have to bring my personal laptop to work tomorrow, connect on the vistors' network, and start OpenVPN to tell.

That is, unless someone else has better advice before then.


thanks a lot for that !!!

when I run ifconfig I get

Code:

tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
        inet 10.100.0.6  netmask 255.255.255.255  destination 10.100.0.5
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 100  (UNSPEC)
        RX packets 14  bytes 1984 (1.9 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 50  bytes 5064 (4.9 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0


this confuses me... When I run ssh root@10.100.0.6
I log in to the client sshd and not the one of the server running through the tunnel
Back to top
View user's profile Send private message
skorefish
Apprentice
Apprentice


Joined: 21 Jun 2015
Posts: 285
PostPosted: Tue Feb 02, 2016 8:53 pm    Post subject: Reply with quote
I think I found a test

vpn server on:
Code:

lenovo ~ # tracepath 10.100.0.1
 1?: [LOCALHOST]                                         pmtu 1500
 1:  10.100.0.1                                            0.894ms reached
 1:  10.100.0.1                                            0.785ms reached
     Resume: pmtu 1500 hops 1 back 64

Code:

vpn server off
lenovo ~ # tracepath 10.100.0.1
 1?: [LOCALHOST]                                         pmtu 1500
 1:  no reply
^C


but :

Code:
 ssh root@10.100.0.1
ssh: connect to host 10.100.0.1 port 22: Connection refused


Why is this ?
Back to top
View user's profile Send private message
audiodef
Watchman
Watchman


Joined: 06 Jul 2005
Posts: 6656
Location: The soundosphere
PostPosted: Tue Feb 02, 2016 9:22 pm    Post subject: Reply with quote
I was about to post my own VPN question when I found this thread, which looks similar to what I wanted to know about. I think I've set mine up correctly. No errors, the logs show a connection established, but when traceroute a server (gentoo.org, google.com, etc.) I see no evidence of my wifi connection touching my VPN server. Not sure what I need to do to make that happen.
_________________
decibel Linux: https://decibellinux.org
Github: https://github.com/Gentoo-Music-and-Audio-Technology
Facebook: https://www.facebook.com/decibellinux
Discord: https://discord.gg/73XV24dNPN
Back to top
View user's profile Send private message
audiodef
Watchman
Watchman


Joined: 06 Jul 2005
Posts: 6656
Location: The soundosphere
PostPosted: Tue Feb 02, 2016 9:24 pm    Post subject: Re: Is my openvpn ok or not? Reply with quote
skorefish wrote:

Code:

                    * WARNING: openvpn has started, but is inactive





I'm learning, too. I came across this question elsewhere and this message might be normal for a Gentoo system. You have to check the actual logs to verify what is/isn't working. (Mine is set up by /etc/openvpn/openvpn.conf to be /etc/openvpn/openvpn.log, but there might also be files in /var/log.)
_________________
decibel Linux: https://decibellinux.org
Github: https://github.com/Gentoo-Music-and-Audio-Technology
Facebook: https://www.facebook.com/decibellinux
Discord: https://discord.gg/73XV24dNPN
Back to top
View user's profile Send private message
skorefish
Apprentice
Apprentice


Joined: 21 Jun 2015
Posts: 285
PostPosted: Tue Feb 02, 2016 11:03 pm    Post subject: Reply with quote
The tunnel is working and so is ssh

i put-> ListenAddress 0.0.0.0 -> /etc/ssh/ssd_config

maybe not the safest solution but 4 today i'm happy, maybe i can use the tunnel address 8)
Back to top
View user's profile Send private message
depontius
Advocate
Advocate


Joined: 05 May 2004
Posts: 3525
PostPosted: Wed Feb 03, 2016 2:23 pm    Post subject: Reply with quote
Testing on my known-working laptop.
Code:
localhost ~ # /etc/init.d/openvpn start
 * Starting openvpn...
 * WARNING: You are dropping root privileges!
 * As such openvpn may not be able to change ip, routing
 * or DNS configuration.                                                  [ ok ]
 * WARNING: openvpn.edgehp has started, but is inactive
localhost ~ # netstat -Nr
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         10.61.144.1     0.0.0.0         UG        0 0          0 wlan0
10.61.144.0     0.0.0.0         255.255.255.0   U         0 0          0 wlan0
127.0.0.0       0.0.0.0         255.0.0.0       U         0 0          0 lo
192.168.nn.1    192.168.nn.129  255.255.255.255 UGH       0 0          0 tun0
192.168.nn.129  0.0.0.0         255.255.255.255 UH        0 0          0 tun0
192.168.nx.1    192.168.nn.129  255.255.255.255 UGH       0 0          0 tun0
192.168.ny.0    192.168.nn.129  255.255.255.0   UG        0 0          0 tun0
192.168.nz.0    192.168.nn.129  255.255.255.0   UG        0 0          0 tun0
localhost ~ #

I also connected to my internal mail server and sshed to one of my (not the VPN endpoint) machines. I also push a few extra routes, so I can get to my LAN, my DMZ, and my cable modem.
_________________
.sigs waste space and bandwidth
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum



 Links: forums.gentoo.org | www.gentoo.org | bugs.gentoo.org | wiki.gentoo.org | forum-mods@gentoo.org

Copyright 2001-2025 Gentoo Foundation, Inc. Designed by Kyle Manna © 2003; Style derived from original subSilver theme. | Hosting by Gossamer Threads Inc. © | Powered by phpBB 2.0.23-gentoo-p11 © 2001, 2002 phpBB Group
Privacy Policy