--- Day changed Sun Jan 01 2017 03:02 < iheartlinux> almost there. I'm trying to route my client router's private network to the vpn's private tun ip: http://www.trunkmasters.com/pastebin/vpn tnx 07:59 < moritz_s> Hi, is there a way to make openvpn add routes to a custom routing table, i.e. the equivalent of the iproute command "ip route add table mycustomtable via " 08:04 < BtbN> If all else fails, add them to the up/down scripts 08:12 < moritz_s> BtbN: Right, I haven't thought of that. But still, then I can't push the option, since push works with route but not with up... 08:14 < BtbN> I'd guess you can only push stuff that works on all platforms OpenVPN supports 08:14 < BtbN> and Windows does not have that concept at all 08:23 < moritz_s> Oh, there seems to exist a PR for this: https://github.com/OpenVPN/openvpn/pull/13 08:23 <@vpnHelper> Title: netconfig: add option to use user defined routing table by speakinghedge · Pull Request #13 · OpenVPN/openvpn · GitHub (at github.com) 11:05 -!- Vampire0_ is now known as Vampire0 14:02 < lesderid> I just upgraded OpenVPN to 2.4.0 on both my client and my server, and connecting to the server now errors and crashes OpenVPN on the server 14:03 < lesderid> only error I can find in the logs is 'Assertion failed at crypto.c:81 (packet_id_initialized(&opt->packet_id))' on the client side, right after 'Initialization Sequence Completed' 14:05 < thereyouare> "crashes OpenVPN on the server", that is interesting 14:06 < lesderid> yeah ... 14:11 < lesderid> my system is fully updated on both my client and my server too 14:14 < lesderid> setting higher verbosity doesn't seem to output much more 14:14 < thereyouare> lesderid: so you can crash our VPN server ? 14:15 < lesderid> I'm sure it's just an issue with my configuration, but I don't see why it would just appear now when updating to 2.4.0 14:16 < lesderid> I haven't tried connecting to other servers 14:17 < lesderid> was support for some ciphers dropped maybe? 14:22 < SCHAAP137> what OS are you using lesderid 14:22 < SCHAAP137> and which SSL library? 14:23 < lesderid> Arch Linux with OpenSSL 14:24 < SCHAAP137> same here 14:24 < lesderid> the only slightly non-standard thing in my config is IPv6 support 14:24 < SCHAAP137> shouldn't matter, using that here as well 14:25 < SCHAAP137> it would suggest that, in your situation, HAVE_AEAD_CIPHER_MODES is defined but openvpn_encrypt_aead() is unable to call it, for some reason 14:25 < SCHAAP137> you just using the packaged version from the regular repo? 14:25 < lesderid> yes 14:26 < lesderid> both openvpn and openssl are from the core repo 14:26 < SCHAAP137> 2.4.0-2 for openvpn? 14:26 < lesderid> yeah 14:27 < SCHAAP137> and what crashes exactly? the binary server-side stops? 14:28 < lesderid> yes 14:28 < SCHAAP137> you say you see this assertion failure in the client logs; can you see what happens in the server logs? 14:29 < lesderid> exact same error (when the client connects) + 'Exiting due to fatal error' 14:30 < SCHAAP137> output of openvpn --version, shows the same versions and libraries used? 14:31 < lesderid> err, I already downgraded, give me a minute 14:31 < SCHAAP137> ah, ok 14:31 < lesderid> https://pst.moe/paste/ndjvde 14:33 < lesderid> on both client and server 14:34 < SCHAAP137> the digest and cipher, in the client config; do they appear in openvpn --show-digests / openvpn --show-tls respectively? both on client and server? 14:35 < SCHAAP137> as in; is the stuff being negotiated present on both sides 14:35 < lesderid> I don't explicitly specify a cipher in any config, it's just the default on both sides 14:36 < SCHAAP137> okay, since 2.4.0, it defaults to AES-256-GCM, irrespective of what's mentioned in the configuration 14:37 < SCHAAP137> in my situation, it didn't create an issue; even though i have AES-256-CBC in the config server-side, somehow it just uses AES-256-GCM 14:37 < SCHAAP137> possibly, in some way or another, this might be causing your issue 14:38 < SCHAAP137> i would try and ask in #archlinux as well 14:39 < lesderid> hmm maybe 14:39 < lesderid> I might ask there later, yeah 14:39 < SCHAAP137> you could test by configuring a defined set of cipher/auth/tls-cipher 14:39 < SCHAAP137> at least server-side, and then test reconnecting again 14:41 < SCHAAP137> only difference in my setup, is that i'm using LibreSSL here 14:41 < SCHAAP137> rest is identical 14:41 < lesderid> I don't really have time to debug it further right now, but thanks for the suggestion 14:41 < SCHAAP137> yw 14:44 < SCHAAP137> crashing is weird though, an assertion failure like that suggests something weird; i wouldn't expect that from vanilla repo packages 14:48 < lesderid> ¯\_(ツ)_/¯ 15:33 < jkaberg> while using the up function while creating an config file, is it possible to pass along the client IP as an argument? 15:33 < jkaberg> I mean the OpenVPN client ip 15:34 < jkaberg> example: up /path/to/script.sh %IPADDR% 15:44 < SAKUJ0> !welcome 15:44 <@vpnHelper> "welcome" is (#1) Start by stating your !goal, such as 'I would like to access the internet over my vpn' (*not* '!goal ' - the bot doesn't understand that - just '!goal' [without the quotes]), or (#2) New to IRC? see the link in !ask, or (#3) We may need you to !paste your !logs and !configs and maybe !interface to help you, or (#4) See !howto for beginners, or (#5) See !route for lans 15:44 <@vpnHelper> behind openvpn, or (#6) !redirect for sending inet traffic through the server, or (#7) Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm, or (#8) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict), or (#9) And again, if you think you need !tap, you're probably wrong, or (#10) see !1925 before arguing with the admins or the person helping you 15:45 < thereyouare> !sample 15:45 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting 15:49 < SAKUJ0> !goal I want to include multiple machines on the client side (10.218.0.0/16) when using a routed VPN 15:49 < SAKUJ0> !goal 15:49 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc 15:50 < SAKUJ0> I want to include multiple machines on the client side (10.218.0.0/16) when using a routed VPN 15:50 < thereyouare> !goat 15:51 < SAKUJ0> The routes seem to be pushing just fine. I don't intend to use MASQUERADING. I can ping the VPN client from the client LAN using its VPN address (outside of 10.218.0.0/16) 15:51 < SAKUJ0> So my local LAN is configured properly. But either the VPN client does not forward the packages to the server, or the server cannot reach 10.218.0.0/16 15:52 < SAKUJ0> I assume it is the latter, as the VPN server can only reach the VPN client on its VPN address 15:52 < SAKUJ0> For posterity, the VPN's network is 10.219.218.0/24 15:52 < SAKUJ0> I am running ufw 15:53 < SAKUJ0> sysctl allows net.ipv4.ip_forward 15:53 < SAKUJ0> ufw is set to allow all routed traffic via policy 15:53 < SAKUJ0> I can verify the routes are added on both the VPN server and client using `ip r` 15:54 < SAKUJ0> How can I get the VPN server to ping the VPN client on its LAN ip address (10.218.0.10) ? 15:57 < SAKUJ0> I also get an error when connecting with the VPN client to the VPN server, as it is trying to push the 10.218.0.0/16 route, which the VPN client is already on 15:57 < SAKUJ0> But I figured that is by design, as the route just already exists 15:58 < SAKUJ0> Here is the server.conf 15:58 < SAKUJ0> http://paste.debian.net/905946/ 16:07 < thereyouare> now wait 16:07 < thereyouare> someone could come buy and notice your question 16:07 < thereyouare> I asked my question 2 days ago still wait 16:07 < thereyouare> I think I will reask it 16:07 < thereyouare> in openvpn source there are files README and INSTALL that contain this text: 16:07 < thereyouare> Copyright (C) 2002-2010 OpenVPN Technologies, Inc. This program is free software 16:07 < thereyouare> why is it 2010 and not 2016 ? 16:08 < thereyouare> also in INSTALL file it says: 16:08 < thereyouare> Compile OpenVPN with OpenSSL/LZO built from source tarballs See INSTALL-nonstandard.txt 16:08 < thereyouare> but there is no INSTALL-nonstandard.txt file 16:13 < DarkSector> Hey guys, so my server.conf contains push route 0.0.0.0 with the comment saying push your local subnet to the client 16:13 < DarkSector> what is the advantage of using push route 0.0.0.0 instead of my actual local server side subnet "push route 192.168.31.0 255.255.255.0" 16:15 < thereyouare> !push 16:15 <@vpnHelper> "push" is usage: push , goes in the server config and makes the command act as if it was in the client config, can be used in ccd entries 16:17 < DarkSector> Uh, I know what push does, but I was just wondering what is the idea of using 0.0.0.0? 16:17 < DarkSector> What does that do, I can't seem to grasp it 16:17 < DarkSector> oh wait 16:21 < DarkSector> so if the client gets the route 0.0.0.0 that means all traffic should just default to this if no route is explicitly defined? 16:22 < thereyouare> I don't know but you can wait for someone who does know 16:22 < DarkSector> That's okay I'll ask on #networking too :) 17:14 < SAKUJ0> for posterity, it seems the ccd directive was missing. Once I set that up, The server was able to reach the client on its lan ip 17:14 < SAKUJ0> and the client lan was properly routed with ip_forward on top 17:29 < thereyouare> posterity will never forge it 17:30 < thereyouare> forge 17:30 < thereyouare> forget 17:44 < Eugene> thereyouare - copyright reflects the date that content was created, not when you downloaded it 18:00 < thereyouare> "its alive, its alive !!!" -- Frankenstein 18:01 < thereyouare> the channel is actually not dead 18:01 < Eugene> Its a holiday, what do you expect 18:01 < thereyouare> SAKUJ0: hang in there 18:02 < SAKUJ0> thereyouare, it's already working (see my latest comment) 18:02 < thereyouare> right 18:48 < nightOwlHash> hey folks 18:49 < nightOwlHash> I have a question about DNS servers 18:49 < nightOwlHash> I tried putting 3 new DNS ips in my ubuntu system files , and i checked for dns leaks online, and in one of the instances, there was a leak 18:50 < nightOwlHash> anybody knows how i can remove my ISP dns from my files ? 19:07 < thereyouare> another poor soul 19:27 < KNERD> Holiday weekend, some people have lifes other than on IRC 21:59 < redrabbit> how do i switch off access to lan and/or internet access behind openvpn server to clients 22:01 < subzero79> redrabbit have you try a firewall rule that prevents forwarding from the openvpn subnet the lan or the main internet gateway? 22:07 < redrabbit> good idea 22:08 < redrabbit> i thought there was some options in openvpn itself 22:08 < redrabbit> i have ufw on the openvpn VM but i started using shorewall, should be good for that 22:35 < redrabbit> < Eugene> redrabbit - see the ping family of options < Eugene> Keepalives & polling can eat a lot of data. 22:36 < redrabbit> how do you deal with this, i would like to reduce idle data use 22:38 < KNERD> redrabbit: I am trying to do the opposite..I want clients to have internet access. 22:39 < redrabbit> well thats how it works default 22:39 < redrabbit> i guess 22:39 < KNERD> once this push "redirect-gateway def1 bypass-dhcp" is enabled..they are cut off locally, but I want them to have access from the opernvpn server side 22:39 < KNERD> not really 22:39 < redrabbit> https://designdesk.org/security/setup-openvpn-vps-local-server 22:39 <@vpnHelper> Title: Setup an OpenVPN server (at designdesk.org) 22:40 < redrabbit> with this config it worked for me 22:40 < redrabbit> its probably down to firewall rules 22:40 < redrabbit> try 22:40 < redrabbit> echo 1 > /proc/sys/net/ipv4/ip_forward 22:41 < KNERD> It's not local..it's a remote server 22:43 < KNERD> IP tables is correct...I had this issue before on another server which I was able to fix with the help from thsi channel before, but the freaking hosting company deleted the VPS...thus what I added in to server.conf is lost 22:43 < Eugene> redrabbit - you can just unset them; they're part of the default helper set used by the --server directive 22:43 < KNERD> this time I need to save it 22:43 < redrabbit> Eugene: oh good 22:44 < redrabbit> can you point me to the proper syntax/man page 22:47 < KNERD> going to test that /proc/sys/net/ipv4/ip_forward now 22:48 < KNERD> i wonder if networking needs to be restarted 22:48 < KNERD> not working 22:49 < redrabbit> you need forwarding 22:49 < redrabbit> maybe iptables rules 22:50 < KNERD> ip tables are there 22:50 < KNERD> :POSTROUTING ACCEPT [609:43311] 22:50 < KNERD> -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE 22:50 < KNERD> -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to-source 104.192.169.78 22:50 < redrabbit> Eugene: did you tried to unset them, if so how much did you gained 22:50 < redrabbit> or, saved 22:52 < redrabbit> i set up 3 openvpn server from the link i posted above, all of them share their internet connection 22:53 < redrabbit> i have no clue which firewall rules i have to set to disable it 22:53 < KNERD> but are they getting internet from the local connection, or remotely 22:54 < redrabbit> from the connection behind the server 22:54 < redrabbit> so remotely i guess 22:55 < KNERD> ipchiken.com will show you for sure 22:55 < redrabbit> yes i do get ip from the openvpn server 22:56 < redrabbit> just compare your config with the stuff in my link 22:56 < redrabbit> or start fresh and follow it mindlessly 22:56 < redrabbit> :D 22:57 < KNERD> that link is using UFW, while I am using IP Tables 22:58 < redrabbit> aha, i should translate that part for iptables users 22:58 < redrabbit> for shorewall too 22:58 < KNERD> I am stuck using IP Tables 22:58 < redrabbit> ufw can be limiting 23:04 < redrabbit> KNERD: you need a forward rule 23:04 < KNERD> which is that? 23:05 < KNERD> I remember putting something in the servf.conf which helped with that but it is gone now so I dont have it anymorwe. I think someone pointed me toa helpful page on the openvpn site 23:06 < redrabbit> iptables -A FORWARD -i eth0 -s 192.168.0.0/24 -j ACCEPT 23:06 < redrabbit> try something like that 23:07 < KNERD> it's a remote server with static IP address 23:08 < KNERD> so what would I be forwarding? the static IP address? redrabbit: 23:10 < KNERD> i see this very issue in many forums. but the answer for them is to add to IP tables the same rules I alreayd have.. (posted above) 23:10 < redrabbit> maybe your ip after -s 23:11 < redrabbit> anyway im gonna edit the how to and add iptables without ufw 23:12 < redrabbit> ill do that later though 23:12 < KNERD> okay..and testing the iptabel rule now 23:12 < KNERD> NO change 23:13 < redrabbit> you prolly need the right foward rule 23:13 < redrabbit> gtg, gl 23:13 < KNERD> okay 23:13 < KNERD> thansk for helping 23:19 < KNERD> this states how to https://openvpn.net/index.php/open-source/documentation/howto.html#redirect 23:19 <@vpnHelper> Title: HOWTO (at openvpn.net) 23:19 < KNERD> Routing all client traffic (including web-traffic) through the VPN 23:21 < KNERD> yeah I have all that so it must be an IP tables issue --- Day changed Mon Jan 02 2017 00:45 <@krzee> KNERD: 00:45 <@krzee> !redirect 00:45 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns, or (#3) if using ipv6 try: route-ipv6 2000::/3, or (#4) Handy troubleshooting flowchart: 00:45 <@vpnHelper> http://pekster.sdf.org/misc/redirect.png 00:45 <@krzee> see the flowchart 01:21 < jayray> good day! 01:24 < jayray> I have a quick question... I just upgraded from 2.3.14 to 2.4.0 and clients wouldnt connect because my CRL.pem had not been updated in years. is there a new config setting that will disable the crl expiration check, or do now have to update crl every 30 days? 01:43 < jayray> nvm... 06:03 < weasel> hm. 06:03 < weasel> I need 'proto udp6' if I want my openvpn to listen on v4 and v6, right? 06:34 < MrNeon> hey, I'm having problems with the openvpn 2.4 update, I'm getting a permission error when reading files from the ccd folder. 06:35 < MrNeon> from the log: Could not access file 'ccd/acer.brocktonbay': Permission denied (errno=13) 06:43 < ordex> MrNeon: maybe you are dropping priviledges to a user that is not allowed to read that directory/files ? 06:44 < BtbN> weasel, you don't need to listen on v4. An IPv6 Socket happily accepts both. 06:54 < MrNeon> ordex, that was it, it was dropping to the user nobody and it can't read inside the new server/ directory. 06:56 < ordex> yap 06:56 < ordex> goed :) 07:22 -!- remirol is now known as lorimer 07:44 < weasel> BtbN: that wasn't my question :) 07:45 < weasel> BtbN: the point is, it only listens on both with udp6. but with 'proto udp6', openvpn (at least 2.3.2) is broken as it answers udp connections from the "wrong" address (i.e. it does not answer from the address that the peer connected to) 07:46 < BtbN> That's unfortunately just how UDP behaves, as it's connectionless. 07:47 < weasel> no, it's not just how UDP behaves. 07:47 < BtbN> You could start multiple instances, and bind each one to a specific IP 07:47 < weasel> if I don't specify 'proto udp6', then openvpn correctly binds on outgoing connections 07:47 < weasel> i.e. it picks the correct ipv4 address from the many it could. 07:48 < weasel> so it appears openvpn has code to handle this case, except it's broken with 'proto udp6' 07:49 < BtbN> Or the default IP just happens to work. 07:49 < weasel> nope 07:49 < weasel> with proto ipv6: 07:49 < weasel> 12:47:21.630490 IP 172.22.126.25.59944 > 141.201.27.94.14525: UDP, length 14 07:49 < weasel> 12:47:21.630697 IP 172.22.126.15.14525 > 172.22.126.25.59944: UDP, length 22 07:49 < weasel> without: 07:49 < weasel> 12:51:26.062338 IP 172.22.126.25.43965 > 141.201.27.94.14525: UDP, length 14 07:49 < weasel> 12:51:26.062750 IP 141.201.27.94.14525 > 172.22.126.25.43965: UDP, length 26 07:50 < BtbN> Is your server configured as multihome? 07:50 < weasel> "multihome" is in the config file. 07:51 < BtbN> And this is a linux server, right? Not some BSD? 07:52 < weasel> correct. 07:52 < weasel> (it's a debian wheezy, with backports openvpn) 07:52 < BtbN> Works fine for me then, with udp6 + multihome and two IPv4s + IPv6 07:54 < BtbN> https://community.openvpn.net/openvpn/ticket/306 07:54 <@vpnHelper> Title: #306 (--proto udp6 --multihome fails for IPv4-mapped clients) – OpenVPN Community (at community.openvpn.net) 07:54 < BtbN> "the code in 2.3 actually gets this right, if the operating system can handle this particular case (IPv4 packets arriving as IPv4-mapped on an IPv6 socket). Linux could not until 3.15 (see below for details)" 07:54 < BtbN> I'd guess Debian Wheezy has an older kernel? 07:54 < weasel> let me check 07:54 < weasel> correct. 07:55 < BtbN> Yeah, that's your issue then. Kernel too old for that case. 07:55 < weasel> Thanks 07:55 < weasel> guess those nodes will stay v4 only then 07:56 < BtbN> Isn't that debian variant dead, and in bad need of an update anyway? 07:57 < weasel> there's LTS. 07:57 < weasel> it's not ideal, but it's reasonable (imo) for this particular host. 08:21 < moritz_s> I have "server 10.12.34.0 255.255.255.0; route 192.168.0.0 255.255.255.0" in the server conf and "iroute 192.168.0.0 255.255.255.0" in the ccd conf for a client. But the server tells me "OpenVPN ROUTE: OpenVPN needs a gateway parameter for a --route option and no default was specified by either --route-gateway or --ifconfig options". 08:21 < moritz_s> Am I missing something? As I understand, "server 10.12.34.0 255.255.255.0" should include the ifconfig option 08:36 < [0xAA]> Mon Jan 2 14:14:59 2017 WARNING: Bad encapsulated packet length from peer (0), which must be > 0 and <= 1626 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...] 08:36 < [0xAA]> I'm seeing this error 08:37 < [0xAA]> I'm designing a TCP proxy like port mapper 08:37 < skyroveRR> Fix the MTU on both the sides. 08:37 < skyroveRR> Is any of your connection doing PPPoE? 08:37 < [0xAA]> skyroveRR: It's the same 08:37 < [0xAA]> I'm designing a TCP MITM proxy 08:37 < [0xAA]> skyroveRR: this is not a general problem 08:37 < [0xAA]> this MITM does not modify any packet contents 08:38 < [0xAA]> this MITM just accepts connection, reads it, encrypts and sends over another tunnel 08:38 < [0xAA]> then all incoming packets are decrypted and the same happens 08:38 < [0xAA]> somehow, some of these packets are getting short 08:38 < [0xAA]> so, what do I do 08:39 < [0xAA]> I've tried this with multiple programs and the proxy works 08:39 < [0xAA]> only OpenVPN doesn't work 08:40 < [0xAA]> is there a specific size upto which this MITM should wait ? 08:42 < lorimer> can you snoop one of the other programs that's working and see if it's being more tolerant of the same error? 08:43 < lorimer> ie. are some of your packets always coming short and other programs just eat-and-retry? 08:43 < [0xAA]> lorimer: I've tried HTTP, netcat chat, IRC 08:43 < [0xAA]> all of them wait until the block arrives 08:43 < [0xAA]> and OpenVPN just rages out 08:44 < lorimer> ./thinking 08:44 < [0xAA]> (they wait until what they need comes) 08:45 < [0xAA]> HTTP does work 08:46 < lorimer> yeah, no, they're being tolerant but not incorrectly so 08:47 < lorimer> dunno, then. i'd dig into the openVPN code at this point if this was me, but i haven't ever looked at it so i don't know how quick a task that is. 08:47 < lorimer> sounds like openVPN expects a certain degree of consistency that the MITM is disrupting. just don't know if that consistency is excessive or there for a reason 08:47 < [0xAA]> but OpenVPN uses OpenSSL 08:47 < [0xAA]> and I've tried HTTPS as well 08:48 < [0xAA]> hmm, if OpenVPN is meant to run over insecure internet, then it should tolerate (block) until what it needs arrives 08:48 < lorimer> this is what i would expect as well because TCP is supposed to work that way 08:49 < lorimer> so it's either a bug or intentional-and-i-dont-know-why. either way i'm out of ideas though, so good luck :/ 08:50 < [0xAA]> D: 08:51 < [0xAA]> can I lure OpenVPN by some configuration to allow whatever-packet-size ? 08:55 < para000> hi guys 08:56 < para000> what do you think is better to install an openVPN, ubuntu 16.04 or Debian 8? 08:57 < thereyouare> untill when new versions servers will support 2.3.11 version clients ? 08:58 < [0xAA]> para000: off-topic 08:59 < thereyouare> I remember when I tryed to use client 2.3.2 version to connect to 2.3.11 server it failed because client was too old, so now I use 2.3.11 client but its support will also be drooped sometime in the future, when it could happen ? 08:59 < thereyouare> so right now can client of 2.3.11 connect to server of 2.4.0 ? 09:00 < thereyouare> [0xAA]: why did hiya banned you in his channel ? 09:00 <@dazo> para000: openvpn should run equally well on both ... choose what you are most comfortable with .... With that said, if deb/ubuntu was my only options, I'd go for Debian .... normally I prefer RHEL/Scientific Linux/CentOS (in that order) 09:01 < [0xAA]> thereyouare: he's gay when it comes to security 09:01 < [0xAA]> thereyouare: https://bpaste.net/raw/a78a10eac0c4 09:01 <@dazo> thereyouare: its a long time ago ... but IIRC, it was mostly related to lack of humbleness and providing very bad advices ... which mean hiya was not capable of accepting s/he was wrong 09:01 < [0xAA]> this is off-topic though 09:02 < [0xAA]> dazo: read those logs, that will prove how insecure hiya and friends are 09:02 < [0xAA]> one of them (raiz) encrypts his keys with ECDSA 09:02 <@dazo> [0xAA]: iirc, I was one of them kicking him out of here at one point ... but it did happen a few more times 09:02 < [0xAA]> my current ssh session is encrypted with ecdsa key 09:03 < [0xAA]> ^ topkek 09:03 < [0xAA]> dazo: hiya is idiot, everyone should know it by now 09:03 < [0xAA]> and back it my mitm 09:03 < [0xAA]> why isn't it working -.- 09:03 < [0xAA]> HTTP is working, HTTPS is, as well 09:04 < [0xAA]> As OpenVPN uses OpenSSL, it should do the same 09:04 <@dazo> [0xAA]: are you re-inventing stunnel? 09:08 < [0xAA]> dazo: nope 09:08 < [0xAA]> It uses custom crypto 09:09 < [0xAA]> with some other features that I want to do myself for realz 09:09 < [0xAA]> I just wrote my own implementation of copy 09:09 <@dazo> "custom crypto" .... that sounds risky 09:10 < [0xAA]> dazo: I know what I'm doing 09:11 < [0xAA]> I've wrote a hashlot of crypto apps 09:12 <@dazo> heh ... sorry, but without knowing your true identity, that sounds like last famous words to me ;-) 09:12 < [0xAA]> dazo: with this identity? 09:12 < [0xAA]> dazo: again off-topic 09:13 <@dazo> off-topic discussions are okay in this channel as long as it doesn't disturb other more "on-topic" discussions 09:17 < [0xAA]> hmm 09:17 < [0xAA]> openvpn is basically breaking me right now 09:19 < lorimer> "why custom crypto?", he asked secretively 09:19 * lorimer goes and stands in the corner 09:20 <@dazo> lorimer++ ... no need to go stand in the corner. That's a very appropriate question 09:20 < lorimer> not for the question, for the tom-swiftie stuck to it 09:21 <@dazo> http://security.stackexchange.com/questions/18197/why-shouldnt-we-roll-our-own#18198 09:21 <@vpnHelper> Title: cryptography - Why shouldnt we roll our own? - Information Security Stack Exchange (at security.stackexchange.com) 09:34 < [0xAA]> dazo: I know what I'm doing 09:35 < [0xAA]> I understand what I'm doing as well 09:35 < [0xAA]> I use other libraries, but write the cryptosystem myself 09:35 < [0xAA]> I don't design primitives 09:42 < [0xAA]> and, I don't write in C 09:42 < [0xAA]> So I'm not vulnerable to buffer overflows and funny things 09:46 < KNERD> krzee: looking now 09:46 < redrabbit> interesting read dazo 09:46 < redrabbit> hi KNERD found the solution ? 09:46 < redrabbit> offtopic, are you a knife nerd ? :D 09:47 < KNERD> redrabbit: i just got back on looking now.. I an a K NERD 09:47 < KNERD> !def1 09:47 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1" 09:47 < KNERD> !ipforward 09:47 <@vpnHelper> "ipforward" is (#1) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall, or (#2) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward 09:47 < KNERD> !nat 09:47 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !openvznat !winnat and !fbsdnat for specific howto 09:47 < redrabbit> pretty sure you need an iptables FORWARD rule 09:48 < KNERD> yes, but which one 09:50 -!- syzzer [~syzzer@openvpn/community/developer/syzzer] has quit [Quit: ZNC - http://znc.in] 09:50 < KNERD> !linipforward 09:50 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware, or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT 09:51 < KNERD> well that is set for sure 09:51 < KNERD> def1 is also set 09:52 < redrabbit> something like iptables -A FORWARD -i tun0 -o eth0 -j ACCEPT 09:52 < redrabbit> kinds of looks like the command above ^ 09:53 < KNERD> that looks good..i will try it now 09:54 < KNERD> no change 09:56 < redrabbit> try command from the helper 09:57 < redrabbit> tbh id start fresh, are you sure the rest of the configuration is good 09:59 < KNERD> yes..i have uset his same one before...just without the push "redirect-gateway def1 bypass-dhcp" because it has always gave problems 09:59 < KNERD> this time I want it 10:00 < KNERD> no change 10:02 < redrabbit> maybe it give problem because the configuration isnt proper 10:04 < KNERD> i have looked in many forums, dealing with the same issue, and the configuration is identical 10:04 < KNERD> even after they got it working 10:05 < redrabbit> would be easier to start fresh and try other instructions are this point 10:05 < redrabbit> at this* 10:07 < KNERD> not really. As I metnioned I had this issue before, and someone on here was able to help with it. If was over a year ago, though. They had me put something other in the configuratrion and it started working. 10:07 < KNERD> if I recall correctly, it was something posted in the helper link 10:09 < redrabbit> http://dpaste.com/0D7S844 10:09 < redrabbit> try this 10:10 < redrabbit> lol, that's why i always take notes when i get something to work :D 10:10 < redrabbit> i learned not to trust my internal brain memory much 10:10 < KNERD> yes...i did, but I had a HD crash a few months ago 10:11 < redrabbit> backups 10:11 < KNERD> and the dammed VPS provider wiped my VPS 10:11 < KNERD> Here is the config http://pastebin.com/XRwyQC94 10:11 < redrabbit> backups 10:11 < redrabbit> :D 10:11 < redrabbit> i backup my vps to my NAS every night 10:11 < redrabbit> with cron and rsync 10:12 < KNERD> plus...i accidentally eased a flash drive with some of my backups on it...what luck 10:12 < redrabbit> https://www.youtube.com/watch?v=B-khEYhppBs 10:14 < KNERD> I though it was Capt. Obvious 10:14 < redrabbit> its another flavor 10:15 < redrabbit> i will install another vpn from strach in a vm to add an iptables section on my how to 10:15 < redrabbit> but im pretty sure you can follow it and use the rules in the dpaste above 10:17 < KNERD> oh okay..but sure to test it 10:18 < para000> Anyone here is willing to help me setup an OpenVPN server with multiple IPs on Ubuntu 16.04 for a sum of money? 10:18 < redrabbit> how much ips 10:19 < para000> total of 10 external IPs 10:19 < redrabbit> :D gl 10:20 < para000> Is for private usage not for commercial. 10:20 < para000> why you say that? 10:20 < redrabbit> i don't know sounds hard 10:20 < redrabbit> id certainly need help too 10:21 < KNERD> Capt Hindsight says so 10:23 < para000> redrabbit: i have some ideeas on how to do it 10:23 < para000> i belive i crate a server1.cfg to server10.cfg for OpenVPN 10:23 < para000> each with 1 IP 10:24 < para000> and start all 10:30 <@krzee> para000: sure 10:30 <@krzee> msg me 10:42 < thereyouare> [0xAA]: you think if you don't use C you are safe from buffer overflows ? 10:44 -!- syzzer [~syzzer@openvpn/community/developer/syzzer] has joined #openvpn 10:44 -!- mode/#openvpn [+o syzzer] by ChanServ 10:48 < [0xAA]> thereyouare: Unless I'm again using a unsafe language 10:57 <@krzee> alright para000, whats the goal for the vpn? 10:58 <@krzee> you want clients to be able to connect to one of 10 public ips, and then traffic leaves for the internet with that source ip? 10:58 < para000> i wanna make all 10 IPs as VPN for 10 virtual machines 10:58 < para000> each client to an indiviaul IP 10:58 < para000> i`m thinking on crating 10 servers.config 10:58 < para000> for eachi IP 10:58 <@krzee> ok so theres 2 ways 10:58 <@krzee> 1 is that way 10:58 <@krzee> the other is --multihome 10:59 < para000> wich way give you more stability ? 10:59 <@krzee> and then give each client a static vpn ip, and give 10 NAT rules with source ip specified 10:59 <@krzee> = stability 11:00 < para000> some guy made me 1 year ago on debia with the 10 servers.config 11:00 <@krzee> well ya that works, but a single config can also do it 11:00 < para000> and something when i try to do a seach on the web from one of my virtual computers, pings jump from 100 to 2500 while the data is transferd 11:01 < para000> k, krzee 11:01 < para000> let me setup ubuntu for static IPs 11:01 <@krzee> you would not specify the ip to listen on, it'll listen on all, then with --multihome in linux it'll be able to handle being contacted on any ip 11:02 < para000> casue is see ubuntu 16.04 now give iface ens3 inet dhcp 11:02 <@krzee> then if clients had static ips you could give them each their own NAT rule based on vpn source ip and specify the ip to nat as 11:02 <@krzee> !static 11:02 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client, or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0, or (#3) also see !ccd and !iporder, or (#4) with static IPs, limit your --ifconfig-pool to exclude the static range, or (#5) See also: !addressing 11:02 <@krzee> !linnat 11:02 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -I POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to , or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info 11:03 <@krzee> iptables -t nat -I POSTROUTING -s -o eth0 -j SNAT --to 11:04 < para000> yes, but if client do not have static IP 11:04 <@krzee> no i mean client vpn ip is static 11:04 <@krzee> !static 11:04 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client, or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0, or (#3) also see !ccd and !iporder, or (#4) with static IPs, limit your --ifconfig-pool to exclude the static range, or (#5) See also: !addressing 11:04 < para000> oh 11:04 <@krzee> you control that =] 11:05 < para000> oh your saying in the .ovpn file 11:05 < para000> right? 11:05 <@krzee> well kinda 11:05 <@krzee> in a ccd entry 11:05 <@krzee> !ccd 11:05 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir to enable it, then put the config options for the client in /common-name, or (#2) the ccd file is parsed each time the client connects. 11:06 < para000> k, let me start on it 12:02 -!- danhunsaker [sid145261@openvpn/corp/danhunsaker] has quit [Ping timeout: 260 seconds] 12:05 -!- danhunsaker [sid145261@openvpn/corp/danhunsaker] has joined #openvpn 12:05 -!- mode/#openvpn [+o danhunsaker] by ChanServ 13:21 < Koshi> hello. i have a server in digitalocean and i try to configure openvpn 13:22 < Koshi> but when i connect to app in windows shows a error 13:22 < Koshi> can not locate HMAC in incoming packed from .... 13:29 < ExoUNX> Koshi make sure the cipher suite lines up between the server and client configs 13:31 < Koshi> ExoUNX, i dont know 13:31 < Koshi> how can i find it 13:52 < ExoUNX> Koshi might help https://community.openvpn.net/openvpn/wiki/Hardening 13:52 <@vpnHelper> Title: Hardening – OpenVPN Community (at community.openvpn.net) 14:02 < Koshi> ExoUNX, Thanks 14:06 < thereyouare> so easy-rsa doesn't ships with source tarball of openvpn anymore ? 14:06 < thereyouare> why ? 14:25 < ExoUNX> thereyouare I think they separated them to be less monolithic 14:26 < ExoUNX> https://github.com/OpenVPN/easy-rsa 14:26 <@vpnHelper> Title: GitHub - OpenVPN/easy-rsa: easy-rsa - Simple shell based CA utility (at github.com) 14:40 <@dazo> Koshi: sounds like you're using --tls-crypt or --tls-auth on only one of the sides, not both 14:40 <@dazo> thereyouare: we decided easy-rsa should be de-coupled and have its own release cycle, not coupled with the core openvpn 14:40 < Koshi> dazo, what can i do 14:41 < Koshi> i followed : https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-ubuntu-16-04 14:41 <@vpnHelper> Title: How To Set Up an OpenVPN Server on Ubuntu 16.04 | DigitalOcean (at www.digitalocean.com) 14:47 < nahra> Hello. Which way to start openvpn systemd service for client, named "openvpn-client@clent.service"? 14:49 <@dazo> Koshi: don't use unofficial openvpn documentation, that's the first thing you can do 14:49 <@dazo> !howto 14:49 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror, or (#3) Getting started with OpenVPN: https://community.openvpn.net/openvpn/wiki/GettingStartedwithOVPN 14:49 <@dazo> Koshi: start with #3 14:49 < Koshi> dazo, i will try now 14:54 < nahra> dazo: Any idea? 15:00 < thereyouare> Koshi: you think they have free VPS on digitalocean ? 15:02 < Koshi> thereyouare, no but i think i can install openvpn on ubuntu server 15:02 < Koshi> and i will try if works or not. i never try before 15:08 <@dazo> nahra: if your client configuration file is called 'clent.conf' ... then you need to do: systemctl start openvpn-client@clent 15:09 <@dazo> Koshi: openvpn on ubuntu on an digital ocean droplet works very fine ... in a previous job, I did some testing with exactly such a setup 15:10 < Koshi> dazo, thanks, when i finish i will tell you . :) 15:11 <@dazo> nahra: just remember that your configuration file must be saved under /etc/openvpn/client/ ... and it must have a .conf extension 15:20 < Vazity> !welcome 15:20 <@vpnHelper> "welcome" is (#1) Start by stating your !goal, such as 'I would like to access the internet over my vpn' (*not* '!goal ' - the bot doesn't understand that - just '!goal' [without the quotes]), or (#2) New to IRC? see the link in !ask, or (#3) We may need you to !paste your !logs and !configs and maybe !interface to help you, or (#4) See !howto for beginners, or (#5) See !route for lans 15:20 <@vpnHelper> behind openvpn, or (#6) !redirect for sending inet traffic through the server, or (#7) Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm, or (#8) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict), or (#9) And again, if you think you need !tap, you're probably wrong, or (#10) see !1925 before arguing with the admins or the person helping you 15:36 < thereyouare> http://www.keylength.com/en/8 15:36 <@vpnHelper> Title: Keylength - BSI Cryptographic Key Length Report (2015) (at www.keylength.com) 15:43 < thereyouare> on that page: http://security.stackexchange.com/questions/18197/why-shouldnt-we-roll-our-own someone said: 15:43 <@vpnHelper> Title: cryptography - Why shouldnt we roll our own? - Information Security Stack Exchange (at security.stackexchange.com) 15:43 < thereyouare> "More eyes means more likely that the current version doesn't have major vulnerabilities, as opposed to something developed in-house by non-experts" 15:43 < thereyouare> but shouln't it be in contrary like in real life when there is the more people whitness a crime the less likely someone call the police ? 16:04 <@krzee> when you roll your own there are no witnesses, so nobody can call the police 16:06 <@krzee> in your example, which is more likely to get a call to the police? the one with too many witnesses or the one with none? 16:07 < thereyouare> so "roll your own" means security through obscurity ? 16:07 < thereyouare> I though "roll your own" means its open source and everyone can see it but its just you made it instead of some other guy 16:08 < thereyouare> so there is no even single case when "roll your own" is better then "not roll your own" ? 16:08 <@krzee> sure there is, the case where you are a math expert and probably have a phd in cryptography 16:09 <@krzee> :D 16:09 <@krzee> so like, if you're DJB for example, then it can be fine 16:09 <@krzee> (he rolled blowfish and twofish, for example) 16:09 < thereyouare> who rolled AES ? 16:10 <@krzee> want me to google that for you? 16:10 < thereyouare> was that one guy ? 16:10 < thereyouare> don't google it for me, google it for yourself 16:10 <@krzee> (guys) 16:11 <@krzee> but i dont care, you're the one asking 16:11 < thereyouare> so AES is the best ? 16:11 < thereyouare> its like "the ring" that unites them all ? 16:11 < thereyouare> rules them all 16:11 <@krzee> its just whats currently recommended, "best" is a personal choice 16:12 < lorimer> 'best' is a significant oversimplification, too. it's just one particular standard that is "satisfactory" based on our current knowledge and tech level 16:13 < thereyouare> imagine if people start breaking encryption as intensely like they mine bitcoins 16:13 < lorimer> bitcoins are way behind the curve on effort level there 16:13 < lorimer> nations have entire departments devoted to breaking encryption 16:13 < thereyouare> its unbreakable because there is just not enough stimulus 16:14 < thereyouare> first they would use CPU then GPU then custom made ASICs 16:14 < thereyouare> and eventually they break AES 16:14 < lorimer> ...again, that kind of effort has been happening long before bitcoin 16:14 < lorimer> building custom hardware to break encryption is at least 25 years old 16:15 < lorimer> maybe more, you'd have to ask the NSA 16:15 < thereyouare> but do you think average people allowed to buy such hardware ? 16:15 < lorimer> not relevant. 16:23 <@dazo> thereyouare: AES is currently the safest algorithms according to several crypto experts 16:26 <@dazo> thereyouare: the SHA3 competitions concluded a year ago or so that the Keccak will be the basis for the SHA-3 generation of crypto algorithms, which is believed to be stronger ... so that's what crypto experts and mathematicians spend their available time on testing out 16:26 < thereyouare> how you compare what is "safest" ? I mean you can compare plastic bottle with glass bottle what is the safest to carry, because you can try to break both and its harder to break plastic one so from experinece of actually breaking stuff you can say which one is less unbreakable, so in case of encryption algorithms how they compare them ? 16:27 <@dazo> oh sorry ... I'm too tired now ... mixing hashing with crypto algorithms 16:27 < thereyouare> I mean it is whether breackable or unbreackable like 0 or 1 or is there scale 1 to 10 or what ? 16:27 <@dazo> thereyouare: "safest" means that no mathematicians or crypto experts have found a reliable way to break down the complexity of decoding an encrypted message 16:28 < thereyouare> like blowfish is safe 3 out of 10 and AES is safe 8 out of 10 16:28 < thereyouare> dazo: so for all others they did found it ? 16:28 <@dazo> for the vast majority, yes 16:28 < thereyouare> so I suppose that makes those vast majority deprecated ? 16:28 < thereyouare> or even useless ? 16:30 <@dazo> many of them are definitely deprecated and useless ... some are only partially broken, meaning it can't be cracked completely unless having enough CPU resources to solve the challenge in a reasonable time ... in these cases, it might be fine to use them if already implemented - depending on the information the crypto is protecting 16:30 < KNERD> redrabbit: hpw 16:31 <@dazo> (if it takes 3 months to crack it, but the information is useless after 1 month .. they you probably don't bother) 16:31 < KNERD> redrabbit: how is the install going? 16:32 <@dazo> thereyouare: but ... there's a ton of different algorithms ... many have not been through enough testing to deem it safe or not .... 16:32 < thereyouare> so AES is "good enough" 16:33 <@dazo> absolutely 16:34 <@dazo> thereyouare: https://en.wikipedia.org/wiki/Advanced_Encryption_Standard#Security 16:34 <@vpnHelper> Title: Advanced Encryption Standard - Wikipedia (at en.wikipedia.org) 16:34 < thereyouare> wikipedia to the resque 16:34 < thereyouare> rescue 16:36 <@dazo> there are some debates if it makes sense to use AES with 256 bit key lengths, or if 128 is more than good enough ... as there are some issues with the 256 bit algorithm, which don't make it much stronger than 128 bit ... Bruce Schneier have some blog articles on that 16:39 <@dazo> thereyouare: https://www.schneier.com/blog/archives/2011/08/new_attack_on_a_1.html 16:39 <@vpnHelper> Title: New Attack on AES - Schneier on Security (at www.schneier.com) 16:41 < thereyouare> so openvpn supports more than just AES right, so if one day it will be broken all you need to do is just change one line config and restart openvpn client and server ? 16:41 < thereyouare> one line in config 16:42 < thereyouare> or even better if AES so popular, and more and more people try to break it, so don't use it at all and use some less popular one in openvpn ? 16:42 <@dazo> thereyouare: openvpn supports most of what openssl (or mbed TLS) supports ... openvpn doesn't do the crypto stuff itself, it "outsources" it to a crypto library 16:42 < thereyouare> its like with viruses if you use some unpopular OS its less likely be hit by a virus or be broken in 16:43 < lorimer> every first world nation is trying to break AES. 16:43 < lorimer> with government-grade resources. and all the other ones, too. 16:43 < thereyouare> so it more chances AES will be broken early than other less popular algorithms 16:43 < lorimer> those other algorithms are also receiving the same level of effort 16:43 < lorimer> except the ones that are already broken of course. 16:44 < thereyouare> or is it possible to use more than one at once ? 16:44 < thereyouare> tunnel inside tunnel ? 16:44 < thereyouare> that will make it much more secure 16:44 <@dazo> thereyouare: crypto is not comparable to virus ... crypto is more comparable to the immunity system in our bodies ... the more it gets hammered and the more it survives, the better it is 16:44 < lorimer> less popular algorithms tend to be less popular because they are inferior, not because of some obscure reason. 16:45 <@dazo> yeah 16:45 < thereyouare> you mean if someone break AES it will got even more secure ? 16:45 < thereyouare> they just tweak the "flaw" and continue to use it ? 16:45 <@dazo> nope, I mean that when so many tries to break it and _still_ haven't managed to break it, it is a good quality sign 16:46 < thereyouare> but if algorithm is broken you can't just fix it you have to throw away its entirely ? 16:46 <@dazo> just as when our immunity system cracks down, we get badly ill ... until that happens, we handle quite a lot 16:47 <@dazo> if an algorithm is broken, something brand new is needed ... you don't easily "fix" an already implemented and distributed algorithm - that would break all implementation not adding the fix 16:48 < thereyouare> also it if was implemented in hardware you can throw those hardware away now 16:48 <@dazo> right 16:50 -!- mode/#openvpn [+v lorimer] by krzee 17:04 < KNERD> I am having issue "web browsing" when using >> push "redirect-gateway def1 bypass-dhcp" << It seems this is a common issue with searches I have done..for example http://serverfault.com/questions/593977/openvpn-connected-but-not-internet-access-on-the-client My config looks the same, and their suggested fix is already in IP tables 17:04 <@vpnHelper> Title: vpn - OpenVPN connected but not internet access on the client - Server Fault (at serverfault.com) 17:06 < KNERD> but I cannot find a solution 17:57 < fs0ciety> hi guys - with openvpn 2.4.0 - i noticed that the down-pre command doesnt work anymore. here is the config file 17:57 < fs0ciety> https://bin.fsociety.info/heribalode 17:58 <@vpnHelper> Title: bin (at bin.fsociety.info) 17:58 < fs0ciety> i get this error 17:58 < fs0ciety> Options error: Unrecognized option or missing or extra parameter(s) in client.ovpn:128: down-pre (2.4.0) 17:58 < fs0ciety> any ideas 18:38 < KNERD> maybe the script is the problem 18:44 < fs0ciety> i shall have a look 18:44 < fs0ciety> thanks 19:35 < egrain> !welcome 19:35 <@vpnHelper> "welcome" is (#1) Start by stating your !goal, such as 'I would like to access the internet over my vpn' (*not* '!goal ' - the bot doesn't understand that - just '!goal' [without the quotes]), or (#2) New to IRC? see the link in !ask, or (#3) We may need you to !paste your !logs and !configs and maybe !interface to help you, or (#4) See !howto for beginners, or (#5) See !route for lans 19:35 <@vpnHelper> behind openvpn, or (#6) !redirect for sending inet traffic through the server, or (#7) Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm, or (#8) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict), or (#9) And again, if you think you need !tap, you're probably wrong, or (#10) see !1925 before arguing with the admins or the person helping you 19:36 < egrain> !goal 19:36 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc 19:38 < egrain> I would like to know what openssl versions my clients use. the version of their OS would also be nice. Basically everything --push-peer-info promises. I have "push-peer-info" in the server.conf, but i only get the basic info like what openvpn version and what kind of OS. The man page says "when it's enabled" (paraphrasing) so I'm guessing i have to put a "true" or "enabled" behind it, but then openvpn doesn't start. help would be appreciated. 19:58 < KNERD> !redirect 19:58 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns, or (#3) if using ipv6 try: route-ipv6 2000::/3, or (#4) Handy troubleshooting flowchart: 19:58 <@vpnHelper> http://pekster.sdf.org/misc/redirect.png 20:00 < KNERD> !nat 20:00 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !openvznat !winnat and !fbsdnat for specific howto 20:01 < KNERD> openvznat 20:01 < KNERD> !openvznat 20:01 <@krzee> !factoids search openvz 20:01 <@vpnHelper> "openvz" is (#1) http://wiki.openvz.org/VPN_via_the_TUN/TAP_device to learn bout openvz specific stuff with regards to openvpn, or (#2) It is usually less painful to switch to a host with better virtualization technology, eg KVM or Xen 20:02 <@krzee> !factoids search vz 20:02 <@vpnHelper> "openvz" is (#1) http://wiki.openvz.org/VPN_via_the_TUN/TAP_device to learn bout openvz specific stuff with regards to openvpn, or (#2) It is usually less painful to switch to a host with better virtualization technology, eg KVM or Xen 20:02 < thereyouare> !nerd 20:03 < KNERD> well..the guide points me to "you ,you likely have a firewall issue." 20:04 <@krzee> oh, my flowchart? 20:04 < KNERD> yes 20:04 <@krzee> nice 20:04 <@krzee> to see if your nat rule is messed up, watch tcpdump 20:05 <@krzee> see if packets are going out eth0 as vpn ip 20:05 <@krzee> if so, we know its the nat rule 20:06 < KNERD> doing now 20:08 < KNERD> krzee: don't see the 10.x.x.x IP address in tcpdump 20:09 <@krzee> see the traffic at all? 20:09 < KNERD> yes...to and from my client, and server 20:11 <@krzee> i guess i should not have assumed, this is traffic destined for the internet, right? 20:11 <@krzee> we're on the redirect flowchart, right? 20:11 <@krzee> (i also made flowcharts for clientlan and serverlan) 20:11 < KNERD> this one http://pekster.sdf.org/misc/redirect.png 20:11 <@krzee> ok good 20:12 <@krzee> i assumed right 20:12 <@krzee> soooo do you have a complex firewall? 20:12 < KNERD> IP tables. 20:12 <@krzee> i mean the config 20:12 < KNERD> I can see .openvpn .openvpn: UDP, length 93 20:12 < KNERD> it is possible.... 20:13 <@krzee> for example if its stock openwrt i dont want to look at the firewall config lol 20:13 <@krzee> but alright, post iptables-save -c 20:13 < KNERD> just good ol Debian 20:13 <@krzee> oh good 20:13 <@krzee> lol 20:13 < KNERD> 8 20:13 <@krzee> ever seen stock openwrt firewall? you need eye bleach after that thing 20:14 < KNERD> not yet..but it was on my bucket list 20:14 < KNERD> 2 routers with OpenWRT coming 20:14 < KNERD> this is a remote server 20:15 < KNERD> oddly..any connection already made still continutes to function, but new ones are denied 20:16 <@krzee> conntrack rules? 20:16 <@krzee> keep-state? 20:16 < KNERD> i dont know 20:16 <@krzee> if you made a rule stopping the vpn after connections exist, but have a keepstate rule allowing active connections, that could cause that 20:17 <@krzee> but ya, when you get a chance show me the iptables-save -c and we'll try to see if theres a firewall issue 20:17 <@krzee> im wondering if ip forwarding is blocked 20:17 <@krzee> also when you check this in tcpdump, use ping and filter for all icmp 20:18 <@krzee> that way if its going as an unexpected address, you'll still see it 20:20 < KNERD> krzee: ip tables -c http://pastebin.com/Bm5wmA25 20:21 <@krzee> ya man 20:21 <@krzee> !linipforward 20:21 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware, or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT 20:21 <@krzee> see the firewall rule at #3 20:22 < KNERD> i did thta earlier...let me try again 20:23 <@krzee> maybe you rebooted since 20:23 <@krzee> or reloaded old firewall rulesets 20:23 <@krzee> but your only forward chain reference in that ruleset is default DROP 20:24 <@krzee> hmm but it got hit 0 times so i dont think that alone will fix this 20:24 < KNERD> http://pastebin.com/XiAbxmv8' 20:24 <@krzee> so do that first, then test again, then when it doesnt work tell me 20:25 <@krzee> yep new rules look better for that, you tested again and it doesnt work still, right? 20:25 <@krzee> so now, cat /proc/sys/net/ipv4/ip_forward 20:26 < KNERD> it's 0 20:26 < thereyouare> why there is no "/proc/sys/net/ipv6/ip_forward" file in my system ? 20:26 < KNERD> i need to change it then 20:27 < thereyouare> I do have /proc/sys/net/ipv6/ directory 20:27 < KNERD> okay..it's now 1...retesting 20:29 < KNERD> krzee: No change, but tcpdump is displaying something new... 20:19:30.355571 IP 13.107.21.200.https > 20:30 <@krzee> KNERD: even if it doesnt work, show me iptables-save -c again 20:30 <@krzee> we'll see if we got passed that problem 20:30 <@krzee> which im sure we did 20:30 <@krzee> https? i told you to use ping 20:30 <@krzee> [18:08] also when you check this in tcpdump, use ping and filter for all icmp 20:30 <@krzee> [18:09] that way if its going as an unexpected address, you'll still see it 20:31 < KNERD> krzee: http://pastebin.com/2BS3uTQy 20:31 < KNERD> okay.repinging 20:33 < KNERD> krzee: I see ping going out to 8.8.8.8 as 0:23:05.848302 IP google-public-dns-a.google.com.domain > but nothing coming back on the client screen except no response 20:35 <@krzee> KNERD: what source ip on the ping...? 20:36 <@krzee> ok good, i see forwarding is happening now 20:36 <@krzee> [131:6813] -A FORWARD -i tun+ -j ACCEPT 20:36 <@krzee> [131:6813] (that part) 20:36 <@krzee> now, when you see that ping go out, is it the VPN ip as the source ip>/ 20:38 <@krzee> if so, it tells me the NAT rule is our new problem 20:38 <@krzee> you are on openvz... your public interface is eth0??? 20:38 < Muimi> can you guys help me set openvpn up on centos 6.9? 20:38 <@krzee> KNERD: shouldnt it be some weird openvz interface name? 20:39 < KNERD> krzee: it's not IP, but the FQDN 20:39 <@krzee> i dont know openvz but from helping people in here i remember it being something else 20:39 <@krzee> KNERD: thats cause you didnt use -n lol 20:39 < Muimi> I'm having trouble gaining access to some server info that might be required. 20:39 < KNERD> krzee: no..it's no OpenVZ 20:39 <@krzee> oh then whyd you !openvznat 20:39 <@krzee> hehehe 20:40 <@krzee> Muimi: you will want to ask a more specific question, unless you're looking to hire somebody to do it for you 20:40 < KNERD> I didn't have my specticals on and thought it said openvpnnat 20:40 <@krzee> oh i got ya :D 20:40 <@krzee> so your internet facing interface *is* eth0, right? 20:40 < KNERD> yes 20:41 < KNERD> the source is a FQDN 20:41 < KNERD> no IP 20:41 < Muimi> So, right now, I'm trying to set up a ca certificate. 20:41 <@krzee> no, its ALWAYS an ip, use -n to stop resolving 20:41 < Muimi> I'm following this guide. Is this a good guide? http://www.server-world.info/en/note?os=CentOS_6&p=openvpn 20:41 <@vpnHelper> Title: CentOS 6 - OpenVPN - Install/Configure : Server World (at www.server-world.info) 20:41 <@krzee> !easy-rsa 20:41 <@vpnHelper> "easy-rsa" is (#1) easy-rsa is a certificate generation utility., or (#2) Download here: https://github.com/OpenVPN/easy-rsa/releases, or (#3) Tutorial here: https://community.openvpn.net/openvpn/wiki/EasyRSA 20:41 <@krzee> !walkthrough 20:41 <@vpnHelper> "walkthrough" is if you are using some walkthrough and now you are here cause you have problems and dont understand your setup, type !howto and !man and try to actually learn what you're doing. most those docs about openvpn from google SUCK. 20:42 < KNERD> krzee: what should be set with -n? That nat command? 20:42 <@krzee> Muimi: follow the tutorial thats in !easy-rsa for making certs 20:42 <@krzee> or try: 20:42 <@krzee> !xca 20:42 <@vpnHelper> "xca" is (#1) XCA is a GUI to create/manage a PKI, much more user-friendly than easy-rsa., or (#2) Example XCA PKI for OpenVPN(writeup pending): https://community.openvpn.net/openvpn/wiki/XCA 20:42 < thereyouare> !rsa 20:42 <@krzee> KNERD: the tcpdump command, you only see FQDN because you are resolving it 20:43 <@krzee> -n is no resolv 20:43 < KNERD> oh okay 20:43 <@krzee> !hard-rsa 20:44 < KNERD> krzee: 20:34:29.935328 IP 8.8.4.4.53 > 104.192.169.78.55676: 11560 1/0/0 A 131.107.255.255 (50) 20:34:29.935825 IP 10.0.1.118 > 104.192.169.78: ICMP host 192.168.1.160 unreachable, length 36 20:44 <@krzee> there we go 20:44 < Muimi> is it necessary to have those certificates to use openvpn? 20:44 <@krzee> Muimi: no, you can use PSK instead 20:44 <@krzee> !secretkey 20:44 <@krzee> !forwardsecurity 20:44 <@vpnHelper> "forwardsecurity" is (#1) in server/client mode with certs your key renegotiates (changes) every hour (by default), so if someone captures your traffic, and then gets your key, they can not decrypt past traffic, or (#2) in ptp mode (static key) you do not have this, so if someone gets your key they can decrypt ANY past traffic that they captured 20:45 <@krzee> in the howto it goes over making a simple PSK (ptp) connection 20:45 < Muimi> Well, how can I just get the bare-minimum basics of installing OpenVPN ? 20:45 <@krzee> but there wont be client/server 20:45 <@krzee> Muimi: openvpn is advanced networking, its not very basic 20:45 <@krzee> unles syou have a background in networking 20:45 <@krzee> theres a learning curve to start 20:46 < Muimi> I installed vpn on ubuntu, and it was really easy, you know? 20:46 < Muimi> it took like 25 minutes. 20:46 <@krzee> its 100% the same on any linux 20:46 <@krzee> really on any OS 20:46 < Muimi> Nah, because yum. 20:46 <@krzee> so if debian was easy, centos is 100% as easy 20:46 <@krzee> nah, because same shit 20:46 < Muimi> And also, I'm not in the US, so I don't have as much information. 20:46 < Muimi> And I don't know all the commands in Centos to get the info that I need directly from the OS. 20:47 <@krzee> and i use both centos and debian, im positive its same 20:47 < Muimi> So, I was really hoping someone would maybe help me out with some of the commands to get the info to fill in teh blanks, you know? 20:47 <@krzee> same commands in centos and debian for the most part dude 20:47 < Muimi> Centos, Debian (neither ubuntu). 20:47 <@krzee> thats not really a valid question tho 20:47 < Muimi> Aren't Centos and Debian essentially the same? 20:47 <@krzee> no, ubuntu and debian are 20:47 <@krzee> centos and redhat 20:48 <@krzee> ubuntu is based on debian 20:48 <@krzee> centos is made by redhat 20:48 < Muimi> okay, so the CA certificates say I need export key country, province, etc. 20:48 <@krzee> just follow the guide at !easy-rsa 20:49 < Muimi> !easy-rsa 20:49 <@vpnHelper> "easy-rsa" is (#1) easy-rsa is a certificate generation utility., or (#2) Download here: https://github.com/OpenVPN/easy-rsa/releases, or (#3) Tutorial here: https://community.openvpn.net/openvpn/wiki/EasyRSA 20:49 <@krzee> KNERD: whats your VPN subnet? 20:50 <@krzee> in your server config, server 20:50 < KNERD> krzee: I have none set 20:51 < KNERD> the server is remote to me 20:51 <@krzee> you have to 20:51 <@krzee> well the server has a vpn subnet 20:51 <@krzee> what is it 20:51 < KNERD> dedicated server in a colo 20:52 <@krzee> i dont think you get the question 20:52 <@krzee> for there to be a vpn server, there is a config file for openvpn on the server 20:52 <@krzee> in that config file there is a line starting with the word server 20:52 <@krzee> i want to see that line. 20:52 < KNERD> oh yes 20:52 < Muimi> ./easyrsa init-pki is something I should type into the CLI? 20:53 < Muimi> https://github.com/OpenVPN/easy-rsa/blob/v3.0.0-rc1/README.quickstart.md 20:53 <@vpnHelper> Title: easy-rsa/README.quickstart.md at v3.0.0-rc1 · OpenVPN/easy-rsa · GitHub (at github.com) 20:53 < KNERD> krzee: local 104.192.169.78 20:53 < KNERD> oh..server 20:53 < KNERD> server 10.8.0.0 255.255.255.0 20:53 <@krzee> Muimi: you really going to read it and then run the commands by us? 20:53 <@krzee> just read it and try 20:54 <@krzee> if you have problems, then ask 20:54 <@krzee> hmm that nat rule looks fine 20:54 <@krzee> and its getting hit 20:54 <@krzee> !configs 20:54 <@vpnHelper> "configs" is (#1) please !paste your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and ovpn version, or (#2) dont forget to include any ccd entries, or (#3) pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config, or (#4) remove inline private key or tls-auth key before posting 20:54 <@krzee> KNERD: ^ 20:55 < KNERD> okay.. 20:56 < KNERD> krzee: Server http://pastebin.com/Xvau1XR7 20:57 <@krzee> you probably dont need bypass-dhcp 20:57 <@krzee> you dont need mode server (its included in --server) 20:57 < KNERD> client http://pastebin.com/aXNnshtQ 20:57 < KNERD> krzee: I tried without bypass-dhcp and same result 20:58 <@krzee> ya i wouldnt expect that to fix it 20:58 < KNERD> as you can see by the line under 20:58 <@krzee> just letting you know what i saw when i saw it 20:58 < KNERD> and I apreciate it 20:58 <@krzee> are you able to restart the vpn server without booting yourself off? 20:58 <@krzee> (like you have sshd without openvpn) 20:59 < KNERD> no..no console 20:59 <@krzee> only access is over openvpn? 20:59 < KNERD> oh. no..I have SSH to the public IP 20:59 <@krzee> ok good 20:59 <@krzee> so put verb 4 on both and get me some logs please 20:59 <@krzee> !logs 20:59 <@vpnHelper> "logs" is (#1) please pastebin your logfiles from both client and server with verb set to 4 (only use 5 if asked), or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log, or (#3) In the OS X client(Tunnelblick) right-click it and select Copy log text to clipboard, or (#4) if you dont know how to find your logs, see !logfile 20:59 <@krzee> !logfile 20:59 <@vpnHelper> "logfile" is (#1) If you want logging you can easily just specify your own logfile with: log /path/to/logfile, or (#2) openvpn will log to syslog if started in daemon mode, but without any log-redirection options, openvpn sends output to stdout., or (#3) verb 3 is good for everyday usage, verb 5 for debugging. see --daemon --log and --verb in the manual (!man) for more info 21:00 <@krzee> (both sides) 21:01 < Muimi> krzee: I woudln't run them all by you except that it doesn't work. 21:02 <@krzee> oh i didnt think you had the chance to read it all and then start trying in the 4 minutes between me giving link and you asking that 21:03 < Muimi> -bash: ./easyrsa: No such file or directory 21:03 <@krzee> did you download easy-rsa 3 from the site? 21:03 <@krzee> or you're using something old from that walkthrough you were on before? 21:04 < Muimi> No, i used yum --enablerepo=epel -y install easy-rsa to install it 21:04 <@krzee> and is it the same version? 21:04 < Muimi> good question let me check. 21:04 < KNERD> krzee: client http://pastebin.com/jT6iU38J 21:04 <@krzee> $50 says its not ;] 21:05 < Muimi> 2.2.2-1.e16. 21:05 < Muimi> so probably not. 21:05 <@krzee> nope, 2.2.2 != 3 21:05 < KNERD> krzee: Server http://pastebin.com/vf1e7z1Q 21:06 < Muimi> Okay, well it doesn't say to install it in the quickstart guide. Let me get it installed if I can. 21:06 <@krzee> it does say its the quickstart guide for easy-rsa 3, i think its fair to assume youd use easy-rsa 3 while using it, so i wont push to modify that 21:07 <@krzee> funny enough KNERDall those multi errors in the server can be safely ignored 21:07 < Muimi> Yeah, that's great. But it's not a quickstart if I have to search the internet for how to install it 21:07 < Muimi> it's a non-start 21:08 <@krzee> (some misconfigured app is sending traffic as ipv6 over the tunnel, that stuff gets dropped, and harms nothing) 21:08 <@krzee> Muimi: you're AT the github page for downloading it 21:08 < KNERD> :-) Some people would have complained I di dnot send about 21:08 < Muimi> I can't be at the github page because github doesn't work in my country, bro. 21:08 <@krzee> you linked me to the github page! 21:09 < Muimi> Oh. they enabled it. 21:09 <@krzee> [18:44] ./easyrsa init-pki is something I should type into the CLI? 21:09 <@krzee> [18:44] https://github.com/OpenVPN/easy-rsa/blob/v3.0.0-rc1/README.quickstart.md 21:09 <@vpnHelper> Title: easy-rsa/README.quickstart.md at v3.0.0-rc1 · OpenVPN/easy-rsa · GitHub (at github.com) 21:09 <@krzee> you literally liked me to the github lol 21:09 < Muimi> lol 21:11 < Muimi> I'm really happy they've finally unbanned it. 21:11 <@krzee> ya i hate that too 21:11 <@krzee> i do have plenty of ways around it, but annoying still 21:11 <@krzee> if i ever go to openvpn.net without bouncing through another country i have to click a box to say im not a robot lol 21:11 <@krzee> and i go to openvpn.net often! 21:11 < Muimi> So I have to use git to install it basically? 21:12 <@krzee> nah github will let you grab a zip 21:12 <@krzee> or you can git 21:12 < Muimi> the server is all text-based. 21:12 <@krzee> https://github.com/OpenVPN/easy-rsa/archive/v3.0.0-rc1.zip 21:12 < skyroveRR> git clone https://github.com/openvpn/easy-rsa 21:12 <@vpnHelper> Title: GitHub - OpenVPN/easy-rsa: easy-rsa - Simple shell based CA utility (at github.com) 21:12 <@krzee> ya or that ^ 21:12 <@krzee> sup sky 21:13 < skyroveRR> A calm morning. 21:13 <@krzee> and a long evening for me :D 21:13 <@krzee> i feel like ive been here at work for 30 hours (its only been like 6) 21:13 < skyroveRR> (: 21:14 <@krzee> and i been all over those freelancer sites doing side work from the office, trying to save all i can for a new house 21:14 <@krzee> doing vpn setups, writing bash scripts, whatever 21:15 < skyroveRR> ooooh. nice. 21:15 <@krzee> im even thinking about taking data entry jobs and automating them in bash (everybody wants stuff in excell, which i see as a csv waiting to be made) 21:15 < Muimi> yeah how much would you charge to set up my VPN for me and save the terimnal log file for me to read through? 21:16 <@krzee> the terminal log wouldnt help much, it would mostly just be setting up configs and putting them in place 21:16 <@krzee> Muimi: 21:16 <@krzee> !goal 21:16 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc 21:16 < skyroveRR> krzee: hope your wish of getting a new house comes true soon. 21:16 < Muimi> internet. 21:16 <@krzee> thanks skyroveRR! im looking at a BEAUTIFUL one on wednesday 21:16 <@krzee> Muimi: may i msg you? 21:17 < Muimi> yeah sure. 21:17 < redrabbit> hi, i'm looking for a way to reduce idle data use, its around 700mb/month just to maintain the link. cost a lot in 3G, someone told me i had to disabled the "ping family of options", any ideas how 21:18 <@krzee> redrabbit: are you using --keepalive in your config? 21:18 <@krzee> (likely in server config) 21:19 <@krzee> 700mb sounds like a lot, you should probably set a firewall to watch wtf is causing that, i doubt its just openvpn keepalives 21:19 <@krzee> might have some misconfigured app sprewing crap 21:20 <@krzee> also, make sure you use tun not tap 21:20 <@krzee> tap would tunnel layer2 crap that you dont want taking up your precious bandwidth 21:20 < redrabbit> here is what i have : keepalive 10 120 21:20 < redrabbit> my measurements may be flawed though 21:20 < KNERD> redrabbit: did you get that test server up? 21:20 < redrabbit> probably because there is a ssh terminal open 21:21 < redrabbit> KNERD: nope but you should try starting fresh 21:21 < KNERD> I think it is getting close to solved 21:21 <@krzee> redrabbit: so now to see the ping options you are using, go look at --keepalive in the manual, see what it expands to 21:21 <@krzee> !man 21:21 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/, or (#2) the man pages are your friend!, or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker 21:21 < redrabbit> i never used tap 21:21 <@krzee> redrabbit: keepalive is a helper directive that expands to some --ping options 21:21 <@krzee> thats likely the options that your friend said to look at 21:22 <@krzee> honestly, i dont think you have 700MB of those tho 21:22 <@krzee> there should be something else going on id say 21:22 < redrabbit> very probable 21:25 <@krzee> !as 21:25 <@vpnHelper> "as" is Please go to #OpenVPN-AS for help with commercial products from OpenVPN Technologies, including Access Server, OpenVPN Connect for iOS/Android, etc. Access Server is a commercial product, different from open source OpenVPN 21:28 < KNERD> Any more ideas krzee? I would assume this is now an IP tables issue 21:29 <@krzee> sorry got sidetracked 21:29 < KNERD> yes, I know..it's okay :-) 21:30 <@krzee> well i agree, everything looks pretty good in openvpn 21:31 <@krzee> lemme grab my flowchart 21:31 < KNERD> you mean you don;t have it pasted in yoru desk :-p 21:34 <@krzee> lol nope, i generally dont need to look at them but im a little fried this evening 21:36 <@krzee> work is gunna be busy for a few 21:36 <@krzee> then ill be headed home and free for a bit 21:36 <@krzee> KNERD: you gunna be here? 21:37 < KNERD> probably so 21:38 < KNERD> I am stll a lot ticked that hosting service wiped my VPS, so my settings I had which had this rresoled are gone 21:39 < KNERD> redrabbit: whith the help here we have discovered 20:34:27.926941 IP 10.0.1.118 > 104.192.169.78: ICMP host 192.168.1.152 unreachable, length 36 21:39 <@krzee> my only suggestion between now and then is you could save your firewall ruleset and then reduce the hell out of it temporarily 21:39 <@krzee> for the vpn you'll need the ip forwarding rule and the nat rule 21:40 < KNERD> why not just disable it for a moment to see if i can connect? 21:40 <@krzee> without the ip forwarding and nat you wont have a working redirect setup 21:40 < KNERD> oh 21:41 < KNERD> see..I know little asbout IP tables 21:41 <@krzee> iptables-save > /tmp/firewall (saves a backup) 21:41 <@krzee> iptables-restore < /tmp/firewall (loads the backup) 21:41 <@krzee> you may also copy the file, mod it, then load that 21:42 < KNERD> oh..thanks 21:42 <@krzee> np 21:42 <@krzee> ill be gone for a bit 21:42 <@krzee> *afk 21:43 < KNERD> sure thing 22:15 < Muimi> so, i finally got easy-rsa into /usr/share/rsa. Then I went to that directory and typed .easyrsa init-pki, and it said 'command not found'. 22:16 < Muimi> Do I need to do an easy_install? ^^ 22:19 < Muimi> Oh. Nevermind. I see what it's hoping. 22:23 < egrain> I would like to know what openssl versions my clients use. the version of their OS would also be nice. Basically everything --push-peer-info promises. I have "push-peer-info" in the server.conf, but i only get the basic info like what openvpn version and what kind of OS. The man page says "when it's enabled" (paraphrasing) so I'm guessing i have to put a "true" or "enabled" behind it, but then openvpn doesn't start. do i need to recompile or am i just 22:23 < egrain> simply forgetting something? 22:32 < Muimi> Is my user, host, or server name my ipv4 address? 23:07 < KNERD> you don;t know what an IP4 address is? 23:08 < KNERD> Vampire0: i got it... :INPUT DROP [25:1582] && :FORWARD DROP [0:0] was doing it 23:09 < KNERD> however stil have a problem... /proc/sys/net/ipv4/ip_forward keeps reverting back to 0 on reboot 23:10 < ordex> KNERD: the default is 0. you can change the value set on boot by altering /etc/sysctl.conf 23:11 < KNERD> ordex: that? net.ipv4.conf.all.rp_filter=1 23:11 < ordex> net.ipv4.ip_forward 23:11 < ordex> same as the path 23:12 < ordex> make it: net.ipv4.ip_forward=1 23:12 < KNERD> ordex: oh..okay..I uncommented the wrong wone 23:12 < KNERD> thanks 23:12 < ordex> np 23:12 < Muimi> i know what it is. i don't know if it's what belongs there. 23:12 < ordex> Muimi: I think your question is too generic - you should give some context 23:13 < Muimi> Is there an easy-to-follow howto on installing OpenVPN so that I can connect to the VPN via another device to browse the internet through that VPN. 23:13 < Muimi> "Common Name (eg: your user, host, or server name)" 23:13 < KNERD> millions...i just got mine up and running 23:13 < Muimi> After ./easyrsa build-ca 23:14 < Muimi> KNERD: can you link me to one? 23:14 < Muimi> for centos 6 23:14 < KNERD> Muimi: https://www.digitalocean.com/community/tutorials/how-to-setup-and-configure-an-openvpn-server-on-centos-6 23:15 <@vpnHelper> Title: How to Setup and Configure an OpenVPN Server on CentOS 6 | DigitalOcean (at www.digitalocean.com) 23:16 < KNERD> I have been running into issues with Ip Tables blocking forwarding which prevents you from connecting...see my last message to krzee on this: 23:16 < KNERD> and I have set up a lot of openvpn servers, but only for connecting locally...this is my second time with browsing 23:17 < KNERD> Groovy...now I can get back to CBS On Demand, Hulu, Sling TV, etc. 23:20 < Muimi> For "user nobody" and "group nobody" should I leave them as "nobody"? 23:21 < KNERD> for CentOS that is fine, but in Debian I notice it does no like group nobody 23:21 < KNERD> you can put nogroup if you want 23:22 < Muimi> will that work in centos? 23:23 < KNERD> nogroup? I am sure it will, but nonody also works 23:23 < Muimi> cp -rf /usr/share/openvpn/easy-rsa/2.0/* /etc/openvpn/easy-rsa ... no such directory (easy-rsa) 23:24 < KNERD> was easy-rsa installed? 23:24 < Muimi> Yes. 23:24 <@krzee> hey im back 23:24 < KNERD> easy rsa is in EPEL repo 23:24 < Muimi> I have 2 and 3 installed. 23:25 <@krzee> KNERD: epel probably has easy-rsa2, you should use 3 23:25 < KNERD> krzee: i got it reseolved 23:25 <@krzee> nice! 23:25 <@krzee> what was it? 23:25 < KNERD> :INPUT DROP [25:1582] 23:25 < KNERD> :FORWARD DROP [0:0] 23:25 < KNERD> removed those and working now 23:25 < Muimi> right. so, i extracted that and moved it to some other directory probably, and then I tried to destroy the changes because none of the tutorials matched what the directories looked like, including the built-in "quickstart guide" 23:25 <@krzee> oh blocking tun on input too 23:25 < Muimi> like that thing is intentionally misleading, you know? 23:26 <@krzee> KNERD: you can go back to drop and add another line like the FORWARD rule but for INPUT for tun+ device 23:26 <@krzee> Muimi: the quickstart guide doesnt even mention a directory 23:27 < KNERD> Muimi: that guide worked fine for me..HOWEVER I think there was some changes in 6.8 it seems differenent 23:27 <@krzee> it assumes you are in the proper directory 23:27 < Muimi> Should I do this: mv easy-rsa-3.0.0-rc1/* /usr/share/openvpn/easy-rsa/* ? 23:27 < Muimi> I know: that's why it's misleading 23:27 < KNERD> you can if you want 23:27 < Muimi> You can't just type commands in. you need a directory. How is it quick if yuo have to figure out which directory it is 23:27 <@krzee> KNERD: lets not confuse things, lets have him use the actual openvpn docs instead of what you found online that probably is for easy-rsa2 23:28 < KNERD> yes..it is easy-rsa 2 23:28 <@krzee> heh 23:28 <@krzee> !walkthrough 23:28 <@vpnHelper> "walkthrough" is if you are using some walkthrough and now you are here cause you have problems and dont understand your setup, type !howto and !man and try to actually learn what you're doing. most those docs about openvpn from google SUCK. 23:28 < KNERD> but it still works for me 23:28 <@krzee> KNERD: wanna show me one of your public keys? 23:29 <@krzee> (they're public, thats safe) 23:29 < KNERD> how so? 23:29 < KNERD> i man which one 23:29 <@krzee> client server or ca 23:29 < Muimi> right-- 23:30 < Muimi> I mean, here's the thing: softwares like Maya win tutorial of the year every year because they speak to the reader, you know? Even an advanced user is going to have trouble figuring this stuff out. 23:30 < Muimi> A quickstart is supposed to be a howto. 23:30 < KNERD> krzee: http://pastebin.com/MTPjtf90 23:30 < KNERD> Hey, I am using this for Hulu, SlingTV CBS all Acess, not security 23:30 <@krzee> KNERD: oh your cert doesnt have anything above that in cleartext? 23:31 < Muimi> Wait, KNERD, I just want to know about that command I was using: 23:31 < Muimi> mv easy-rsa-3.0.0-rc1/* /usr/share/openvpn/easy-rsa/* 23:31 < KNERD> krzee: no 23:31 < Muimi> easy-rsa-3.0.0-rc1 is the directory which contains the contents of the .zip file rsa3. 23:31 < Muimi> I've made the directory and what-all 23:32 < KNERD> it contains the script to generate the cetificares easy so you dont have to keep retypign all that stuff in 23:32 <@krzee> it doesnt matter where you put the easy-rsa3 dir or what you name it 23:32 <@krzee> what matters is that you go in to the dir and follow the directions on the guide 23:33 < KNERD> krzee: http://pastebin.com/vTiiYFxY this? 23:33 < Muimi> @ KNERD but in the tutorial you're using, here (https://www.digitalocean.com/community/tutorials/how-to-setup-and-configure-an-openvpn-server-on-centos-6), it says ...rsa/2.0 23:33 <@vpnHelper> Title: How to Setup and Configure an OpenVPN Server on CentOS 6 | DigitalOcean (at www.digitalocean.com) 23:33 <@krzee> Muimi: if thats too hard, you can try a gui 23:33 <@krzee> !xca 23:33 <@vpnHelper> "xca" is (#1) XCA is a GUI to create/manage a PKI, much more user-friendly than easy-rsa., or (#2) Example XCA PKI for OpenVPN(writeup pending): https://community.openvpn.net/openvpn/wiki/XCA 23:33 < Muimi> so they're still using 2.0. Not that I mind: I just want something that works, and I actually prefer to avoid the much more confusing 3.0 23:33 <@krzee> easy-rsa isnt the only option for your CA 23:33 < Muimi> can't use the GUI. No monitor. 23:33 <@krzee> you dont have a monitor on any computers? 23:33 < Muimi> choosing a new option means uninstalling and re-installing things which is just a lengthy process. 23:33 < KNERD> Muimi: it is using easy-rsa from the EPEL repo 23:34 < Muimi> it's remote. 23:34 <@krzee> you shouldnt be running your CA on your server btw 23:34 <@krzee> lol 23:34 < KNERD> Muimi: you dont need a monitor.... you can do X-Fowarding, and run Ming, and x-server on your PC 23:34 < KNERD> sorry.. X-Ming 23:34 < Muimi> it says it's already installed. I think the one from epel repo installs to a different directory on centos. 23:35 <@krzee> i mean you can, but its not recommended 23:35 < Muimi> -bash: cd: 2.0: No such file or directory 23:35 < KNERD> it must be a nwer version 23:35 < Muimi> 2.2.2 23:35 < KNERD> just use the newer directory 23:35 < Muimi> there isn't one. 23:35 <@krzee> are you using KNERD's guide or something? 23:35 < Muimi> -bash: cd: easy-rsa: No such file or directory 23:35 <@krzee> cause you're talking about stuff that doesnt exist in any openvpn guides 23:35 < KNERD> WHat is under /etc/openvpn/easy=rsa ? 23:36 <@krzee> it doesnt matter where you unzip easy-rsa to! 23:36 <@krzee> just enter the dir! 23:36 < Muimi> but it's asking for /share not /etc. 23:36 < Muimi> cp -rf /usr/share/openvpn/easy-rsa/2.0/* /etc/openvpn/easy-rsa 23:36 < KNERD> okay then 23:36 <@krzee> lol ok i give up 23:36 < Muimi> https://www.digitalocean.com/community/tutorials/how-to-setup-and-configure-an-openvpn-server-on-centos-6 23:36 <@vpnHelper> Title: How to Setup and Configure an OpenVPN Server on CentOS 6 | DigitalOcean (at www.digitalocean.com) 23:36 <@krzee> enjoy those lame google walkthroughs 23:36 < Muimi> I'd accept any walkthrough that worked, krzee 23:36 <@krzee> no, obviously you wouldnt 23:36 < Muimi> If they're really that lame, openvpn should make one that works and isn't lame. 23:37 <@krzee> works for everybody else! 23:37 < KNERD> I created my own guide which I blindly follow for CentOS...been working 100% of the tiem for me 23:37 < Muimi> Last time I installed a VPN on ubuntu, I used digitalocean and finished in about 15 minutes. 23:37 < Muimi> This has already taken 4 hours. 23:37 <@krzee> KNERD: you're using a super old version of easy-rsa 23:37 <@krzee> KNERD: so you shouldnt even be helping him do it wrong lol 23:37 < KNERD> still works 23:37 <@krzee> works depends on what you want 23:37 < Muimi> Exactly: if it works, that's the goal. 23:37 <@krzee> you can have a bad setup with less than that 23:37 < KNERD> he wants to do what I am doing...browsing 23:37 <@krzee> why go through the trouble if you aint gunna use the right tools? 23:38 <@krzee> cool, ill let you help him 23:38 < Muimi> Did the old versions not work? 23:38 <@krzee> old versions use weaker stuff 23:38 <@krzee> and may or may not work, i dont know if anybody maintains them at all 23:38 < Muimi> Yeah, but there's no point in releasing something without proper documentation. 23:38 < Muimi> You might as well keep it in the spider hole where only you can use it. 23:38 <@krzee> worked when they were the active version for sure 23:39 <@krzee> Muimi: literally only you have the problem you describe 23:39 <@krzee> you been doing this over an hour and havent figured out how to enter the dir after you unzip and follow the instructions 23:39 < KNERD> Here is my command cp -rf /usr/share/easy-rsa/2.0/* /etc/openvpn/easy-rsa/ so just change it to 3.x and be done 23:39 < Muimi> First of all, you're dealing with a limitted audience. Second, I like to complain (especially about tutorials), which is very dissimilar to your standard linux user. 23:40 < KNERD> you are just copying the contents of the scipt to easy-rsa to run it from one location 23:40 <@krzee> cool, i dont think i can help you do this on your own, but i wish you guys luck 23:40 < Muimi> I'm just saying: why should people "do it on their own"? 23:40 < KNERD> but krzee knows this stuff better than me 23:41 < Muimi> There should be a quickstart guide that stays each command requierd, without glazing over commands like which directory you're supposed to be in. 23:41 <@krzee> what i mean is that im not sure you have the skill level to be doing this, you should probably hire a tech 23:41 < Muimi> It seems like a gimic. Maybe just trying to sell the easy-to-use service or something, in the end. 23:41 <@krzee> or maybe use openvpn-as 23:41 < Muimi> No, krzee. It doesn't mean that. It means information was intentionally ignored. 23:41 <@krzee> as its made for people who cant do all this stuff on their own 23:41 < KNERD> people who develop things get to know it well, and tend to forget people new to it are not sure where to start 23:41 < Muimi> like figure out which directory they should be in, man? 23:42 < Muimi> Come on.... 23:42 <@krzee> KNERD: running a ca isnt even an openvpn thing 23:42 <@krzee> you dont even have to use easy-rsa 23:42 <@krzee> i NEVER use easy-rsa 23:42 < Muimi> but at 10:30 a.m. you asked me to use it 23:43 < Muimi> and how can you say it's easy for a tech when you haven't even used it 23:43 <@krzee> ive ran it, and ive seen thousands of people come here and have no problem 23:43 < Muimi> rsa is a nightmare. you have to install it manually, and then you need to shift it around to the right place, and then you have to figure out which directories and stuff 23:43 <@krzee> i give link, they read, they use, they say thanks 23:43 <@krzee> ive ran it, but i never use it for my stuff 23:44 < Muimi> I dunno, bro. It just seems like a shoddy tutorial to me. 23:44 <@krzee> for my stuff i mostly use my own scripts that call openssl directly, or sometimes i use xca 23:44 < Muimi> Ttyl. I'm going to keep trying to get a working vsn. 23:44 <@krzee> cool, complaining to people who donate their time is a sure way to get ignored 23:44 <@krzee> later 23:44 < Muimi> See? That's the attitude I'm talking about, man. 23:44 < Muimi> If it's broke, it's broke. You should expect people to complain. Feedback's the most valuable thing you can get from someone. 23:45 <@krzee> if it was broke it wouldnt only be you whining 23:45 < Muimi> Apart from that, you're donating your time to a smoke screen. Why would anyone appreciate it? 23:45 < Muimi> Well, that's your opinion, krzee. But it's not mine, and it's very unconvincing given the facts. 23:46 <@krzee> ive been here helping people for years, its not opinikon 23:46 <@krzee> opinion 23:46 < KNERD> yes, he has. 23:46 < KNERD> I have made numerous successful OpenVPN installed based on that link I sent you.....The issue I had today was replated to IP Tables 23:46 < Muimi> I've been making a living on writing tutorials for 9 years. It's hard to get complaints, krzee. It is an opinion, and from your background, it's the popular opinion, and it's usually wrong. 23:47 <@krzee> !stats 23:47 <@vpnHelper> I have 6 registered users with 5 registered hostmasks; 3 owners and 0 admins. 23:47 <@krzee> !ircstats 23:47 <@vpnHelper> "ircstats" is (#1) See http://secure-computing.net/logs/openvpn.html for all-time IRC stats., or (#2) See http://secure-computing.net/logs/openvpn-devel.html for all-time dev channel IRC stats. 23:47 <@krzee> Muimi: you're close to getting banned 23:47 < Muimi> But let's take another example: KNERD isn't using the quickguide. Maybe the people who come here say: "Thanks....." And then they just go use a different tutorial, and you're blissfully unaware, you know? 23:47 <@krzee> ok, bye dude, good luck elsewhere 23:48 < Muimi> Don't be ridiculous. Just because we have a difference of opinion you don't need to ban me, bro. 23:48 <@krzee> its not a difference in opinion, its you demanding that the docs are wrong because you cant figure out how to run your pki 23:49 <@krzee> and its not how people get help on irc 23:49 < KNERD> ny own guide was based on trial and error from different guides I found online. I set up a VPS on my computer and tried different things until I was happy 23:49 < Muimi> I'm not demanding that they're wrong. I'm saying it's my opinion that they're missing important details. 23:49 < Muimi> You can't change my opinion by saying I'm the first one who's mentioned it. It's the latest version. 23:49 <@krzee> !factoids search --values help 23:49 <@vpnHelper> 'router', 'notopenvpn', 'help', 'winroute', 'firestarter', 'allinfo', 'notovpn', 'irc', 'secret', 'snapshots', 'testing', 'no_as', 'msg', 'both', 'servercert', 'rocks', 'effort', 'ask', 'vampire', 'whining', 'iptables-rules', 'notovpn', 'connect', 'certman', 'netfilter', 'msg', 'netman', 'easyrsa', 'vague', 'speed', '', 'commercial', '', 'easyrsa-ng', 'speed', '', '', 'AS', 'welcome', 'welcome', and 23:49 <@vpnHelper> 'spoonfeed' 23:50 <@krzee> !welcome 23:50 <@vpnHelper> "welcome" is (#1) Start by stating your !goal, such as 'I would like to access the internet over my vpn' (*not* '!goal ' - the bot doesn't understand that - just '!goal' [without the quotes]), or (#2) New to IRC? see the link in !ask, or (#3) We may need you to !paste your !logs and !configs and maybe !interface to help you, or (#4) See !howto for beginners, or (#5) See !route for lans 23:50 <@vpnHelper> behind openvpn, or (#6) !redirect for sending inet traffic through the server, or (#7) Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm, or (#8) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict), or (#9) And again, if you think you need !tap, you're probably wrong, or (#10) see !1925 before arguing with the admins or the person helping you 23:50 <@krzee> !ask 23:50 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc, or (#2) See also, How to ask questions the smart way here: http://catb.org/~esr/faqs/smart-questions.html, or (#3) if you had asked your question this might be an answer instead of a message from the bot about how to ask questions on IRC :) 23:50 <@krzee> there, i suggest you read the link in #1 of ask 23:50 < Muimi> You're saying thousands of people have been through here looking at the new version and have all been successful using that specific tutorial or whatever.... docs get updated based on people like myself saying: "something should be added" and then adding it, eventually. 23:51 <@krzee> you're not giving constructive feedback about a detail to add 23:51 <@krzee> you're saying that because you cant even figure out how to start that its bad, and i looked and say that anybody who has business running a PKI should be able to use that doc 23:51 < Muimi> add the directories you should run the commands in. 23:52 < Muimi> that would be the first thing, you know? 23:52 <@krzee> is there a README file in the zip? 23:52 < Muimi> there's 2. 23:52 <@krzee> have you read them/ 23:52 < Muimi> yes. 23:52 <@krzee> i wont ban, but i definitely need to remove myself from here 23:52 <@krzee> goodnight guys 23:52 < Muimi> and specifically speaking about the quickstart guide: it should include directory information. 23:53 < Muimi> not must, just should 23:57 < Muimi> Goodnight, bro. My bad. I'm just trying to figure this thing out-- --- Day changed Tue Jan 03 2017 00:00 < sigquit> this is not an act of war : https://dlshad.net/bypassing-censorship-by-using-obfsproxy-and-openvpn-ssh-tunnel/ 00:00 <@vpnHelper> Title: Bypassing censorship by using obfsproxy and openVPN , SSH Tunnel Dlshad Othman Container of Scribbles (at dlshad.net) 00:03 < cyberanger> sigquit: act of war? 00:03 < Muimi> Okay seriously, though, I wonder why people are so adamant about using 3.0 00:03 < KNERD> i thoght I was going to have to set up obfsproxy on a OpenWRT router for a person in Egypt 00:03 < KNERD> Muimi: he sadi it was better 00:04 < Muimi> cyberanger: The John Quincy Adams attitude doesn't exist in every country. If you do something illegal, they just want to hunt you down instead of ask if it was constitutional. 00:04 < Muimi> Better in what way, though? I mean, for example, would the openvpn community be negatively effected if I used 2.0 instead of 3.0. 00:04 < cyberanger> Muimi: no, I get that. I've been to some of those places. 00:06 < Muimi> Doesn't the ISP block and monitor traffic for the government? I mean: how can you access a domain without the isp knowing? Isn't that impossible? 00:07 < cyberanger> It's why I keep a few servers with those tricks, obfsproxy (both versions 3 and 4) stunnel, ssh, iodine (DNS Tunneling) and even some custom code that's just a way to discreetly notify if I'm okay or not. 00:10 < cyberanger> Use the hosts file, that'd avoid DNS 00:11 < cyberanger> if IP's are blocked, don't go directly to that IP address, if you run the site, use a CDN. If you don't then SSH Tunneling, Tor or a VPN 00:11 < Muimi> Starting openvpn: [FAILED] 00:13 < cyberanger> Muimi: I'll be back on in 15 minutes, then read over things and see if I can help you. 00:13 < Muimi> yeah igotta take a break i'm zonked 00:13 < Muimi> thanks 00:14 < cyberanger> I've just clocked out from work, need the time to get home. 00:44 < cyberanger> Muimi: Okay, reading over and trying to get an idea of where your issue is. Can you give me a quick synopsis? 00:44 < Muimi> I'm working through this guide: https://www.digitalocean.com/community/tutorials/how-to-setup-and-configure-an-openvpn-server-on-centos-6 00:44 <@vpnHelper> Title: How to Setup and Configure an OpenVPN Server on CentOS 6 | DigitalOcean (at www.digitalocean.com) 00:45 < cyberanger> Muimi: Okay, and you are running CentOS 6? 00:45 < Muimi> I've just reached service openvpn start, and I got a [FAILED] error. 00:45 < Muimi> Yes, I am. 00:45 < Muimi> So, I'm trying to think of how I could figure out why it would fail. Maybe I need to restart the server or check some logs? 00:47 < cyberanger> Okay, It's been awhile for CentOS here, Debian mostly, and yeah, we can turn on some logging and a few other things. 00:48 < Muimi> At this point, I'm actually running out of time to accomplish it; so, I might end up paying a tech to finish the job, you know? 00:49 < cyberanger> Yeah, I get that. My day job is one of the techs. 00:49 < cyberanger> Have you tried just launching it without systemd, 00:49 < Muimi> It's a fresh-new server. So, there's nothing that can be damaged on it. 00:49 < cyberanger> see the output there? 00:50 < Muimi> No, I don't know how to do that. 00:51 < Muimi> i just rebooted.... see if tha thelps 00:51 < cyberanger> Where's your config file 00:51 < cyberanger> under /etc/openvpn/ 00:51 < Muimi> which one? 00:51 < cyberanger> The one where you have it failing to start up 00:52 < Muimi> I have files in /etc/openvpn that are config riels 00:52 < Muimi> files 00:54 < cyberanger> okay 00:54 < cyberanger> cd /etc/openvpn 00:54 < cyberanger> then 00:54 < cyberanger> sudo openvpn server.conf 00:55 < cyberanger> (Assuming server.conf is your server config file, and that's the machine we're talking about here) 00:56 < cyberanger> Does that give you any output? 00:56 < cyberanger> Complain about missing files perhaps? 00:57 < Muimi> hold on i'll do that now 00:57 < cyberanger> Okay 00:57 < Muimi> Options error: --explicit-exit-notify cannot be used with --mode server // Use --help for more information. 01:01 < cyberanger> I'm double checking my memory, but explicit-exit-notify is a client option, not a server option I believe (I don't use it myself anyway, different use case) 01:01 < Muimi> acnnot be used with --mode server help? 01:01 < cyberanger> Open the config file, search for explicit-exit-notify and put a # in front of it. 01:01 < cyberanger> Then try again 01:01 < Muimi> Maybe this is what has happened? 01:01 < Muimi> https://www.digitalocean.com/community/tutorials/how-to-setup-and-configure-an-openvpn-server-on-centos-6 At this guide.... 01:01 <@vpnHelper> Title: How to Setup and Configure an OpenVPN Server on CentOS 6 | DigitalOcean (at www.digitalocean.com) 01:01 < Muimi> It has a way to generate server keys and a way to generate client keys 01:02 < Muimi> and the server keys are frist, and the client keys are second. 01:02 < Muimi> maybe I overwrote the server keys with the client keys? 01:03 < cyberanger> Muimi: from the output you gave me, you have two conflicting parameters, you just have to comment out the one that doesn't apply to a server. 01:03 < cyberanger> Comment out explicit-exit-notify 01:04 < Muimi> in what file? 01:04 < cyberanger> Can you do that, then run "sudo openvpn server.conf" again? 01:04 < cyberanger> Sorry, right 01:04 < cyberanger> Comment out explicit-exit-notify in server.conf 01:04 < Muimi> server.conf? 01:04 < Muimi> Okay. It worked, now. 01:05 < cyberanger> Okay, so that fixes your server, care to try a client now? 01:06 < cyberanger> Then we can test it with systemd once we know the config files themselves aren't an issue 01:07 < Muimi> on my way to there. 01:08 < cyberanger> Forgive me, my 12 hour workday was actually a 16 hour day. I'm not rushing you, just my mind is racing a little from the caffine I think ;-) 01:09 < Muimi> do you know how to download a file from putty? 01:09 < Muimi> I know: I'm a noob, but I promise I'm working as fast as possible and not getting distracted. 01:10 < cyberanger> Muimi: Windows? 01:11 < cyberanger> Muimi: Eh, so was everyone here at some point in time, I didn't mean it like that. 01:11 < Muimi> Okay, so I'm making the -- 01:11 < Muimi> client.ovpn file. Do I need to change lines to the code? Or add BEGIN END at the top and bottom? 01:12 < Muimi> Is there any whitespace needed? 01:13 < Muimi> for example, x.x.x.x should be my server IP? 01:14 < cyberanger> Your right on the IP 01:14 < Muimi> I can't believe I need to install a program to connect rather than just using the 'connect to vpn' dialogs. 01:15 < Muimi> I hope the port isn't blocked 01:16 < cyberanger> I think if you follow the tutorial from here you should be good 01:16 < cyberanger> Transferring files I'd use SFTP, a good windows client for that would be filezilla 01:16 < Muimi> Yeah, the download is gonna take 5 minutes, you know? 01:17 < Muimi> So, I add the contents of my certs to the ovpn file.... 01:17 < Muimi> and the keys 01:17 < Muimi> and add the ip address 01:17 < Muimi> and change nothing else, basically 01:17 < cyberanger> That's how this tutorial is, yes. 01:18 < cyberanger> If something isn't matching the tutorial, or there is a port restriction, we can tweak something based on the error we get. 01:18 < Muimi> It's a litlte confusing, though 01:19 < cyberanger> But shouldn't be a need (unless you are aware of a restriction where you are) 01:19 < Muimi> client.crt doesn't start at BEGIN... there's a lot of data before that 01:19 < Muimi> like the signature algorithm 01:19 < cyberanger> Yeah, you can trim that out. 01:19 < cyberanger> For the client config 01:20 < Muimi> Do I also trim out --BEGIN CERTIFICATE--? Or do I leave that? 01:20 < cyberanger> Leave that line, but what's above it can be trimmed out 01:20 < cyberanger> If it's left in, it won't hurt either. 01:20 < Muimi> okay. 01:21 < cyberanger> Just as long as it's between the .. brackets 01:21 < cyberanger> same for and 01:22 < cyberanger> I follow the tutorial easily now, but I'll admit a decade ago when I was learning, there's a learning curve to it. 01:24 < Muimi> cool. 01:24 < Muimi> but here's the problem: it doesn't use easy-rsa 3.... 01:25 < cyberanger> What is it using? 01:25 < Muimi> which is different from easy-rsa 2, you know? 01:25 < Muimi> easy-rsa 2, and it says easy-rsa 3 was a major update with a lot of significant changes. 01:25 < Muimi> openvpn requires .net and everything, man. 01:27 < cyberanger> Shouldn't be a problem, easy-rsa is just setup for the certs and keys. 01:27 < Muimi> Now it says I don't have permission to copy the file 01:27 < cyberanger> Which file? 01:27 < Muimi> there it goes 01:28 < Muimi> failed. :'( 01:28 < cyberanger> Which file is failing 01:28 < cyberanger> ? 01:30 < cyberanger> Your client.ovpn file? 01:31 < Muimi> i'm trying to figure it out 01:32 < Muimi> it says view client.log, but there is no client.log 01:33 < cyberanger> What's failing, OpenVPN or Filezilla? 01:33 < Muimi> openvpn 01:33 < Muimi> it said exit code 1 check the log 01:34 < Muimi> Options error: Unrecognized option or missing or extra parameter(s) in client.ovpn:1: lclient (2.4.0) 01:35 <@plaisthos> Muimi: lclient is not a valid option 01:35 < cyberanger> can you open the config file in notepad, look for anything mentioning log 01:35 <@plaisthos> probably meant client 01:35 < cyberanger> Oh, plaisthos good catch. 01:36 < Muimi> the only config file is the ovpn file we made based on the tutorial. 01:37 < cyberanger> Muimi: can you open that file in notepad, look for a line with lclient in it 01:37 < Muimi> line one. 01:37 < Muimi> it says "lclient". 01:37 < cyberanger> remove the l 01:37 < cyberanger> plaisthos: thanks for spotting that 01:38 < cyberanger> Muimi: If you can fix it, it should just be client, then try again. 01:38 * cyberanger needs to switch to decaf.... 01:39 < Muimi> strange. it changed it. 01:39 < cyberanger> Huh? 01:39 < Muimi> although i deleted the old file and coppied the new file, I get the same error. I closed the program and re-imported the file, and it said "already exists". 01:40 < cyberanger> What is your client, what Windows version? (I'm presuming it's Windows) 01:41 < Muimi> win 7. openvpn. 01:41 < Muimi> using the gui 01:41 < Muimi> There already exists a file named client.ovpn. you cannot have two different files with the same name even if they reside in different folders. 01:42 < Muimi> When I click "edit config", it says lclient. 01:43 < cyberanger> Can you delete config? 01:43 < Muimi> it meaks a new one in a folder that doesn't even appear on my harddrive called client. 01:43 < Muimi> oh i finally could edit that. 01:44 < cyberanger> Okay, I have not used the Windows client in awhile... 01:45 < Muimi> key negotiation failed 01:46 < Muimi> WARNING: No server certificate verification method has been enabled 01:46 < Muimi> WARNING: No server certificate verification method has been enabled 01:46 < Muimi> hehe udp not bound 01:46 < Muimi> looks like it's gonna continue to mess with me. ^^ 01:47 < cyberanger> Did you create the client.ovpn on the server? 01:47 < Muimi> No. 01:48 < Muimi> i'll start making one, though. 01:48 < Muimi> what directory do I stow it into? Any changes to the file name? 01:49 < cyberanger> I'm just reading how the tutorial did it, do try and figure out where it's giving you issues on this step. 01:50 < cyberanger> The tutorial had you create it on the server, then transfer the one file. 01:52 < cyberanger> filename would still be client.ovpn 01:55 < cyberanger> The warning might be okay, the client config in the tutorial your using says nobind too. 01:56 < cyberanger> Key negotiation could be from a few things, is anything else different from the tutorial? 01:57 < Muimi> okay. 01:57 < Muimi> no, I just don't know where to put the client.ovpn file on the server. 01:58 < cyberanger> /tmp/client.ovpn works, it's just there for the transfer (and we may use it here in a second on the server for testing) 01:59 < cyberanger> We'll be removing it after it's all said and done. 01:59 < Muimi> wait what trasnfer? 02:00 < cyberanger> We have to transfer this file to your client, once we create it on the server. 02:00 < Muimi> should I use lclient or client in that file? 02:00 < cyberanger> client 02:01 < Muimi> it's saved there. 02:03 < Muimi> I started openvpn agani 02:07 < cyberanger> I'm trying to think, why you'd be having that error. 02:08 < Muimi> *shrug* 02:08 < Muimi> I dunno. I'll ask someone else tomorrow. 02:09 < cyberanger> Anything else done differently from the tutorial? 02:09 < Muimi> TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) 02:09 < Muimi> maybe the port isn't open on the server 02:10 < cyberanger> I think the firewall default on CentOS 6 is open, port is 1194, udp right? 02:16 < Muimi> blocked by default, cyberanger 02:16 < Muimi> another reason the quickstart is ***awsome*** 02:17 < Muimi> http://ask.xmodulo.com/open-port-firewall-centos-rhel.html 02:17 <@vpnHelper> Title: How to open a port in the firewall on CentOS or RHEL - Ask Xmodulo (at ask.xmodulo.com) 02:21 < Muimi> I've opened the port, and I'm still getting the connect error. 02:26 < jiquera> !goal 02:26 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc 02:27 < Muimi> https://paste.fedoraproject.org/519223/34314551/ 02:27 < Muimi> wrong channel. 02:27 < Muimi> I would like to access the internet over my vpn 02:28 < jiquera> I set up a openvpn server, and everything works except: on one of the networks i connect form I get MTU issues. I have to reduce tun-mtu to 952 to make it work. However, when i change the --fragment settings this doesnt help at all. From what i understand, that should work too right? 02:29 < jiquera> can anybody explain in nooby speak why the internal openvpn fragmentation doesn't seem to do anything? I used wireshark to trace and the udp packets are indeed too big with fragment 02:31 < jiquera> @muimi did you masquerade the tun traffic? 02:32 < jiquera> otherwise packets can't find there way back to you from the web --> not internet 02:33 < jiquera> aaaand you need to forward some tun traffic too as well 02:34 < Muimi> i dunno. i just found out that openvpn starts but then immediately turns itself off 02:34 < Muimi> netstat -anulp | grep 1194 returns a blank line instead of openvpn. 02:35 < jiquera> ow then you probably have errors in config 02:35 < jiquera> what does your log say? 02:38 < Muimi> I dunno where the log is. 02:40 < jiquera_> @miumi just checked my server settings 02:40 < jiquera_> so what does your log say? 02:41 < Muimi> brb. 02:43 < jiquera_> #accept incoming traffic for our VPN-UDP server iptables -I INPUT -p --dport -j ACCEPT #allow traffic to and from our VPN-UDP tunnel entry/exit point iptables -I INPUT -i -j ACCEPT iptables -I FORWARD -i -j ACCEPT iptables -I FORWARD -o -j ACCEPT #properly masquerade VPN-UDP traffic iptables -t nat -A POSTROUTING -s /255.255.255.0 -j 02:43 < jiquera_> that's what made my firewall comply :D 02:43 < Muimi> huh? 02:43 < Muimi> https://paste.fedoraproject.org/519226/43234614/ 02:43 < Muimi> They said "group nogroup" would work. what should I actually use? 02:45 < jiquera_> are you running on windows? 02:46 < jiquera_> ow no ur not... I think it should be "nobody" 02:46 < jiquera_> and not "nogroup" 02:46 < jiquera_> but im not that much of a linux guru 02:47 < jiquera_> if you havent got it working yet... i recommend using the simplest settings eg. no security related stuff... and then once it works, start adding security until it breaks again :) 02:49 < Muimi> what's the simplest thing? I would have done that from the start if it were an option 02:49 < Muimi> there should be an idiot's guide, you know? I'm an idiot so... I use those 02:50 < Muimi> !ping 02:50 <@vpnHelper> pong 02:50 < Muimi> this is really weird, now. I'm connected. 02:50 < Muimi> but ping google.com fails still 02:51 < Muimi> Authenticate/Decrypt packet failed. Decrypt error. 02:51 < garman> Hello, I am trying to install a newer version than 2.3.11 in yakkety, but have run out of ideas. 02:51 < Muimi> decrypt packet error. cipher failed. 02:51 < garman> The version 2.4 relies on initscripts but that's not in yakkety anymore 02:52 < Muimi> authenticated/decrypt packet error. cipher final failed. 02:53 < garman> I see that 2.3.11 was changed to not require initscripts according to https://launchpad.net/ubuntu/yakkety/+source/openvpn/+changelog 02:53 <@vpnHelper> Title: Change log : Yakkety (16.10) : openvpn package : Ubuntu (at launchpad.net) 02:53 < garman> I have tried to build from source hoping to work it out, but there is no makefile after I ./configure 02:53 < garman> and google has failed me for any combination of searc terms I can think of 02:54 < Muimi> garman what are yuo trying to do man? 02:54 < jiquera_> oki back 02:54 < jiquera_> let me read first 02:54 < garman> Muimi: Install a newer version tha 2.3.11 in yakkety. Our servers require a newer version. I don't know why/what feature they depend on. 02:55 < jiquera_> @garman: ehhhh good luck, I have no clue :p 02:55 < garman> I have tapped "release/2.4 xenial" because there is no yakkety release in openvpn's releases 02:56 < garman> kk thanks 02:56 < jiquera_> well i noticed that the android releases are not updated either 02:56 < jiquera_> maybe just wait a week... is that possible? 02:57 <@plaisthos> jiquera_: hm? 02:57 <@plaisthos> jiquera_: openvpn connect or OpenVPN for Android? 02:57 < jiquera_> @miumi: you have control over server and client right? 02:57 < jiquera_> connect for sure 02:58 < Muimi> yeah i have 02:58 < jiquera_> for android, got updated on the 31st but i didnt check it yet... it said "tls-crypt" supported now... which sounded a bit like the rest was not 02:58 < jiquera_> but that was an assumption 02:58 < Muimi> windows connecting to centos server 02:58 < jiquera_> of course 02:58 < jiquera_> oki 02:58 <@plaisthos> jiquera_: that is my app 02:59 <@plaisthos> and the app uses OpenVPN master for years 02:59 < jiquera_> the for android one? 02:59 <@plaisthos> so the rest has been supported a long time already 02:59 <@plaisthos> yes 02:59 < jiquera_> nice :D 02:59 < jiquera_> kudos on that app 02:59 <@plaisthos> thanks 02:59 < jiquera_> yeah i was about to try it out... as the connect one has zero information on releases and basically everything 03:00 < Muimi> well, with the specific error.... I kind of imagine I should be able to figure out waht's wrong if I keep cracking at it 03:00 < jiquera_> @miumi can you post a config 03:00 < jiquera_> anonymised if you like 03:00 < jiquera_> using same compression/auth/cipher settings on client and server 03:00 < jiquera_> ? 03:01 < jiquera_> and they provide a sample script in the opevpn package btw 03:01 < jiquera_> it's not entirely idiot proof 03:01 < jiquera_> but it helps :) 03:01 < jiquera_> plaisthos... do you post the release notes somewhere? 03:01 <@plaisthos> jiquera_: no just the play store update log 03:01 < jiquera_> bummer 03:02 <@plaisthos> but openvpn itself is very close to official openvpn 03:02 <@plaisthos> and there is the git log if you are bored :P 03:02 < jiquera_> yeah i checked that one out :p 03:02 < jiquera_> after 15minutes i figured i wasnt that bored 03:02 < Muimi> what kind of config? 03:03 < jiquera_> on the server and client 03:03 < Muimi> the client.ovpn file and the server.conf file? 03:03 < jiquera_> yah (but remove IP, key and password materials) 03:03 < jiquera_> or change them after it works 03:05 < jiquera_> plaisthos, i remember why i thought it wasnt up to date. in the settings it lists LZO but nowhere LZ4, is that supported? 03:05 < jiquera_> i didnt see it in your license either 03:05 < Muimi> how do you select all and copy from nano? 03:06 < jiquera_> are you ssh-ing to your server? 03:06 < jiquera_> putty? 03:07 < jiquera_> @plaisthos: i remember why i thought it wasnt up to date. in the settings it lists LZO but nowhere LZ4, is that supported? 03:08 < TyrfingMjolnir> I have openvpn server running with dh and local key, how do I make a key for my iPhone? 03:09 < Muimi> tring to 03:09 < Muimi> yeah 03:10 < Muimi> putty yuck 03:10 < jiquera_> cant you just select with mouse and then right mouse button copies it i think 03:10 < jiquera_> @mjolnir have a look at the easy-rsa scripts 03:11 < TyrfingMjolnir> I have the easyrsa script 03:11 < Muimi> the pastebin doesn't carry over 03:11 < Muimi> it's like 500 lines, dude. 03:12 < Muimi> it's dumb. i only changed 3 or 4 lines to the config file on the server 03:12 < jiquera_> then create a new key with a new common name-> create a config file for your iphone with the ca cert and the iphone key and use that on ur iphone 03:12 < jiquera_> 500 lines config :o 03:12 < jiquera_> thats a lot 03:13 < Muimi> on my windows pc, the file isn't hard to pasate. it's the server tht i have to rip the data out line-by-line. 03:14 < jiquera_> hm 03:14 < TyrfingMjolnir> Muimi: cat /etc/openvpn/openvpn.conf | nc termbin.com 9999 03:14 < Muimi> https://paste.fedoraproject.org/519235/43434514/ 03:15 < Muimi> i want to edit it before it displays, though. doesn't it have some sensitive info? 03:15 < jiquera_> looks simple, looks good 03:15 < TyrfingMjolnir> Muimi: mine only has LAN IPs 03:15 < Muimi> k 03:15 < jiquera_> depends if you have the keys inline 03:15 < jiquera_> if they are in seperate files it's fine 03:16 < TyrfingMjolnir> Muimi: If you only reference the keys, the keys are in separate files 03:16 < Muimi> they're inline. 03:17 < jiquera_> ah hence the 500 lines... winscp? 03:17 < Muimi> nah the server.conf file is a lot of lines. 03:17 < jiquera_> or copy it on the server and remove the keys 03:17 < Muimi> maybe 180? I'm not sure. 03:17 < Muimi> so if they're inline, what should I do? 03:17 < Muimi> how should I change the client.ovpn file? 03:18 < jiquera_> the client.ovpn file looks ok 03:18 < jiquera_> depending on how your server file looks of course 03:18 < jiquera_> copy the server file 03:18 < Muimi> but you said: "if the keys are inline..." 03:18 < jiquera_> and remove the keys in the copy and just use that one 03:18 < Muimi> there are no keys in tht copy. 03:19 < Muimi> the server file is a server.conf file not a .ovpn file 03:19 < jiquera_> if the keys are inline u shouldnt paste it wthout removing them... but you did it right, your client conf does not contain sensitive material 03:19 < jiquera_> thats ok 03:19 < Muimi> http://termbin.com/rw43 03:19 < Muimi> what file are you talking about? 03:20 < skyroveRR> termbin blocked? WTF? 03:21 < skyroveRR> Your requested URL has been blocked as per the directions received from Department of Telecommunications, Government of India. Please contact administrator for more information. 03:21 < skyroveRR> ^ Ridiculous. 03:21 < jiquera_> muimi 03:21 < jiquera_> the file you just posted uses no compression 03:21 < jiquera_> and uses AES 03:21 < jiquera_> where as ur client config uses the default blowfish 03:22 < TyrfingMjolnir> Muimi: Here is my openvpn.conf: http://termbin.com/npp1 03:23 < jiquera_> ah ok 03:23 < jiquera_> what was the other file then? 03:23 < jiquera_> just to be clear, you are using this: https://paste.fedoraproject.org/519235/43434514/ and this http://termbin.com/npp1 03:23 < jiquera_> correct? 03:23 < Muimi> Ahhh i dunno what you're saying hold on 03:24 < Muimi> you're talking to a cow man 03:24 < TyrfingMjolnir> jiquera_: Mine is for inspiration 03:24 < jiquera_> ow wait 03:24 < Muimi> so what should I change? ^^ 03:24 < jiquera_> im confusing them 03:24 < Muimi> yes. correct and no, not correct. 03:24 < Muimi> npp1 is not me. 03:24 < jiquera_> yeah i get it now :p 03:25 < Muimi> http://termbin.com/rw43 03:25 < jiquera_> do you understand all the settings? 03:26 < jiquera_> ";topology subnet" --> change to "topology subnet" 03:26 < jiquera_> and 03:26 < jiquera_> "cipher AES-256-CBC" --> ";cipher AES-256-CBC" 03:26 < Muimi> not mytap 03:27 < jiquera_> let's first do all defaults 03:27 < Muimi> not diffie hellman 03:27 < jiquera_> so no fancy ciphers 03:27 < Muimi> they're bsically all default, man. 03:27 < jiquera_> and enable ";comp-lzo" 03:27 < Muimi> how do i turn the cipher off? 03:28 < jiquera_> you want no cipher at all? 03:28 < jiquera_> you already have keys right? 03:28 < jiquera_> just put ; in fron tof the aes line 03:28 < Muimi> okay. 03:28 < Muimi> i already have keys. 03:29 < Muimi> should I turn off the cipher? Again: you're talking to a cow. :P 03:29 < jiquera_> lol 03:29 < Muimi> i'm just trying to find the fastest success, you know? 03:29 < jiquera_> me too 03:29 < jiquera_> dont worry 03:29 < jiquera_> :p 03:29 < Muimi> You can ignore my inane questions if you have a working method. 03:30 < jiquera_> well i see three things that for sure cause issues 03:30 < jiquera_> 1) ;topology subnet <--- remove the ; to enable this line 03:31 < Muimi> done. 03:31 < Muimi> i haven't removed the aes lines yet. 03:31 < jiquera_> 2) your client file is using the default cipher, and your server is using AES: put a ; infront of "cipher AES-256-CBC" 03:32 < jiquera_> 3) your client uses compression, and your server doesnt: remove ; from ";comp-lzo" 03:32 < Muimi> would it be possible to use one of the two ciphers without any complexity? Like just say "blowfish"? Not that I care: honestly, I don't see the point of a cipher for me. 03:32 < Muimi> done and done. 03:32 < jiquera_> the default is blowfish 03:33 < jiquera_> you can also use the cipher aes in your client 03:33 < jiquera_> as long as it's the same for both 03:33 < Muimi> well, i'm connected again. no connection to google, though. 03:33 < Muimi> same errors. 03:34 < jiquera_> did you restart server? 03:34 < Muimi> just did now 03:34 < Muimi> and client to be safe 03:35 < jiquera_> do you have generated seperate keys for client ? so don't use the server key on the client... i think it won't like that 03:35 < jiquera_> @rest of the chatroom: my question about tun-mtu vs fragment is still open :) 03:35 < Muimi> I generated a key for the client and the server 03:35 < Muimi> but I added a password.... 03:35 < jiquera_> oki 03:35 < jiquera_> on the private key 03:35 < Muimi> so I was wondering: why didn't it prompt me for the password? 03:35 < jiquera_> for the client 03:35 < jiquera_> or also the server 03:36 < jiquera_> yeah it should :p 03:36 < Muimi> I'm not getting that error anymore. 03:36 < jiquera_> yaaay progress 03:36 < Muimi> no password prompt and no access to google. 03:37 < jiquera_> no access to google is more tricky as you need to set your dns and iptables properly 03:37 < jiquera_> but the connection seems stable? 03:37 < Muimi> yes. 03:37 < Muimi> and the final goal is a couple of google sites, youtube, and github. 03:37 < Muimi> github was unblocked by the firewall, already, though. 03:37 < jiquera_> we'll get there :) 03:38 < jiquera_> can you ping your server? 03:38 < jiquera_> with a local address? 03:38 < Muimi> I'm connected to it by ssh soo probably right 03:38 < Muimi> i can from cmd. yes 03:38 < jiquera_> no i mean with a local address so the ping goes over the tunnel 03:38 < jiquera_> good 03:39 < Muimi> you mean ping the server from the server? 03:39 < jiquera_> no ping the server from your client 03:39 < Muimi> yes. 03:39 < jiquera_> but use the local server ip (192.168.1.1 or whatever it is in your case) 03:40 < jiquera_> can you do a nslookup from your client 03:40 < Muimi> i'm not sure what you mean.... 03:40 < jiquera_> nslookup google.com 03:40 < jiquera_> on your commandline 03:40 < jiquera_> client side 03:40 < Muimi> what's the dns_ip? 03:40 < Muimi> timed out timed out. 03:41 < jiquera_> what timed out the nslookup? 03:41 < Muimi> 8.8.8.8? 03:41 < Muimi> yes. 03:41 < Muimi> but I don't know the dns_ip. 03:41 < jiquera_> so how do you want your dns lookup to work 03:41 < jiquera_> directly to the dns server 03:41 < jiquera_> or via your tunnel? 03:42 < Muimi> I wish I knew what you meant. 03:42 < jiquera_> oki 03:42 < jiquera_> if you go to google.com 03:42 < jiquera_> first your machine will ask the web what the ip address is of google.com (this is called a DNS query) 03:43 < Muimi> okay. 03:43 < jiquera_> depending on who you want to answer that question your setup differs a bit 03:43 < Muimi> the one that's easiest to set up. 03:43 < jiquera_> either you ask your vpn server which then asks some other servers 03:43 < jiquera_> or you ask directly the other servers 03:43 < jiquera_> let me check your config 03:44 < Muimi> the vpn asks. 03:44 < jiquera_> and see what it does now 03:44 < Muimi> because i cannot access google from my country. 03:44 < Muimi> i can't even ask from here. 03:45 < Muimi> brb (5) 03:47 < jiquera_> are you connecting form china? because then openvpn will not do the trick for you 03:48 < cyberanger> Not just China, and it can alongside another tool. 03:48 < cyberanger> Obfsproxy, Stunnel or something. 03:52 <@dazo> !obfs 03:52 <@vpnHelper> "obfs" is (#1) if you are looking to obfuscate your traffic to get through a firewall that recognizes and blocks openvpn, try using this proxy: obfsproxy https://www.torproject.org/projects/obfsproxy.html.en to encapsulate your packets in other protocols, or (#2) http://community.openvpn.net/openvpn/wiki/TrafficObfuscation, or (#3) in client/server mode an admin can know that openvpn is being used. in 03:52 <@vpnHelper> static-key mode they only know that it is some encrypted data, but not specifically openvpn; however with static-key you lose forward security (!forwardsecurity) 03:56 < Muimi> back 03:56 < Muimi> jiquera_: yes. 03:56 < jiquera_> china actively detects vpn tunnels 03:56 < jiquera_> and then blocks them 03:57 < Muimi> what's forward security? 03:57 < TyrfingMjolnir> How can I generate a key for a device? 03:57 < Muimi> So I need to figure out how to use obfsproxy also? :<< 03:58 < TyrfingMjolnir> I know how to make a key with easyrsa, but how do I match my keys made on my laptop with the keys from the server? 04:00 < jiquera_> @muimi: you need some kind of obfuscation on top of your tunnel so it doesn't look like a vpn tunnel, however china is pretty advanced in detecting this they take packet length, data intensity, packet timeing and data patterns into account 04:00 < jiquera_> so yeah 04:00 < jiquera_> i'd say your best bet is not openvpn but tor + obfproxy 04:01 < Muimi> tor? 04:01 < Muimi> isn't that for bitcoin? 04:01 < jiquera_> unless you want to code stuff yourself (like me, i made it a hobby project to bypass the chinese firewall) 04:01 < TyrfingMjolnir> jiquera_: ;-) Got source? 04:02 < Muimi> well, I could just pay a yearly service to bypass it.... 04:02 < Muimi> But to be honest, I think they manually check things. 04:02 < jiquera_> no not exactly. Tor (the onion router) is a sort of protocol that routes every packet over a lot of computers all encrypted etc... to confuse eavesdroppers 04:02 < Muimi> They focus on banning people who are doing unsavory things like addictive gaming, porn, 04:02 < jiquera_> it is used for many things 04:03 < Muimi> one of my friends works in some terrorism prevention unit, and he has told me about some of this. 04:03 < jiquera_> @mjolnir: use the same CA cert on your phone, server and laptop and then they should be able to verify the keys from the server 04:03 <@plaisthos> jiquera_: newer compression algorithm are pushable and negotiable, so there is no need to configure them on the client, see also the script http://plai.de/android/peerid.py 04:04 < Muimi> Is it difficult to set tor and obfproxy? Do I still need to go through the centos server? 04:05 < jiquera_> well it's a different setup... and although tor and obfproxy is basically the most powerful around when it comes to this you still need non-standard settings because china of course made sure the standard configuration doesn't work 04:05 < Muimi> I have to leave in like 10 minutes. Basically, I'm just wondering if I would be able to set everything up tomorrow, or if it would be like a 10-day project. 04:05 < jiquera_> i can setup your vpn in 15 more minutes 04:06 < jiquera_> but it will probably not work stable 04:06 < Muimi> yeah, but it's useless if it's going to cause my server to block. 04:06 < jiquera_> if it doesnt 04:06 < Muimi> i also use the server for website hosting. 04:06 < jiquera_> it is more likely to be a 10 day project 04:06 < Muimi> last year, I used pptpd, and I had no issues. 04:06 < jiquera_> oki well 04:07 < jiquera_> let's setup openvpn for ya then 04:07 < jiquera_> and see how it works :) 04:07 < jiquera_> as i understand the blocks are not permanent and usually port specific 04:08 < jiquera_> @mjolnir: I'm using a lot of different tunnels to bypass the firewall, however at the moment a lot of them rely on obscurity of the protocol so no, no source ;) 04:09 < Muimi> i'll start with that 04:10 < Muimi> i'll try obfs later, maybe 04:10 < Muimi> so what's left? I've got 4 minutes until I have to go. 04:10 < Muimi> Maybe less. 04:11 < jiquera_> oki 04:11 < jiquera_> oki ill give you some hints and then you can pick it up from there 04:11 <@plaisthos> also tls-crypt is worth a try 04:12 < Muimi> alright 04:12 < Muimi> I've taken the key from an employee. 04:12 < jiquera_> curreently your server pushes the google DNS servers (8.8.8.8 and 8.8.4.4) these will be blocked in china (change them to your centos server or a dns server that is not blocked) 04:13 < jiquera_> by force? :p 04:13 < jiquera_> then in your iptables you allow traffic to come in on the vpn port 04:13 < jiquera_> but you dont allow it to exit yet 04:14 < Muimi> in Windows? 04:15 < jiquera_> no on your server 04:15 < jiquera_> https://paste.fedoraproject.org/519261/83437970/ 04:15 < jiquera_> there are 2 sets of commands 04:15 < jiquera_> one is an example of the other 04:15 < Muimi> but the server is in france. 04:16 < jiquera_> the packets that you send to your centos server, enter the server but you have to tell the firewall how to deal with those packets 04:16 < jiquera_> the first line you don't need to do as it's already done in your case (or you wouldn't be able to connect) 04:17 < jiquera_> the first line opens the external port of your server so you can make a connection with your vpn server 04:17 < Muimi> I dunno man. it sounds way over my head. 04:18 < Muimi> I gotta take off. Sorry. Maybe see you tomorrow. Have a good night. 04:18 < jiquera_> np 04:18 < jiquera_> goodluck though 04:18 < jiquera_> this stuff is never easy :) 04:18 < Muimi> is there like a config file i'd change? 04:19 < jiquera_> no you literrally type the commands that are in the example i showed 04:19 < jiquera_> but then with your parameters 04:19 < jiquera_> iptables <-- is the command to update your firewall 04:19 < Muimi> oh in that pastebin 04:19 < Muimi> alright i'll try those 04:19 < Muimi> tomorrow 04:19 < Muimi> maybe see you 04:19 < Muimi> have a good day. thanks 04:21 < jiquera_> cheers 04:22 < jiquera_> @anybody else 04:22 < jiquera_> please help me with my mtu / fragment question 04:35 < jiquera_> @plaisthos: I see it can be pushed... but i don't see any mention of negotiation, plus the client needs to support it meaning your app needs to have the code right? 04:36 <@plaisthos> jiquera_: my app is basically OpenVPN master 04:36 <@plaisthos> everything that is supported in OpenVPN is supported by the app 04:36 <@plaisthos> even if there is no ui configuration 04:37 < jiquera_> oki cool 04:37 <@plaisthos> as for the negoation, the client pushes its capabilities (IV_*) to the server 04:37 < jiquera_> i like :) 04:37 <@plaisthos> so the server can check what the client supports and push certain options 04:37 <@plaisthos> for some things this is done automatically 04:38 <@plaisthos> e.g. the cipher will be AES-256-GCM in 2.4 server/client if you don't configure anything else 04:38 <@plaisthos> also peer-id will be automatically be pushed 04:38 <@plaisthos> !changes24 04:38 <@plaisthos> !24changes 04:38 <@vpnHelper> "24changes" is https://github.com/OpenVPN/openvpn/blob/release/2.4/Changes.rst 04:41 < jiquera_> yeah i read that 04:41 < jiquera_> i just didnt realize it could be used like that 04:41 < jiquera_> i have a pretty static setup... since i only have a handful users 04:43 <@plaisthos> :) 04:43 <@plaisthos> the cipher negoiation will happen unless you disable/fiddle with it 04:46 < jiquera_> there's a "bug" in ur python script btw... the ping pushed to the client should be half that of the srever 04:46 < jiquera_> in this case 1800 04:46 < jiquera_> ping-restart * 04:46 < jiquera_> yeah i fiddled with it 04:46 < jiquera_> :p 04:47 <@plaisthos> :) 04:47 <@plaisthos> worked well enough for me :p 04:48 < jiquera_> well the problem is that the server could close the connection before the client knows there is a problem 04:48 < jiquera_> "problem" 04:49 < jiquera_> pfff people are a bit silent today... 04:49 < jiquera_> do you know why fragment doesn't do the trick and tun-mtu does? 05:00 < Bitnova> hi, when i import .ovpn from my provider in network-manager Ubuntu xenial, it imports the file with the cert and key fields being auto-populated with .pem, yet inside the the .ovpn file there is a .crt and .key file. any idea why network-manager imports the file and generates .pem? whereas in terminal when i connect, it uses the correct crt and key. 05:15 < Koshi> SIGUSR1[soft,private-key-password-failure] received, process restarting 05:15 < Koshi> Tue Jan 03 11:01:54 2017 MANAGEMENT: >STATE:1483437714,RECONNECTING,private-key-password-failure,,,,, 05:16 < Koshi> i installed openvpn in digitalocean and it is now working 05:31 < Bitnova> can anyone help please? 06:17 < fsociety[00]dat> are there any traces on system after disconnecting a VPN service? ( connecting like "openvpn --config VPN.ovpn" ) 06:22 < MrNice> fsociety[00]dat: bash history, system logfiles, openvpn logfiles, certificates / configurations 06:31 < fsociety[00]dat> MrNice, thanks. 06:40 < Koshi> i have installed OpenVPN on my digitalocean server, but not working 06:41 < Koshi> SIGUSR1[soft,private-key-password-failure] received, process restarting 06:41 < Koshi> MANAGEMENT: >STATE:1483403538,RECONNECTING,private-key-password-failure,,,,, 07:30 <@dazo> Koshi: private-key-password-failure .... that is the core error 07:30 <@dazo> you have a password protected key file 07:31 < Koshi> dazo, i try this but nothing again https://github.com/Nyr/openvpn-install 07:31 <@vpnHelper> Title: GitHub - Nyr/openvpn-install: OpenVPN road warrior installer for Debian, Ubuntu and CentOS (at github.com) 07:33 < ninja85a> hello 07:33 <@dazo> Koshi: *that* installer is not something I would recommend .... 07:34 < Koshi> dazo, what you recommend 07:34 <@dazo> Koshi: or any documentation or installer script not *officially* being provided by the OpenVPN community or company 07:34 <@dazo> !howto 07:34 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror, or (#3) Getting started with OpenVPN: https://community.openvpn.net/openvpn/wiki/GettingStartedwithOVPN 07:34 <@dazo> Koshi: In particular: https://community.openvpn.net/openvpn/wiki/GettingStartedwithOVPN 07:34 <@vpnHelper> Title: GettingStartedwithOVPN – OpenVPN Community (at community.openvpn.net) 07:35 < Koshi> dazo, ok i will try this now 07:35 <@dazo> setting up OpenVPN isn't hard .... but you need to go through a little learning first 07:57 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Disconnected by services] 07:58 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn 07:58 -!- mode/#openvpn [+o vpnHelper] by ChanServ 08:03 -!- You're now known as ecrist 08:19 <@krzee> dazo: for that guy who needed !obfs we could have try --tls-crypt, it's unlikely that china updated the great firewall's DPI so fast 08:20 < skyroveRR> !obfs 08:20 <@vpnHelper> "obfs" is (#1) if you are looking to obfuscate your traffic to get through a firewall that recognizes and blocks openvpn, try using this proxy: obfsproxy https://www.torproject.org/projects/obfsproxy.html.en to encapsulate your packets in other protocols, or (#2) http://community.openvpn.net/openvpn/wiki/TrafficObfuscation, or (#3) in client/server mode an admin can know that openvpn is being 08:20 <@vpnHelper> used. in static-key mode they only know that it is some encrypted data, but not specifically openvpn; however with static-key you lose forward security (!forwardsecurity) 08:20 < skyroveRR> o.o 08:20 < skyroveRR> Interesting. 08:20 <@krzee> skyroveRR: --tls-crypt is a new option that encrypts the control channel with a PSK 08:21 <@krzee> new in 2.4 08:21 <@krzee> (so the tls handshake is hidden) 08:21 < skyroveRR> Hmm.. using 2.3.10 here. :) 08:21 < skyroveRR> But I don't live in China, so "heh". :) 08:22 <@krzee> so at least for now its likely that a vpn with tls-crypt wont be detected as an openvpn tunnel 08:22 <@krzee> haha ya same 08:22 < skyroveRR> Yeah, that's a really cool thing :) 08:23 <@krzee> although its also somewhat better privacy (no looking at our pub certs), and its also poor mans quantum safe 08:25 < skyroveRR> krzee: may I pm you? 08:25 <@krzee> sure 08:28 <@ecrist> oh, snap 08:28 <@ecrist> I'll need to resubmit chapter 9 08:28 <@ecrist> I missed discussing --tls-crypt in my section on obfuscation 08:32 <@krzee> ya i mention that in like chapter 6 too iirc 08:32 <@dazo> krzee: there's already been some reports that the great firewall blocks connections with --tls-crypt ... which isn't really unexpected 08:32 <@krzee> oh interesting 08:33 <@dazo> it doesn't encrypt everything in the packet being sent ...only the stuff after a small header 08:33 <@dazo> (and only the control channel, iirc) 08:33 <@krzee> control channel seems like the perfect way to detect openvpn 08:34 <@dazo> the first bytes in each packet provides an identifier, if it is data or control channel 08:36 <@krzee> ecrist: here: 08:36 <@krzee> There are two scenarios where PSKs are used, in a static key point-to-point VPN, and with the --tls-auth directive in the more commonly deployed client-server topology 08:36 <@krzee> my note is: "There is a new one in 2.4, and it is awesome! --tls-crypt uses the same key as –tls-auth, but instead of signing packets with an hmac for auth, it actually encrypts the tls channel with a statickey. This means that certificates are no longer public, and we have poor mans protection against quantum decryption! (Because no exposed handshakes)" 08:36 <@krzee> (thats in chapter 6) 08:37 <@dazo> right 08:37 <@dazo> that is correct 08:38 <@krzee> steffen had guessed that it tls-crypt may defeat dpi for a bit, i guess it didnt happen 08:39 <@krzee> but i'll bet on his guesses any time! ;] 08:56 < thereyouare> on that page https://en.wikipedia.org/wiki/NIST_hash_function_competition it says: 08:56 <@vpnHelper> Title: NIST hash function competition - Wikipedia (at en.wikipedia.org) 08:56 < thereyouare> Security: "We preferred to be conservative about security, and in some cases did not select algorithms with exceptional performance, largely because something about them made us 'nervous,' even though we knew of no clear attack against the full algorithm." 08:56 < thereyouare> so they used their intuition to guess that a algorithm is bad ? 08:56 < thereyouare> how is that scientific ? 08:56 < thereyouare> "something about them made us nervous" ? 08:57 < thereyouare> you know what intuition can do to you ? go outside and look at the sun, intuition tells you it goes around the earth, and earth is standing still, why still ? because if earth were moving or even spinning we all would fell down, this is what intuition tells us, and who disagree with that should be burned as heretic because intuition rules and scientce not 08:58 <@dazo> thereyouare: if you start digging into the math behind it, you might better understand what made them nervous ... if you don't understand the math, don't bother questioning their guts 08:58 <@ecrist> krzee: thanks. Also, I just submitted FreeBSD PR 215734, updates -devel port to 2016-52 and fixes the mbedtls bug. 08:59 <@ecrist> I copied over the entire port structure from Mathias' main port and modified it for the -devel. 09:01 <@dazo> thereyouare: http://nvlpubs.nist.gov/nistpubs/ir/2012/NIST.IR.7896.pdf ... here you have a bit more verbose reasoning 09:03 <@plaisthos> thereyouare: something is telling you that this might break easily or could potentially break but you don't have a proof to show it 09:04 < cornfeedhobo> does anyone know, off the top of their head, how to force the default route in the _client_ config? 09:04 <@plaisthos> !redirect-gateway 09:04 <@plaisthos> !def1 09:04 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1" 09:05 <@krzee> ecrist: nice thanks! 09:05 <@plaisthos> cornfeedhobo: that is for you 09:05 < cornfeedhobo> that is what i thought. thanks for verification!! 09:05 < cornfeedhobo> (time crunch. ya'll are awesome!) 09:15 < [0xAA]> hmm 09:15 < [0xAA]> devs 09:15 < [0xAA]> Does OpenVPN not work when I limit the packet size? 09:15 < [0xAA]> (on handshake, it screams over small packets) 09:15 <@dazo> !logs 09:15 <@vpnHelper> "logs" is (#1) please pastebin your logfiles from both client and server with verb set to 4 (only use 5 if asked), or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log, or (#3) In the OS X client(Tunnelblick) right-click it and select Copy log text to clipboard, or (#4) if you dont know how to find your logs, see !logfile 09:16 <@krzee> ive used openvpn over ip over dns, so i suspect small packet sizes can work 09:16 <@krzee> (that was long long ago, to be fair) 09:17 < thereyouare> "over ip over dns", what 09:17 < thereyouare> is that some kind of magic ? 09:18 <@krzee> ip over dns, dns tunneling,an app called iodine (and even older there was nstx) 09:18 <@dazo> https://github.com/yarrick/iodine 09:18 <@vpnHelper> Title: GitHub - yarrick/iodine: Official git repo for iodine dns tunnel (at github.com) 09:18 <@dazo> sorry ... http://code.kryo.se/iodine/ 09:18 <@vpnHelper> Title: kryo.se: iodine (IP-over-DNS, IPv4 over DNS tunnel) (at code.kryo.se) 09:18 < thereyouare> krzee: you know free services that lets you use dns tunnel ? 09:18 <@krzee> no 09:19 <@krzee> and its very non ideal 09:19 <@krzee> however, it does bypass many captive portal logins 09:19 <@krzee> since they kinda have to do dns 09:19 < thereyouare> how is TCP working over it ? 09:19 < thereyouare> I mean TCP has 2 way stream of packets right ? 09:19 <@krzee> embedded in requests 09:20 <@krzee> and responses 09:20 <@krzee> google dns tunneling 09:20 <@krzee> theres also icmptx for icmp tunneling 09:20 < thereyouare> so as I understand it there is a constant stream of DNS requests and TCP ack are piggy backed on responses ? 09:20 <@krzee> thereyouare: correct 09:21 < thereyouare> because you send SYN with DNS request but then you have to send another DNS request and answer for that second request will contain ACK, right ? 09:21 < [0xAA]> that seems cancer 09:21 < [0xAA]> DNA A? .hah 09:21 <@krzee> https://dnstunnel.de/ 09:21 <@vpnHelper> Title: DNStunnel.de - free DNS tunneling service (at dnstunnel.de) 09:22 <@dazo> probably IN TXT queries ... or a variety, based on the amount of data 09:22 < thereyouare> I have only 500MB per month internet but I noticed when my 500MB used up I can still resolve DNS names, I recently resolved 1000000 names with no working internet so I think I can use that tunnel ? 09:22 < thereyouare> you think ISP will notice if I use DNS tunneling ? 09:23 <@dazo> yes, that should work ... but that would be illegal in your case 09:23 < thereyouare> that is why I tested it resolving 1000000 adresses, nothing bad happened 09:23 < thereyouare> how is it illegal do DNS requests ? 09:23 <@krzee> i know *i* wouldnt do it 09:23 < thereyouare> krzee: you think that tunnel will work with IRC ? or the lag will be too big ? 09:23 <@krzee> but you feel free to do whatever you want, assuming you're an adult and responsible for yourself 09:24 <@dazo> DNS requests aren't illegal ... but you use it to circumvent a restriction you have on your subscription, *that* is illegal 09:24 < thereyouare> or how about using ssh over DNS tunnel ? it would be like a torture ? 09:24 <@krzee> thereyouare: ive used ssh over openvpn over dns, yes everything over dns is somewhat tortuous 09:24 <@krzee> but it worked 09:25 <@krzee> in that situation, that was all i could wish for 09:25 <@krzee> btw at http://dev.kryo.se/iodine/wiki/TipsAndTricks i have a script for starting iodine on the client and changing the route to go over it 09:25 <@vpnHelper> Title: TipsAndTricks – iodine (at dev.kryo.se) 09:27 < thereyouare> by the way will that clog up ISP's DNS resolver ? because it all will be cached 09:27 <@krzee> maybe, i only use it on fly-bys 09:27 <@krzee> i wouldnt use it from home simply because id be able to do a better solution 09:41 < [0xAA]> Tue Jan 3 15:31:45 2017 WARNING: Bad encapsulated packet length from peer (0), which must be > 0 and <= 1626 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...] 09:41 < [0xAA]> this problem is bugging me hard 09:41 <@krzee> [0xAA]: 09:41 <@krzee> !configs 09:41 <@vpnHelper> "configs" is (#1) please !paste your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and ovpn version, or (#2) dont forget to include any ccd entries, or (#3) pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config, or (#4) remove inline private key or tls-auth key before posting 09:41 < [0xAA]> krzee: the problem here is OpenVPN is not wrapping 0-len packets 09:42 < [0xAA]> krzee: My configuration is not a problem 09:42 < [0xAA]> If I try without the MITM, it does work 09:42 <@krzee> [07:06] <[0xAA]> Does OpenVPN not work when I limit the packet size? 09:42 <@krzee> [07:06] <[0xAA]> (on handshake, it screams over small packets) 09:42 <@krzee> [07:06] !logs 09:42 <@krzee> well dazo asked for logs and got ignored, i asked for configs and got a no 09:42 < [0xAA]> 1 sec 09:43 <@krzee> logs might be better, as dazo knows more than i 09:43 < [0xAA]> https://bpaste.net/show/de9681420287 09:43 < [0xAA]> krzee: this 09:44 <@krzee> ok so theres a proxy in the middle 09:44 < [0xAA]> yep 09:44 < [0xAA]> I have control of code 09:45 * krzee taps dazo on the shoulder and walks away 09:45 <@krzee> lol 09:45 < [0xAA]> the first 0-len packets are meant to be ignored 09:50 <@krzee> [0xAA]: is that obfsproxy or something? 09:50 <@krzee> tor? 09:50 < [0xAA]> nope 09:50 < [0xAA]> krzee: I custom-wrote that proxy in Golang 09:51 <@krzee> oh 09:51 < [0xAA]> >language doesn't matter, ignore 09:51 < [0xAA]> I tried its io.Copy 09:51 < [0xAA]> every protocol worked except OpenVPN 09:51 < [0xAA]> Even HTTP works 09:51 <@krzee> i get the issue now, ya you'll wanna talk with dazo 10:04 <@dazo> [0xAA]: ensure that the first byte of the packet being sent on the wire consist of the packet length ... this is the only difference between the TCP and UDP packets 10:05 <@dazo> [0xAA]: the length value should be the length of the whole packet excluding these length field ... the length-field is 2 bytes (16 bits) 10:08 < [0xAA]> dazo: I read from TCP sockets 10:08 < [0xAA]> I tried this before with a Python MITM 10:08 < [0xAA]> it worked 10:08 < [0xAA]> dazo: I see my MITM sending 0-len packets to OpenVPN 10:09 < [0xAA]> OpenVPN server screams out of it 10:09 < [0xAA]> Tue Jan 3 10:56:04 2017 127.0.0.1:59265 WARNING: Bad encapsulated packet length from peer (0), which must be > 0 and <= 1626 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...] 10:09 < [0xAA]> see this 10:09 <@dazo> which is why you must send the proper length value 10:09 < [0xAA]> so dazo, I should wait (for servers) until the packet size becomes larger than zero ? 10:09 <@dazo> why it is stripped, I have no idea ... that's your code 10:10 <@dazo> all TCP packets in the OpenVPN wire packet have a length field > 0 10:10 < [0xAA]> dazo: hmm 10:10 < [0xAA]> so I SHOULD wait till packets become larger than zero 10:10 * [0xAA] writes 10:10 <@dazo> no ... all packets you receive will have a packet length > 0 10:10 <@dazo> so, all packets you send further MUST have a packet length > 0 10:11 <@dazo> if packet length == 0 ... OpenVPN wouldn't send the packet. 10:18 <@plaisthos> a packet without information is a packet is not worth sending is OpenVPN's logic 10:18 < [0xAA]> it's weird 10:18 < [0xAA]> why would a TCP stack even send 0-length packets 10:23 < mrpops2ko> hey m8s, question in general about tinfoil / opsec I guess, but how bad would it be to use opendns on a paid for vpn provider (instead of their own one)? 10:27 < moritz_s> [0xAA]: there are two instances that immediately come to mind where 0-size packets are used: 1. the initial syn syn/ack ack packets are usually empty, the fin packets as well, 2. when the receiver advertises a window size of 0, the sender periodically sends a 0-size packet to look if the window size increased 10:56 <@ecrist> mrpops2ko: unless you're using secure-dns, that traffic is snoopable once it leaves the VPN provider. 13:44 -!- Netsplit *.net <-> *.split quits: @krzee, @plaisthos 13:44 -!- Netsplit over, joins: plaisthos 13:45 -!- mode/#openvpn [+o plaisthos] by ChanServ 13:45 -!- batrick is now known as Guest1928 13:46 -!- RAX is now known as rax- 13:46 -!- Netsplit over, joins: krzee 13:46 -!- mode/#openvpn [+o krzee] by ChanServ 14:02 < klow> Can you push a specific dns entry similar to an /etc/hosts entry w openvpn, or just DNS server addresses? 14:19 <@ecrist> klow: what do you mean? 14:19 <@krzee> klow: pushing dns is really an up script grabbing a var and doing what it wants with it (editing resolv.conf) 14:20 <@krzee> look at the env and see if you can get the info you want from the env, then see about writing the code to edit your hosts file 14:20 <@krzee> or do whatever you want with it 14:20 <@dazo> so ... you could write your own --up script which parses some setenv_safe varialbes pushed to the client which updates /etc/hosts 14:20 <@ecrist> everything he needs is passed in the environment to the --up script 14:20 <@dazo> even simpler 14:20 <@krzee> setenv_safe? 14:21 <@krzee> we can push custom vars dazo? 14:21 <@dazo> krzee: see --setenv-safe in the man page :) 14:21 <@krzee> nice already searching 14:22 <@krzee> thats nice! 14:22 <@dazo> I even believe JJK documented it in the OpenVPN 2 Cookbook ;-) 14:22 < klow> thanks guys i will check that out 14:22 <@krzee> nooooo wayyyy 14:22 <@krzee> lets see, i have that here 14:22 <@dazo> he uses a Windows client with .vbs script as an example, iirc 14:23 <@krzee> dammit he did :D 14:23 < klow> basically what I mean is that say I have vpn clients out in the field, and I want website.internaldomain.com to resolve , without putting in real-world DNS, and without having to manage internal DNS infrastructure for every "customer if you will" 14:23 <@krzee> klow: i do the same =] 14:23 < redrabbit> i was thinking about doing it from the firewall 14:23 < klow> so /etc/hosts would do that, but thats another thing to configure on each client, and i dont know if that would be possible on iOS openvpn, which sadly i have to support in a big way 14:24 < redrabbit> i get internet from two interfaces, eth1 and wlan1, i also use tun0 device as openvpn client, how can i make sure only eth1 is used to connect to openvpn server, is there an openvpn setting for that ? 14:24 <@krzee> oh ya i dont know about ios supporting that either, id say it probably does not 14:24 * dazo decides to catch an earlier train ... will be back in a few hours 14:24 <@krzee> later dazo! 14:25 <@krzee> klow: rooted ios by chance? 14:25 <@krzee> or stock 14:25 < klow> nah just iOS OpenVPN Connect 14:25 < klow> its like a big platform for us, which is tough for me heh 14:25 <@krzee> ya my complete guess would be that it cant do that 14:25 <@krzee> since it shouldnt even have access to the hosts file 14:26 <@krzee> it manages routes and whatnot via vpn API 14:26 <@krzee> not via root 14:26 < klow> ya .. thats right. we actually went through the process of getting those API rights to build something ourselves 14:27 <@krzee> oh cool! 14:27 <@krzee> well in case you were ever curious, heres the source to connect 14:27 <@krzee> !connect 14:28 <@vpnHelper> "connect" is (#1) OpenVPN Connect is part of the commercial, non-free (non-GPL) corporate offering; see #openvpn-as for help with these. For the community-maintained GPL OpenVPN, see !download for download links, !android for GPL-openvpn on Android, or !howto for the beginner how-to guide, or (#2) the source is here: http://staging.openvpn.net/openvpn3/ except for the portion that may not be released 14:28 <@vpnHelper> because of NDA with apple (for its vpn API), or (#3) It is impossible to retrieve your configuration from Connect itself. This is by design. Keep a copy of your config (and any certs/keys/etc that go with it) someplace safe, and where you can find it later. 14:28 <@krzee> #2 14:28 <@krzee> its open except for the vpn api part, as im sure you know theres an NDA there 14:28 < klow> i feel like when istarted looking for this, maybe a year ago, it was not open source ? 14:29 <@krzee> hard to find 14:29 <@krzee> its a complete re-write of openvpn 14:30 < klow> ya , pretty interesting .. lots of work involved heh 16:11 <@krzee> klow: better link: https://github.com/OpenVPN/openvpn3 16:11 <@vpnHelper> Title: GitHub - OpenVPN/openvpn3 (at github.com) 16:12 <@krzee> !forget connect 2 16:12 <@vpnHelper> Joo got it. 16:12 <@krzee> !forget connect 3 16:12 <@vpnHelper> Error: Invalid factoid number. 16:12 <@krzee> !forget connect 2 16:12 <@vpnHelper> Joo got it. 16:13 <@krzee> !learn connect as the source is here: https://github.com/OpenVPN/openvpn3 except for the portion that may not be released because of NDA with apple (for its vpn API) 16:13 <@vpnHelper> Joo got it. 16:13 <@krzee> !learn connect as It is impossible to retrieve your configuration from Connect itself. This is by design. Keep a copy of your config (and any certs/keys/etc that go with it) someplace safe, and where you can find it later 16:13 <@vpnHelper> Joo got it. 16:19 < redrabbit> is there a way to pick the interface the openvpn client uses to connect 16:20 < redrabbit> from openvpn options 16:22 <@krzee> what do you mean 16:23 < redrabbit> i only want to use eth1 to connect to openvpn server 16:23 < redrabbit> from client 16:23 <@krzee> set the route 16:23 < redrabbit> not other internet connection 16:23 < redrabbit> ok 16:23 <@krzee> not in vpn config, but before running openvpn 16:24 < redrabbit> in my firewall ? 16:24 <@krzee> add a route to your routing table so that traffic to your vpn server ip goes out the interface/gateway that you desire 16:25 <@krzee> before you start openvpn 16:25 < redrabbit> ok with "route" in the cli 16:26 < redrabbit> is there a way to make it permanent 16:26 <@krzee> definitely, and how depends on your distro 16:27 < redrabbit> i'm on debian, i have to look this up 16:27 <@krzee> "static route" will help your search 16:27 < redrabbit> thanks 16:27 <@krzee> https://www.cyberciti.biz/tips/configuring-static-routes-in-debian-or-red-hat-linux-systems.html 16:27 <@vpnHelper> Title: Configure Static Routes In Debian or Red Hat Enterprise Linux (at www.cyberciti.biz) 16:29 < redrabbit> i openened that page seconds before you posted it ^^ 16:29 < redrabbit> i heard there is a way to do this with my firewall too 16:29 < redrabbit> with this : http://www.shorewall.net/MultiISP.html 16:29 <@vpnHelper> Title: Shorewall and Multiple Internet Connections (at www.shorewall.net) 16:30 <@krzee> you have multiple internet links? 16:30 < redrabbit> basically i want to make sure it only uses eth1 for the vpn 16:30 < redrabbit> yes 16:31 <@krzee> i do as well 16:31 < redrabbit> i have multiple wifi interfaces + 3G dongles 16:31 < redrabbit> + 100mbps at home 16:31 <@krzee> i manage it with an openwrt router, multiple routing tables, and policy routing 16:31 < redrabbit> 3G dongles are a lot of fun 16:32 <@krzee> ##networking was very helpful 16:32 < redrabbit> nice setup 16:32 <@krzee> thanks 16:32 <@krzee> so ya you just need a route 16:33 < redrabbit> atm i'm setting up a rpi3 to work on battery, controlled by umts (3G/H+) it connects to my local openvpn server on a vm and i can access it from there 16:33 <@krzee> ahh making your own lil pineapple 16:33 < redrabbit> works fine, i'm at the finishing stage 16:34 <@krzee> https://www.wifipineapple.com/ 16:34 < redrabbit> tightening firewall rules + routing 16:34 <@vpnHelper> Title: WiFi Pineapple - Home (at www.wifipineapple.com) 16:34 < redrabbit> yea from hak5 16:34 <@krzee> ya its sweetness 16:34 < redrabbit> i don't know if it does all i can do with my setup 16:34 <@krzee> at least once you stop trying to use the web interface lol 16:34 < redrabbit> works pretty awesome 16:35 < redrabbit> web interfaces are meh 16:35 < redrabbit> :D 16:35 < redrabbit> cli ftw 16:35 <@krzee> agreed 16:35 < Koshi> dazo, i try some times to configure the openvpn on digitalocean but nothing. 16:36 < redrabbit> is there 3G connectity on the pinapple ? 16:37 < redrabbit> i have a wifi AP from wlan0 to connect to the machine when in close range 16:37 < redrabbit> 3G connectivity for virtually unlimited / international range 16:37 <@krzee> not built in, you need a 3g usb stick 16:37 <@krzee> but yes its made for it 16:37 < redrabbit> that's cool 16:38 < redrabbit> designed to run on battery as well 16:38 <@krzee> ya 16:38 < redrabbit> rolling you own seems much sweeter imo 16:38 <@krzee> oh totally, if you're up for it! 16:38 <@krzee> hell, im not 16:38 < redrabbit> i can put whatever kind of wifi card i want 16:38 <@krzee> at least not in the forseable future 16:38 < redrabbit> same for antennas 16:38 <@krzee> well in their defense, their 2 cards are win 16:39 <@krzee> and the antenna are rp-sma 16:39 < redrabbit> the standard 16:39 <@krzee> but i still agree 16:39 < redrabbit> im good with my awus036h 16:39 <@krzee> rolling your own is the win 16:39 < redrabbit> still the best card around for injection ect 16:39 <@krzee> you'll know it 100% and get way more use out of it 16:40 < redrabbit> what i like about my setup is how modular it is 16:40 < redrabbit> i'm gonna make it work on the pi0 ultimately 16:41 < redrabbit> i can pick wifi adapter depending on if i need more power or more battery time 16:41 <@krzee> you might even be able to go into different modes based on the different hardware, after you've used it a bit you might find certain hardware means you're doing certain things 16:42 < redrabbit> no sd card 16:42 < redrabbit> its practical to have a card you can copy/dd 16:42 < redrabbit> (on the pineapple) 16:43 < redrabbit> looking at the specs its not at the level of a pi3 16:43 <@krzee> not likely, pi3 came out way more recent 16:43 < redrabbit> looks decent but way more limited 16:44 <@krzee> pi3 has usb3 for 1 thing 16:44 < redrabbit> usb 3 on the pi 3 :o 16:44 <@krzee> doesnt it? 16:44 < redrabbit> its 2.0 16:44 < redrabbit> works fine though 16:45 < redrabbit> its still a small arm pc 16:46 <@krzee> i didnt think my gsm software defined radio worked on usb2 16:46 <@krzee> i guess it does tho 16:47 <@krzee> (since i only used it with a rpi3) 16:59 < redrabbit> it does ^^ 17:01 < thereyouare> I just got an idea 17:01 < redrabbit> i'm about to make a sun powered one 17:01 < thereyouare> why not implement DNS tunneling and ICMP tunneling inside OpenVPN as a module ? 17:01 < thereyouare> can you imagine how much popular it will make OpenVPN 17:02 < thereyouare> like that iodine it doesn't encrypts data you have to do tunnel inside tunnel, but if it will be implemented in openvpn source tree it can do encryption by default 17:04 * redrabbit wonders if a pc fan can be turned into a mini windmill 17:05 <@dazo> thereyouare: you do know we are trying to slim down the feature set of openvpn, not increase it? as it is a big burden to maintain all this code ... openvpn is by far incredibly popular already, with millions of users using it actively every day 17:05 <@dazo> we will look into adding support for plug-ins doing that kind of stuff, so other projects can maintain their own "this is cool"-project ... without adding maintenance burden on the core OpenVPN developers 17:11 <@dazo> redrabbit: probably depends on what kind of fan ... if it is such a 3-pin PCM based fan speed control capable fan (or 4 pins, for that matter) it probably won't work. But a single 2 pin (only power) should be able to generate at least some electricity ... but how much you can load it, that's the difficult one - and I don't think it will be able to drive too much stuff 17:11 <@dazo> (if anything than a led, at all) 17:18 < redrabbit> wondering if i can rig a couple or more and recharge a battery from it 17:19 < redrabbit> i have a ton of spare fans around 17:19 < redrabbit> i can always get to the motor output if i remove the circuit inside 17:29 < MTecknology> using a fan as a windmill seems like an odd openvpn feature 17:29 < thereyouare> right, better use a hamster in a wheel, they are replaceable and doesn't require much feeding 17:30 < MTecknology> heh, that most assuredly fixes the out-of-scope dilemma 17:34 < klow> heres a new one to me: Bad encapsulated packet length from peer (18516), which must be > 0 and <= 1627 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link 17:34 < klow> wondering if this is because the server is running on a vmware fusion guest (debian) 17:35 < orev> openvpn not needing admin rights on windows is a game changer. great work! 17:35 < klow> orev: agreed. major pain point for some of my customers 17:37 <@krzee> klow: should be fine in a vm, can you post your configs? 17:37 <@krzee> !configs 17:37 <@vpnHelper> "configs" is (#1) please !paste your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and ovpn version, or (#2) dont forget to include any ccd entries, or (#3) pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config, or (#4) remove inline private key or tls-auth key before posting 17:39 < klow> ignore, im dumb. wrong port 17:39 < klow> sorry, crunching big time 17:39 <@krzee> cool 19:41 < fa0> Hello all 19:41 < fa0> link local, if I'm not mistaken is for ipv6? 19:43 < fa0> Actually this? https://en.wikipedia.org/wiki/Link-local_address 19:43 <@vpnHelper> Title: Link-local address - Wikipedia (at en.wikipedia.org) 19:44 < fa0> In 2.3.14 it was listed as saying link local [undef] and now in 2.4.0 as [unbound] and I'm trying to figure if I should have this bound, what the purpose would be etc...? 19:46 < Muimi> i'm back :D 20:13 < fa0> can someone please explain, in 2.4.0 I now see this from the cmd line when running as a client connecting to a server; Preserving recently used remote address: 20:13 < fa0> Before 2.4.0 I never saw this in any version of OpenVPN going back for the past 5 years... So I'm a little confused by this now... 20:19 < fa0> The thing I also don't get is that I didn't connect to this before, and having it saying 'recently used' seems odd... 20:20 < fa0> Anyone here know about this? 20:32 < thereyouare> fa0: How many apples grow on a tree? 21:01 < chandoo> hi 21:02 < chandoo> i have this error start openvpn server " Options error: --explicit-exit-notify cannot be used with --mode server" 21:12 < thereyouare> chandoo: How many apples grow on a tree? 21:20 < tx> 5 21:20 < thereyouare> All of them. 21:24 < [0xAA]> Update on my issue 21:24 < [0xAA]> I implemented buffering, added protection against 0-length packets 21:24 < [0xAA]> now the server is indefinitely stuck 21:25 < [0xAA]> because OpenVPN server is not sending packets to the TCP socket 21:25 < [0xAA]> and it's getting 0-length reads 21:28 < [0xAA]> who sends first? 21:28 < [0xAA]> OpenVPN server sends initial packet first, right? 21:29 < thereyouare> [0xAA]: How many apples grow on a tree? 21:29 < [0xAA]> thereyouare: 1337 21:29 < thereyouare> right, all 1337 of them 21:30 < [0xAA]> OpenVPN server sends TLS Initial Packet, then the handshake starts 21:33 < [0xAA]> afaik 21:34 < thereyouare> what is the difference between TLS and SSL ? 21:36 < [0xAA]> thereyouare: SSL is old, TLS Is newer 21:36 < [0xAA]> OpenVPN is not sending me any packets 21:36 < [0xAA]> the server aka 21:37 < thereyouare> so the package that called openssl is it SSL only, or it contains TLS too or is there separate package with TLS ? I know there is some GnuTLS software is it prefferable then OpenSSL ? 21:37 < thereyouare> !ssl 21:37 < thereyouare> !tls 21:37 < [0xAA]> thereyouare: OpenSSL is just the name 21:38 < [0xAA]> OpenSSL has both TLS and SSL constructs 21:38 < [0xAA]> gnutls is more preferable afaict 21:38 < [0xAA]> because GnuTLS is cleaner, safer, secure, and GPLv3 too 21:40 < thereyouare> so openvpn can use both OpenSSL and GnuTLS ? 21:41 < thereyouare> "./configure --help" doesn't says anything TLS related 21:41 < thereyouare> it only has: 21:41 < thereyouare> --disable-ssl disable SSL support for TLS-based key exchange 21:42 < ordex> thereyouare: openvpn supports OpenSSL and mbesTLS 21:42 < thereyouare> mbes ? 21:42 < ordex> mbedTLS, sorry 21:42 < ordex> toy can choose with --with-crypto-library=openssl|mbedtls 21:43 < thereyouare> is it similar to PolarSSL ? 21:43 < ordex> polarssl is the old name of mbedtls 21:43 < thereyouare> there is no more PolarSSL ? 21:43 < ordex> it ha sbeen renamed 21:43 < ordex> afaik 21:43 < thereyouare> http://polarssl.org/download/polarssl-1.3.8-gpl.tgz so this package is outdated ? 21:44 < thereyouare> I was about to install it 21:44 < ordex> I don't know 21:44 < ordex> if you open polarssl.org you get redirected 21:44 < ordex> maybe you get the latest package from there ? 21:44 < thereyouare> and #polarssl is empty 21:44 < fa0> Can anyone tell me when using 2.4.0 and connecting for the first time to a server it's telling me; Preserving recently used remote address, when it wasn't used before? 21:44 < ordex> but you can also use your package manager, without compiling it 21:44 < thereyouare> there is no package manager 21:45 < thereyouare> I have to compile everything from source 21:46 < thereyouare> ba dum tssss 21:47 < fa0> A Linux distro without a pkg manager? 21:47 < [0xAA]> mbedTLS is kinda weird 21:47 < [0xAA]> that still works and is good 21:47 < [0xAA]> OpenSSL is just full of bloatware 21:47 < [0xAA]> need LibreSSL 21:48 < [0xAA]> -.- 21:49 < [0xAA]> now everything is deadlocked 21:49 < [0xAA]> I changed the MITM to wait until OpenVPN server sends TLS initial packet 21:49 < [0xAA]> now none is sending nothing 21:51 < [0xAA]> ok 21:51 < [0xAA]> finally got the fix 21:57 < redrabbit> is there a way to use openvpn to connect from two network interfaces client side and combine speeds from multiple providers 21:59 < [0xAA]> It's named PolarSSL because it was made in Antartica 21:59 < [0xAA]> Antarctica 21:59 < [0xAA]> redrabbit: nope 22:01 < redrabbit> do you know something do to that 22:02 < ordex> redrabbit: that is not an openvpn problem, but rather an upper layer thing 22:03 < ordex> you can do mtcp if supported by the server (for example), but still it requires upper layers support, openvpn will just create the interfaces 22:03 < [0xAA]> redrabbit: that won't with with SSL afaict 22:06 < redrabbit> i host my vpn, i can configure that on in the server i guess 22:41 < thereyouare> anyone heard of ipfs.io ? 22:51 < ordex> sounds similar to freenet to some extends, no ? at least the mechanism behind 23:07 < Muimi> !seen jiquera 23:07 <@vpnHelper> jiquera was last seen in #openvpn 20 hours, 32 minutes, and 48 seconds ago: what does your log say? 23:10 < Muimi> iptables -I INPUT -i -j ACCEPT anybody know waht the vpntundevice is? 23:10 < redrabbit> iptables -a 23:10 < redrabbit> tun0 23:11 < redrabbit> ifconfig -a * 23:11 < redrabbit> lol 23:11 < redrabbit> its late 23:11 < redrabbit> type : ifconfig -a 23:11 < redrabbit> its probably tun0 23:12 < Muimi> the inet addr? 23:13 < Muimi> does the vpn server need to be started 23:42 < Muimi> !seen krzee 23:42 <@vpnHelper> krzee was last seen in #openvpn 6 hours, 2 minutes, and 45 seconds ago: cool --- Day changed Wed Jan 04 2017 00:03 < ordex> Muimi: no, if you are adding iptables rules, yu do not need to restart openvpn 00:03 < ordex> that will likely kill the rules linked to the tun interface 00:08 <@krzee> Muimi: picking up from msg 00:09 <@krzee> wellllll i havent had much chance to play behind the great firewall, but its of interest to me 00:09 <@krzee> because you cant risk you production server getting blocked i recommend getting a semi-disposable vps 00:10 <@krzee> then you may be able to play with a mix of techniques 00:11 <@krzee> like the xor patch that is out there for example 00:11 <@krzee> but if you cant risk getting that production server blocked, i suggest not testing with it 00:12 <@krzee> keep it safe, test with something else, and even when you get things right you can tunnel through a server to the real production server, so it's never at risk 00:13 <@krzee> going to lay down now 00:14 < ordex> Muimi: you got a vps behind the wall ? 00:28 < Muimi> yeah I did. 00:28 < Muimi> <3 00:35 < ordex> Muimi: cool :) what's the provider opinion with you running a vpn ? 00:36 < ordex> I am wondering because I also wanted to get one, but I was a bit reluctant to believe that a VPN could survive long enough on that machine :P 00:47 < Muimi> ordex: what's the qeustion again? 00:48 < Muimi> Oh. They don't care about that, man. They just don't want me jumping partitions. 00:51 < Muimi> ordex: but I've heard that they do some deep packet sniffing that gets through obfsproxy or whatever 00:57 < cyberanger> Muimi: obfsproxy is obfs v3, I think obfs4 is still fine last I heard. 00:57 < cyberanger> I used ssltunnel myself. 02:24 < ordex> Muimi: mh ok.. I may try 05:29 -!- Vampire0_ is now known as Vampire0 09:00 < redrabbit> ordex: providers dont care if you run your own vpn 09:00 < redrabbit> i run one of a vps at ovh, all is good 09:18 < ordex> redrabbit: what if you allow random users to connect from china ? 09:19 < redrabbit> :o 09:19 < redrabbit> mine is only for personal use 09:19 < redrabbit> and i dont use it much 09:20 < ExoUNX> redrabbit hopefully you don't use it for anonymity 09:20 < redrabbit> no 09:20 < redrabbit> i pay for the server its it the country i live in 09:20 < redrabbit> no point 09:21 < ExoUNX> well anonymity doesn't require your endpoint be a different country, but yah 09:22 < redrabbit> what would you do for anonymity 09:24 < ordex> redrabbit: why having a VPS in CN that connects to ovh via vpn? why not connecting directly to ovh with your client ? 09:25 < redrabbit> huh? 09:25 < redrabbit> i just have 1 vpn in france 09:25 < ordex> well, maybe I don't know what you use the vps for :P 09:25 < ordex> ah 09:25 < redrabbit> well 2 at home 1 at ovh 09:26 < ordex> we were talking about a VPN on a chinese VPS 09:26 < redrabbit> i use them for connectivity from 3G 09:26 < ordex> that's where the discussion started 09:26 < redrabbit> ok :p just saying my vps provider don't care 09:27 < ordex> ehhe ok 09:40 < tormoz> okay... looks like 2.4 client can't connect to 2.3 server.... 09:40 <@plaisthos> tormoz: that would be considered a bug 09:41 <@plaisthos> and generally we are not aware of anything 09:41 <@plaisthos> unless you have a broken ssl library on the 2.3 server that does not support PFS 09:41 <@plaisthos> in that case the stricter ssl settings of 2.4 refuse to connect 09:42 < tormoz> ah i'll look into this. Thanks... 09:45 <@dazo> tormoz: I've done successful 2.4 client to 2.3 server connections .... so it might be a corner case issue .... I also believe we also run some various tests regularly which also tests against 2.3 servers 09:51 < tormoz> i just don't know where to start looking, cipher was specified implicitly And yet... tls handshake failed... 10:25 < tormoz> uh oh... looks like tls-cipher default values differs 11:40 <@plaisthos> tormoz: yes 11:40 <@plaisthos> tormoz: but usually that should not be problem 11:41 <@plaisthos> tormoz: and you should get ssl library errors 11:41 <@plaisthos> at least on one side 11:52 < tormoz> i already found that yls cipher cannot be negotiated. just don't know why 11:53 < tormoz> *tls cipher 11:57 <@dazo> tormoz: you use --tls-cipher in your configs? 11:58 < tormoz> now? but ow i temporary use it to make it work 11:58 < tormoz> now, but now i temporary use it to make it work 12:00 <@plaisthos> tormoz: what is the error message? 12:00 <@plaisthos> http://ics-openvpn.blinkt.de/FAQ.html 12:00 <@vpnHelper> Title: Ics-openvpn (at ics-openvpn.blinkt.de) 12:01 <@plaisthos> see also the tls-cipher FAQ there 12:01 <@plaisthos> you might be running into that 13:10 < tormoz> ok most probably my certs require ECDHE encryption which openvpn 2.3 does not support 13:11 < tormoz> problem partially solved 13:45 -!- Netsplit *.net <-> *.split quits: @vpnHelper, +RBecker, @syzzer 13:45 -!- Netsplit over, joins: RBecker 13:45 -!- mode/#openvpn [+v RBecker] by ChanServ 13:46 -!- Netsplit over, joins: syzzer 13:46 -!- mode/#openvpn [+o syzzer] by ChanServ 13:47 -!- Netsplit over, joins: vpnHelper 13:47 -!- mode/#openvpn [+o vpnHelper] by ChanServ 14:08 -!- CGML_ is now known as CGML 14:30 < chandoo> where to copy the keys on the mobile phone 14:51 <@plaisthos> !inline 14:51 <@vpnHelper> "inline" is (#1) Inline files (e.g. ... are supported since OpenVPN 2.1rc1 and documented in the OpenVPN 2.3 man page at https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAV, or (#2) https://community.openvpn.net/openvpn/wiki/IOSinline for a writeup that includes how to use inline certs 15:17 < rzyz85fr> hello, i have a config file .ovpn that works , but asking login and password, how can i automated that by cli when do openvpn --config config.ovpn? (can't change server side config) 15:17 <@ecrist> rzyz85fr: check out the man page. there is a way to provide a file name in the config that contains your user and password 15:18 < rzyz85fr> ecrist, is it possible by env var or directs args? (didn't find directs args in manpage) 15:58 <@danhunsaker> rzyz85fr: Just add a -- to the start of any config option to use it on the commandline. 15:59 < rzyz85fr> danhunsaker, aa thanks for this precision. ! 16:01 <@danhunsaker> There may be a few that don't work, or that you'll have to adjust slightly to make work (anything with more than one argument needs them all quoted, for example), but overall that's the appreach. 16:01 <@danhunsaker> *approach 16:01 < rzyz85fr> danhunsaker, ok 16:03 < signo-> Hey, question related to rzyz85fr's. Is there anyway to point OpenVPN to an encrypted file that contains the username/password? I know you can do custom authentication on the server side but I don't know if you can either pass an encrypted password file or have a client script to decrypt. (Just trying to avoid storing plain-text passwords) 16:09 <@danhunsaker> I'm not aware of any such mechanism, but that doesn't mean they don't exist. You still have to worry about handling the decryption key, though... 16:11 < rzyz85fr> signo-, nice ask, how i can automated that with storing plain password 16:17 < para000> krzee: are you here? 16:18 <@dazo> signo-: no, such feature does not exist ... the username/password needs to be in plain text 16:19 <@dazo> rzyz85fr: --auth-user-pass can take a an option, which is a filename to the file containing either username and password, or just password .... in the former, username must be the first line and password the second line 16:21 < rzyz85fr> dazo, thanks, auth-user-pass doesn't have good explain in manpage 16:23 < rzyz85fr> dazo, so, i will put login/password in the script, then echo it to working dir with .ovpn , then call openvpn --config config.ovpn --auth-user-pass mylogin.txt 16:24 <@dazo> ehm? 16:24 <@dazo> --auth-user-pass [up] 16:24 <@dazo> Authenticate with server using user‐ 16:24 <@dazo> name/password. up is a file contain‐ 16:24 <@dazo> ing username/password on 2 lines. If 16:24 <@dazo> the password line is missing, OpenVPN 16:24 <@dazo> will prompt for one. 16:24 <@dazo> If up is omitted, username/password 16:24 < rzyz85fr> dazo, for me it is dirty, i prefer an encrypt password in .ovpn ( i repeat, don't have acces to the server side : french ISP box name freebox ) 16:24 <@dazo> will be prompted from the console. 16:25 <@dazo> rzyz85fr: send patches and we'll review them and they might be added to the code when its good enough 16:26 < rzyz85fr> dazo, ok lol 16:26 <@dazo> the problem with encrypted passwords is that it needs to be decrypted regardless ... if that happens on the client side, what would be the difference between a plain text file with username/password vs an encrypted file and then some mechanism to automatically decrypt that file when openvpn starts? 16:27 <@dazo> if you worry about a leaking password ... you should type the password each time (or us 'pass' or something else to partly automate it for you) 16:30 < chandoo> hi 16:31 < chandoo> i have vpn server running and connected to vpn from my mobile. but nothing works, how to troubleshoot 16:31 < rzyz85fr> dazo, ok, you true. for the manpage, i doesn't have this help in my ubuntu 16.04 16:31 <@dazo> !goal 16:31 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc 16:31 <@dazo> chandoo: ^^ 16:33 < chandoo> dazo, i cannot browse anything, i open browser and did cnn.com and it failed 16:34 <@dazo> that is describing what doesn't work ... what do you try to do with your VPN tunnel? 16:34 <@dazo> You want all Internet traffic to go via your own OpenVPN server? 16:35 < chandoo> i want to connect to my cameras through my app 16:36 <@dazo> !serverlan 16:36 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation, or (#3) Handy troubleshooting flowchart: http://www.ircpimps.org/serverlan.png 16:36 < rzyz85fr> chandoo, which app you use? 16:36 < chandoo> yes 16:36 <@dazo> chandoo: start with reading that ^^^ .... and look at the image at #3 at the end 16:37 < rzyz85fr> dazo, where did you find your help about "--auth-user-pass" ? 16:38 <@dazo> rzyz85fr: $ man openvpn 16:38 <@dazo> !man 16:38 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/, or (#2) the man pages are your friend!, or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker 16:38 <@dazo> rzyz85fr: you'll find the same there too 16:41 < rzyz85fr> dazo, ok i have problem in my man config (can't search without fullword, lol) 16:41 < rzyz85fr> dazo, i leave, thanks and bye 16:55 < chandoo> dazo, push route? 16:56 < chandoo> ;push "route 192.168.10.0 255.255.255.0" 16:56 < chandoo> ;push "route 192.168.20.0 255.255.255.0" 16:56 < chandoo> i have those 17:03 < chandoo> dazo, how to check the client connections on the server 19:40 < orizzle> hello, is there a way to restrict users on my vpn to only be able to see each other and not any services on the vpn host or access the internet? 19:46 < redrabbit> i want to do the same 19:46 < redrabbit> tell if you find a reliable solution 20:13 < Ziginox> !welcome 20:13 <@vpnHelper> "welcome" is (#1) Start by stating your !goal, such as 'I would like to access the internet over my vpn' (*not* '!goal ' - the bot doesn't understand that - just '!goal' [without the quotes]), or (#2) New to IRC? see the link in !ask, or (#3) We may need you to !paste your !logs and !configs and maybe !interface to help you, or (#4) See !howto for beginners, or (#5) See !route for lans 20:13 <@vpnHelper> behind openvpn, or (#6) !redirect for sending inet traffic through the server, or (#7) Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm, or (#8) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict), or (#9) And again, if you think you need !tap, you're probably wrong, or (#10) see !1925 before arguing with the admins or the person helping you 20:14 < Ziginox> !goal 20:14 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc 20:14 < Ziginox> oh, derp 20:16 < Ziginox> I'm trying to set up OpenVPN so I can access my LAN remotely; I have it installed with a server config on a Windows Server 2012 R2 machine and with client config on a Windows 7 machine. I've generated keys and opened firewall (both router and windows) on the server. The client machine appears to connect, but no traffic seems to be going through. Is there something I'm missing? 20:16 < Ziginox> Oh, and the local subnet is unique 20:18 < Ziginox> I followed the instructions here to the T, but no dice https://community.openvpn.net/openvpn/wiki/Easy_Windows_Guide#FurtherConsiderationsTroubleshooting 20:18 <@vpnHelper> Title: Easy_Windows_Guide – OpenVPN Community (at community.openvpn.net) 20:25 <@krzee> !serverlan 20:25 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation, or (#3) Handy troubleshooting flowchart: http://www.ircpimps.org/serverlan.png 20:25 <@krzee> see #3 20:26 <@krzee> orizzle: sure, firewall and dont redirect-gateway 20:29 < Ziginox> !ipforward 20:29 <@vpnHelper> "ipforward" is (#1) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall, or (#2) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward 20:29 < Ziginox> !winipforward 20:29 <@vpnHelper> "winipforward" is (#1) reboot after enabling it, or (#2) https://support.microsoft.com/EN-US/kb/230082 to enable ip forwarding on windows 20:32 < Ziginox> !route 20:32 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT!, or (#3) See !tcpip for a basic networking guide, or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts 20:32 < Ziginox> !route_outside_openvpn 20:32 <@vpnHelper> "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route, or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png 20:49 < KMBBANS> can anyone help me real quick 21:14 -!- Netsplit *.net <-> *.split quits: +s7r 21:19 < KMBBANS> hello 21:28 < conrmahr> !welcome 21:28 <@vpnHelper> "welcome" is (#1) Start by stating your !goal, such as 'I would like to access the internet over my vpn' (*not* '!goal ' - the bot doesn't understand that - just '!goal' [without the quotes]), or (#2) New to IRC? see the link in !ask, or (#3) We may need you to !paste your !logs and !configs and maybe !interface to help you, or (#4) See !howto for beginners, or (#5) See !route for lans 21:28 <@vpnHelper> behind openvpn, or (#6) !redirect for sending inet traffic through the server, or (#7) Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm, or (#8) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict), or (#9) And again, if you think you need !tap, you're probably wrong, or (#10) see !1925 before arguing with the admins or the person helping you 21:30 < conrmahr> !goal I would like to access my devices on my local network to make connections to my ubuntu device running OpenVPN. 21:35 < KMBBANS_> can someone help me 21:51 < CoreISP> Hey guys - question; the ping mechanism in OpenVPN - is that something the client and host exchange over the regular port; or does it rely on ICMP? 22:14 < KMBBANS_> does anyone know what services in services.msc msc i have to set to automatic to enable the openvpn to connect to the server --- Day changed Thu Jan 05 2017 01:35 < egrain> Is there a way to see the OpenSSL version of my clients? Push-peer-info doesn't seem to work. Or maybe I'm doing something wrong. 02:21 <@plaisthos> egrain: your client need to have a recent verrsion 02:21 <@plaisthos> might be 2.4+ only 02:21 <@plaisthos> not sure if that got backported to 2.3 02:21 <@plaisthos> Jan 5 08:14:15 hermes ovpn-aead-v6[3017]: 146.60.159.163 peer info: IV_SSL=OpenSSL_1.0.2j__26_Sep_2016 02:21 < egrain> my clients have 2.4 02:21 <@plaisthos> and push-peer-info in their config? 02:21 <@plaisthos> that is not pushable 02:22 < egrain> they need that in their config? i thought server side only. 02:22 < egrain> that's the problem then. 02:22 < egrain> thanks a bunch. 02:22 <@plaisthos> yeah 02:22 <@plaisthos> you are pushing potientally sensitive information so that needs a opt in 02:22 < egrain> okay. 02:23 <@plaisthos> Jan 5 08:14:15 hermes ovpn-aead-v6[3017]: 146.60.159.163 peer info: IV_PLAT_VER=23_6.0.1_arm64-v8a_Sony_msm8994_E5823 02:23 < egrain> doesn't matter where in the config, right? 02:23 <@plaisthos> e.g. that :) 02:23 <@plaisthos> no 02:24 <@plaisthos> I think windows c lients/linux client also push their ethernetnet mac 02:25 < egrain> i'll take all the information i can get, but i really just need the client version and openssl. 02:26 <@plaisthos> :P 03:53 < jiquera> can somebody explain the difference between lz4 and lz4-v2 (from the code they look identical except from some handling of the header bytes) 03:55 < jiquera> @plaisthos: I get an error in OpenVPN for Android I don't get in other clients. "Got unrecognized line from management: ERROR: no username is currently needed at this tme" 03:55 < jiquera> I'm only using certs no user/pass login 04:00 <@plaisthos> jiquera: that is the difference 04:00 <@plaisthos> jiquera: hm 04:01 < jiquera> but what is the purpose of it? should one be used over the other? 04:01 <@plaisthos> jiquera: the v2 methods have no overhead for uncompressed packets 04:02 < jiquera> aaaah 04:02 < jiquera> cool 04:02 < jiquera> i like that 04:02 < jiquera> :) 04:03 <@plaisthos> for the user that is strange 04:03 <@plaisthos> somehow my app thinks that OpenVPN wants a username 04:07 < jiquera> can i test something for you ? for more info? 04:09 < jiquera> also lz4-v2 seems to always add 2 bytes... an indicator and whether it was compressed or not 04:09 < jiquera> kind of looks like it is always 1 byte more than the v1 version 04:10 < jiquera> or am i being dufus now? 04:14 < jiquera> v1 stores the compression byte at the front and moves the head byte to the end (undos this for compression 04:15 < jiquera> v2 prepends 2 bytes one as indicator and a second one as the compression byte 04:15 < jiquera> but whyyyyy support both methods 04:18 <@plaisthos> jiquera: the moving around actually costs a bit of performance 04:18 <@plaisthos> both methods for backwards compatibility 04:18 < jiquera> for the second method you mean? 04:19 < jiquera> ah ok i didnt realize there was legacy involved here 04:19 <@plaisthos> v2 is OpenVPN 2.4+ only 04:19 <@plaisthos> Altough we implemented lz4-v1 04:19 <@plaisthos> which is kind of nonsense since lz4 is 2.4+ only anyway 04:20 < jiquera> yeah that's why i didnt get the redundancy 04:20 < jiquera> i mean the difference is 1 byte at most... might as well just pick one method 04:20 < jiquera> expecially since it's nowhere documented that there are two algorithms 04:21 < jiquera> the sample code uses lz4-v2 but the manual only mentions lz4 04:23 <@plaisthos> documentation might be improved ... 04:37 < jiquera> oki i get the point with lz4 algorithms now... although i still think one would have sufficed. Do you want me to debug the android thing? if so what do you need to know? 04:42 < jiquera> also... it might have been better to not use a legal ascii character as indicator byte... if you send plaintext now it might trigger the escape method. using 0x1B would have been less likely to trigger i guess 05:46 < jiquera> !heartbleed 05:46 <@vpnHelper> "heartbleed" is (#1) only affects OpenSSL 1.0.1 through 1.0.1f. Does not affect polarssl, or (#2) if running vuln openssl then both client and server keys not protected by tls-auth should be considered compromised., or (#3) android 4.1.2_r1 is the first one to have -DOPENSSL_NO_HEARTBEATS and it is still in master. android 4.1 and 4.1.1 are probably affected., or (#4) 05:46 <@vpnHelper> https://community.openvpn.net/openvpn/wiki/heartbleed, or (#5) http://xkcd.com/1354/ 05:48 < jiquera> !poodle 05:48 <@vpnHelper> "poodle" is (#1) http://googleonlinesecurity.blogspot.com/2014/10/this-poodle-bites-exploiting-ssl-30.html . OpenVPN uses TLSv1.0, or (with >=2.3.3) optionally TLSv1.2 and is thus not impacted by POODLE. See also: !hardening for some unrelated TLS security options OpenVPN has, or (#2) https://www.tinfoilsecurity.com/poodle for a tool for testing your websites 05:54 <@plaisthos> jiquera: can you send me a complete log of the app and tell me what is selected as authentication method under basic settings? 05:54 <@plaisthos> jiquera: the character has been to be something that an IP or Ethernet packet does not start with 05:56 <@plaisthos> the header is IP version 5 05:56 < jiquera> complete log is a bit tricky at the moment... (work security policy) 05:56 < jiquera> as for the character it makes sense 05:56 < jiquera> i can give you info about the config 05:57 <@plaisthos> jiquera: ah okay 05:57 < jiquera> but i have to type everything manually 05:57 <@plaisthos> jiquera: hm 05:57 < jiquera> so please use efficient queries ;) 05:57 <@plaisthos> what is selected under basic settings? 05:58 < jiquera> LZO -> ON; Type -> Certificates; and then the certs and key 05:58 <@plaisthos> is the key encrypted and requires a pw? 05:58 < jiquera> yeah 05:58 <@plaisthos> hm 05:59 <@plaisthos> I see the bug :P 05:59 < jiquera> the password is used to auth? 05:59 <@plaisthos> the bug is there since forever 05:59 <@plaisthos> literally 05:59 < jiquera> well the connection succeeds... so i guess unless somebody reads through the log, nobody notices 06:00 <@plaisthos> no when openvpn requires any kind of password I sent the username and the password 06:00 < jiquera> ah oki and in this case it just needs the pass for the key 06:01 < jiquera> weird that nobody noticed that though... what happens if you use key+pass and user/pass but with different passwords? 06:06 -!- Gizmokid2010 is now known as Gizmokid2005 06:07 <@plaisthos> jiquera: it works :) 06:07 <@plaisthos> jiquera: it always send the right password 06:07 <@plaisthos> but also always the user name 06:07 <@plaisthos> OpenVPNManagementThread.java:570 if you want to look ;) 06:08 < jiquera> looking 06:10 < jiquera> yup i see what you mean 06:10 <@plaisthos> is quite silly :) 06:10 < jiquera> im surprised nobody noticed :p 06:11 < jiquera> maybe openvpn has not always reported an error? 06:11 <@plaisthos> it does 06:11 <@plaisthos> but keys with password are rare 06:11 < jiquera> are they? 06:11 < jiquera> i work in security... never seen one without tbh 06:11 <@plaisthos> people most times have either pcks12 which gets imported into android keystore or just plain key+pem 06:12 < jiquera> ah key with pw on openvpn for android are rare :p 06:12 < jiquera> yeah i guess so then 06:12 <@plaisthos> yeah 06:12 < jiquera> :p 06:12 <@plaisthos> user certificates tend to be in pkcs12 format 06:13 <@plaisthos> if you are security orientated on android you store your certificate inside the keystore anyway 06:13 < jiquera> but then it still contains a key right? but it gets decoded by android :p 06:13 <@plaisthos> yeah 06:14 < jiquera> yeah well.. i do hardware security (side channel analysis and fault injection etc)... no too familiar with android 06:14 <@plaisthos> but either in a hardware keystore 06:14 < jiquera> but fair point :p 06:14 <@plaisthos> or at least in some trustzone special seperated zone 06:14 <@plaisthos> the app does not get the key anymore 06:16 < jiquera> when i start generating keys for 2.4 i'll make them pkcs12, pinky promise :) 06:16 <@plaisthos> do whatever you want ;) 06:16 <@plaisthos> for mobile devices you might want to look into 06:16 <@plaisthos> !inline 06:16 <@vpnHelper> "inline" is (#1) Inline files (e.g. ... are supported since OpenVPN 2.1rc1 and documented in the OpenVPN 2.3 man page at https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAV, or (#2) https://community.openvpn.net/openvpn/wiki/IOSinline for a writeup that includes how to use inline certs 06:17 < jiquera> yeah i inline everything... without it it's a nighmare 06:17 < jiquera> just wasnt using pkcs12 as i didnt really see the advantage over the raw format 06:18 < jiquera> but if it can be imported into keystores and the raw format not... it finally has a benefit for me :) 06:18 <@plaisthos> Iirc my app asks you to import it into the keystore 06:18 <@plaisthos> not 100% sure if that also works for inline pkcs12 06:18 <@plaisthos> have to check 06:18 < jiquera> I'll tell you soon enough ;) 06:19 <@plaisthos> I also wanted to do a pem+key => pcks12 importer 06:19 <@plaisthos> but I have found the motivation to fight the horror of x509+pkcs12 again 06:20 < jiquera> well, if you can handle pcks12 decently, i guess the conversion can be left to the vpn admin 06:23 <@plaisthos> importing embedded pcks12 works 06:24 < jiquera> nice 06:24 < jiquera> i'll start doing some conversions this weeken then... so i have some fresh bugs to report on monday 06:25 <@plaisthos> :) 06:25 < jiquera> thx for the quick analysis though :D 08:05 < robsco> a while back someone shared with me the docs for allowing access behind an OpenVPN servers LAN for clients, and vice versa, with iptables rules, etc. does anyone have that link, can't see to find a nice example 08:07 <@plaisthos> !iroute 08:07 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd 08:07 <@plaisthos> basically that is the keyword 08:07 < robsco> thanks 08:07 <@plaisthos> don't know of a guid though 08:07 < robsco> i've got old configs that do it one way, but not the other 08:08 < robsco> it was this page https://community.openvpn.net/openvpn/wiki/RoutedLans but there was also another for doing it the other way round, i want to do both 08:08 <@vpnHelper> Title: RoutedLans – OpenVPN Community (at community.openvpn.net) 08:08 < robsco> will have a crack at this and see how I get on 09:31 < oditector> hello 09:32 < oditector> i usevpnkeys and get this error , what should i specify for --ifconfig paramter, or --default-gateway dhcp ? i tried it but didnt work? 09:32 < oditector> NOTE: unable to redirect default gateway -- VPN gateway parameter (--route-gateway or --ifconfig) is missing 09:40 < oditector> hello??? is anyone here??? 09:40 <@ecrist> yes, people are here. 09:41 < oditector> great then tell me my query that i asked? 09:41 <@ecrist> wow, you're off to a great start 09:41 <@ecrist> did you read !welcome? 09:41 <@ecrist> or even /topic? 09:42 < oditector> how should i do with --route-gateway for vpnkeys 09:42 < oditector> i don't have a firewall problem as vpnbook works without the --ifconfig option 09:42 < oditector> !welcome 09:42 <@vpnHelper> "welcome" is (#1) Start by stating your !goal, such as 'I would like to access the internet over my vpn' (*not* '!goal ' - the bot doesn't understand that - just '!goal' [without the quotes]), or (#2) New to IRC? see the link in !ask, or (#3) We may need you to !paste your !logs and !configs and maybe !interface to help you, or (#4) See !howto for beginners, or (#5) See !route for lans 09:42 <@vpnHelper> behind openvpn, or (#6) !redirect for sending inet traffic through the server, or (#7) Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm, or (#8) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict), or (#9) And again, if you think you need !tap, you're probably wrong, or (#10) see !1925 before arguing with the admins or the person helping you 09:43 <@ecrist> is vpnbook a VPN provider? 09:43 < oditector> ecrist: yes 09:44 <@ecrist> ok, unfortuneately, you'll need to contact their support for help. 09:44 <@ecrist> we normally will need to see server logs to offer any real assistance 09:44 < oditector> no vpnkeys i said 09:45 <@ecrist> ? 09:45 < DArqueBishop> Is vpnkeys a VPN provider? 09:45 < oditector> --route-gateway ?? was that? 09:45 < oditector> https://www.vpnkeys.com/get-free-vpn-instantly/ 09:45 <@vpnHelper> Title: Free VPN - 100% Free PPTP and OpenVPN Service (at www.vpnkeys.com) 09:45 < oditector> yes it is a provider 09:45 <@ecrist> well, you said both vpnbook and vpnkeys 09:45 < DArqueBishop> oditector: then ecrist's answer still applies. You need to contact them for support. 09:46 < DArqueBishop> Support here is geared mainly towards those who run their own servers, and there's not much we can do to help when you only control one end of the connection. 09:46 < oditector> lol, i don't think they'd answer and moreover i don't know what should i do with --route-gateway 09:46 <@ecrist> we don't, either, without knowing how the server is configured. 09:48 < oditector> https://ptpb.pw/31DO 09:50 * ecrist doesn't folllow random links without context 09:50 < oditector> yeah? 09:50 < oditector> https://www.vpnkeys.com/how-to-setup/ is this too random 09:50 <@vpnHelper> Title: VPN Setup – How to Setup VPN with VPN Keys (at www.vpnkeys.com) 09:51 < oditector> or shall i paste here , and make it less random 09:51 <@ecrist> no, but we don't support customers of XYZ service provider 09:51 < oditector> why is linux not mentioned , then where shall i go? 09:51 <@ecrist> contact THEIR support 09:52 * ecrist shouts "Make READY!" 10:00 < jiquera> i imported pkcs12 files into my android phone... however these were debug versions... does anybody know how to remove them again? 10:01 <@plaisthos> jiquera: settings -> security -> somewhere there 10:01 < jiquera> im trying... but i only find the CA cert 10:02 <@plaisthos> on Android < 7.0 you can only delete all 10:02 < jiquera> ffs 10:02 < jiquera> oki np 10:02 < jiquera> thx 10:02 <@plaisthos> there is a "delte auth data" with the subtitle "remove all certificates" 10:02 <@plaisthos> or similar 10:03 <@plaisthos> not sure what it is called in English exactly 10:03 < jiquera> yeah i have a "clear credentials" 10:03 < jiquera> but it indeed removes everything 10:03 < jiquera> lovely system 10:03 < jiquera> ow btw 10:04 < jiquera> is easyrsa still part of your development? 10:04 < jiquera> it has some serious bugs with filepaths with spaces 10:04 < jiquera> with serious i mean "it took me hours to figure out what was going wrong exactly and why" 10:04 < jiquera> using v3 10:08 <@plaisthos> !easy-rsa 10:08 <@vpnHelper> "easy-rsa" is (#1) easy-rsa is a certificate generation utility., or (#2) Download here: https://github.com/OpenVPN/easy-rsa/releases, or (#3) Tutorial here: https://community.openvpn.net/openvpn/wiki/EasyRSA 10:08 <@plaisthos> blame ecrist :p 10:11 < jiquera> @ecrist: is this still something you work on? 10:12 < jiquera> if so: binaries for windows in the latest release are still missing + when using filepaths with spaces things go wrong when converting to pksc12 due to the interpretation of a variable as 1 cmd parameter instead of several 10:12 < jiquera> dinne! 10:13 <@plaisthos> jiquirea: Report that as github issue 10:14 <@plaisthos> narf 10:24 < para000> guys what do you think about this server.conf: https://codepaste.net/cdz7x4 ??? 10:27 <@dazo> para000: you're using too many options .... 10:29 <@dazo> para000: txqueuelen/rcvbuf/sndbuf/tls-cipher .... those should not be used unless you really know what you are doing 10:30 <@dazo> reneg-sec 7200 .... that is very aggressive 10:30 <@dazo> (and will be a performance hit) 10:30 <@dazo> oh wait ... that's every 2 hour ... that is reasonable .... somehow my head calculated it the other way around 10:31 * dazo is sleep deprived today 10:32 <@dazo> max-clients 1 ... doesn't really give you any advantage, it sure isn't doing anything good for hardening the security - it will just be annoying if your client disconnects and openvpn stops running ... restarting OpenVPN will cause a rejection until the server finally realises the client is dead and drops the session 10:34 <@dazo> further .... /etc/openvpn/easy-rsa/keys/ <<< that path makes me concerned ... see these URLs for details: http://community.openvpn.net/openvpn/wiki/GettingStartedwithOVPN#Configuringencryption (Look for the BEWARE: paragraph) ... and https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg03466.html 10:34 <@vpnHelper> Title: GettingStartedwithOVPN – OpenVPN Community (at community.openvpn.net) 10:39 <@plaisthos> float in server config is also strange 10:39 <@plaisthos> should give an error 10:39 <@dazo> oh true! 10:40 <@plaisthos> also 443/udp is a strange combination 10:40 < dakar> 23/udp ftw 10:40 <@plaisthos> mssfix 0 10:41 <@plaisthos> I have no idea if 0 default but don't do that 10:41 <@dazo> 443/udp ... true, but it often works surprisingly well on many networks only allowing http/https .... for some reason many firewalls opens for udp+tcp on the same ports 10:41 <@plaisthos> also comp-lzo is outdated 10:41 <@plaisthos> and you need to push compression to 10:42 <@plaisthos> and if you are planning for 2.4+ clients only 10:42 <@plaisthos> you might use tls-crypt instead of tls-auth 10:42 <@dazo> plaisthos: mssfix defaults to 1450 ... 10:43 <@plaisthos> dazo: yeah, but I have no idea what it does with 0 as paramater 10:44 <@dazo> plaisthos: my memory is very scarce ... but I think it pushes that value to --fragment ... or there are some combinations here which results in --fragment and --mssfix using the same value 10:44 <@plaisthos> :) 10:44 < __rob2> hello 10:45 < __rob2> Trying to connect to my openvpn server via a socks5 proxy 10:45 < __rob2> works normally 10:45 < __rob2> just not via the proxy 10:45 <@dazo> checked the proxy logs? 10:46 < __rob2> its on my phone 10:46 <@plaisthos> local proxy? 10:46 < __rob2> using it directly now with chrome proxy settings 10:46 < __rob2> well Im on a laptop 10:46 <@dazo> !all 10:46 <@vpnHelper> "all" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#' client.conf`), also include which OS and version of openvpn, include your routing tables, firewall settings and client/server logfiles, or (#2) For more detailed instructions, look to: !logs !configs !interface 10:46 < __rob2> but I want everything to route via the phone 10:46 < __rob2> through the vpn, which I want to connect via the socks5 proxy on the phone 10:47 <@plaisthos> phone means android? 10:47 < __rob2> http://pastebin.com/Hhg6qL3A 10:47 < __rob2> yea 10:47 < __rob2> thats my logs 10:47 <@plaisthos> laptop => tethering wifi => phone [VPN client => socks ] => mobile 10:47 <@plaisthos> did I get that right? 10:48 < __rob2> yea, but I cant tether 10:48 < __rob2> or I would directly connect 10:48 < __rob2> but if my phone runs a socks 5 proxy server 10:48 < __rob2> it all looks like its internet on the phone, so it works 10:49 <@plaisthos> that proxy needs to be a normal android app for that to work 10:49 < __rob2> it is 10:49 < __rob2> SSHTunnel i think is the app Im using 10:49 <@plaisthos> and even then the behaviour for incoming connecting while a VPN is active is kind of undefined 10:49 < __rob2> its working right now 10:49 < __rob2> this is going through it on chromes proxy settings 10:49 < __rob2> but I want it to be system wide 10:50 < __rob2> or only chrome works, and not everything uses the windows proxy settings 10:50 < __rob2> if openvpn client is running, everything goes through 10:50 < __rob2> so each part is working, just not openvpn client with socks5 proxy set in the options.. 10:52 <@plaisthos> __rob2: you seem to run into the 5s proxy connect timeout of openvpn 2.3 10:53 < __rob2> ohh, is that the cause ? 10:53 <@plaisthos> I don't know 10:53 <@plaisthos> that is all I see in your sparse log 10:54 < __rob2> https://i.snag.gy/yiQ7AG.jpg 10:54 < __rob2> thats the setup.. 10:54 < __rob2> where ...43.1 is my phone 10:54 < __rob2> as I say, chrome is working 10:54 < __rob2> is there a setting to increase the verbosity of the logs on ovpn client ? 10:54 <@plaisthos> !verb 10:55 <@vpnHelper> "verb" is (#1) verb command is for setting log verbosity, see --verb in the manual (!man) for more info, or (#2) verb 5 is good for finding firewall problems, verb 4 for troubleshooting anything else, and 3 is good for every day usage., or (#3) Anything more than 5 is for developer debugging only (special debug build needed) 10:56 < __rob2> how high does it go ? 10:58 <@plaisthos> !man 10:58 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/, or (#2) the man pages are your friend!, or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker 11:00 < para000> plaisthos: i`m new at OpenVPN setups, now learning and setting up my first server :P, and i`m haveing a lot of problems 11:01 < para000> can you give me a example of a proper server.conf with certification auth ? 11:01 < para000> it will go long way for me finishing faster my first try :P 11:01 < __rob2> http://pastebin.com/0Avf2zh9 11:01 < __rob2> thats a more verbose log 11:02 < __rob2> verb=7 11:08 < __rob2> any suggestions ? 11:10 <@dazo> para000: If you're new to OpenVPN ... _do_ read this one: http://community.openvpn.net/openvpn/wiki/GettingStartedwithOVPN 11:10 <@vpnHelper> Title: GettingStartedwithOVPN – OpenVPN Community (at community.openvpn.net) 11:11 <@dazo> it provides the bare minimum configuration of something that does work ... and explains what all these settings do and why you need them ... and you _do_ need to understand that 11:14 < robsco> iroute issues. client LAN ips can access any machine on the LAN of the vpn server. the vpn server can access IPs on the clients LAN, but not other machines on the servers LAN. http://pastebin.com/qv2qyXKa 11:16 < robsco> feels like it's gonna be a tiny routing mistake somewhere 11:18 < robsco> possibly the default gateway (which I don't control) on the servers LAN is getting the traffic 11:19 <@dazo> do you have routing configured on all clients and server properly, for all networks? 11:20 <@dazo> client LAN must know of server LAN, and server LAN must know of client LAN 11:21 <@dazo> and is net.ipv4.ip_forward enabled on the OpenVPN server? 11:21 < robsco> yup, but this routing table on one of the machines on the servers LAN is making me suspicious http://pastebin.com/RZFMBT6X 11:22 <@dazo> that looks wrong ... which LAN is behind the VPN client? 11:22 < robsco> behind the vpn client is 192.168.0.0/24 11:22 < robsco> 172.31.1.0/24 is the server lan 11:22 < robsco> 10.10.10.0/24 is the vpn network 11:23 <@dazo> good .. and what is the IP of the VPN server? 11:23 <@dazo> IPs! 11:23 < robsco> 172.31.1.10, 10.10.10.1 11:23 <@dazo> good ... your server config lacks a gateway on the "route 192.168.0.0 255.255.255.0" ... it needs a third parameter 11:24 < robsco> really? the examples I've been using don't have it? 11:24 <@dazo> you will need to have a fixed VPN IP for your VPN client (ifconfig-push in the ccd config) .... and then add that IP as the third argument to the route statement 11:24 <@dazo> 192.168.0.0 172.31.1.10 255.255.255.0 UG 0 0 0 eth0 11:24 < robsco> ok i'll try that 11:25 <@dazo> that should say: 192.168.0.0 10.10.10.X 255.255.255.0 tunX 11:25 <@dazo> 10.10.10.0 172.31.1.10 255.255.255.0 UG 0 0 0 eth0 11:25 <@dazo> that also looks odd, though 11:25 <@dazo> I'd expect to see: 11:26 < robsco> i'm sure I've it working quite easily on a previous platform 11:26 <@dazo> 10.10.10.1 0.0.0.0 255.255.255.0 tunX 11:27 < robsco> i thought the "route" config just tells ovpn to take care of that route? 11:27 < robsco> by following https://community.openvpn.net/openvpn/wiki/RoutedLans 11:27 <@vpnHelper> Title: RoutedLans – OpenVPN Community (at community.openvpn.net) 11:27 < robsco> no 3rd param 11:28 <@dazo> well, I have a working setup with 3 VPN clients ... where each VPN client can access the LAN(s) behind each of the other clients ... and I do need the third argument there 11:29 <@dazo> but it might be due to that my setup is far more advanced, with LAN<->client1<->server<->client2<->LAN 11:29 < robsco> yeah, this is just 1 client 11:30 <@dazo> and not providing the third argument ... it defaults to whatever --route-gateway is set to 11:39 < robsco> found it, was a setting on aws that checked source/dest addresses, disabled it, and hey presto 11:40 <@dazo> ahh! 11:41 < robsco> talk about a pain :) 11:41 <@dazo> :) 11:41 < robsco> thanks for you input tho 11:41 <@dazo> when you mention aws ... I do remember others have stumbled upon the same issue though 11:42 <@dazo> but had you mentioned aws earlier, I probably wouldn't have remembered the solution though :/ 11:42 < robsco> was sure i couldn't have been the first but took a while to find it in google 11:45 < para000> guys do i need to use a user and group on the server.config? 11:46 <@dazo> para000: on Linux/BSD (or other *nix OSes) it is advisable to add that 11:48 < para000> k, doing that now 11:56 <@ecrist> yes, I have plans to fix easyrsa sometime soon. 11:56 <@ecrist> I need to finish this damn book, first 11:59 < para000> i managed to make a connection 11:59 < para000> with basic settings 11:59 <@dazo> congrats! 11:59 <@dazo> then 1/3 of the job is done :-P 11:59 < para000> dazo now i need to optimize or what? 12:00 <@dazo> then you need to configure routing ... and then do the firewalling properly 12:00 <@dazo> and then, as an optional step, performance optimizing comes 12:00 < para000> k, yes. I done some routing and ufw seetings 12:01 < para000> krzee told me there is a way i can rout with only 1 server a specific client to a specific IP 12:02 <@dazo> that statement can be understood in several ways ... each with a different solution .... :-/ 12:03 < para000> k, so a guy made me a server 6 months ago 12:04 < para000> and i learn some staff from him, but i see you guys are more proffesional then him 12:04 < para000> i needed 10 IPs on my VPN 12:04 < para000> and he made 10 servers.conf 12:04 < para000> for every IP 12:04 <@dazo> !???!!?!?? 12:04 < para000> and every client connected to a server 12:04 < para000> and that how every client gets its own IP 12:05 < para000> cause i need Client1 to have same IP every time 12:05 < para000> do you advice me to do the same as him? 12:05 < para000> cause krzee told me it can be done with 1 server 12:06 < para000> and is more relaible and stable 12:06 <@dazo> okay ... let one thing be said .... it isn't entirely stupid to do so, if the network configuration is done equally clever (using p2p mode, not server mode) .... as that can give better performance if the VPN server is powerful with multiple cores and each VPN client does a lot of traffic over the VPN 12:06 <@dazo> *but* in most cases, it is not needed to do a setup this complex 12:07 <@plaisthos> without knowing your setup we never know 12:07 < icyjug> hi, i am using ovpn files to connect to vpn and i want to check if *all* traffic goes through the vpn 12:08 <@dazo> it is usually enough to have --server 10.8.0.0 255.255.255.0 in the server config (which adds a "DHCP" pool for all VPN clients) ... and then add --client-config-dir where each VPN client have their own unique Common Name in their certificate, with a matching filename inside the --client-config-dir directory 12:08 <@dazo> each of these config files will then have --ifconfig-push with the VPN IP address you want the client to have 12:09 < icyjug> i read somewhere that netstat -nr can do that 12:09 <@dazo> icyjug: use tcpdump/wireshark ... or visit some "what's my IP address" web sites from your VPN client and see which IP you get 12:09 < icyjug> dazo thats not enough 12:09 < icyjug> i am afraid 12:09 <@dazo> icyjug: netstat -nr just dumps the routing table 12:10 <@dazo> icyjug: using tcpdump/wireshark should definitely give you an indication if the routing works as expected 12:10 < icyjug> dazo is this a problem in my table then? 0.0.0.0 192.168.0.1 0.0.0.0 UG 0 0 0 wlo1 12:10 <@dazo> icyjug: just dump the traffic on the public interface ... all you should see there is the OpenVPN traffic to the server/client 12:11 < icyjug> dazo ok i will try wireshark too 12:11 <@dazo> icyjug: not necessarily ... if using --redirect-gateway def1 ... that is expected 12:11 <@dazo> it ensures you won't loose connectivity is openvpn crashes in a way where it doesn't restore the routing table with the old default gateway 12:15 < icyjug> dazo just a general question, would using a website like ipleak.net prove 100% that all my traffic goes through the vpn? 12:16 < para000> dazo: still here? 12:16 <@dazo> it will most likely give you a very strong indication which IP address your browser will use 12:16 <@dazo> para000: yeah 12:16 < para000> export KEY_CN="CommonName" 12:16 < para000> this one? 12:16 <@dazo> nope 12:17 < para000> export KEY_COUNTRY="US" 12:17 < para000> export KEY_PROVINCE="CA" 12:17 < para000> export KEY_CITY="SanFrancisco" 12:17 < para000> export KEY_ORG="Home" 12:17 < para000> export KEY_EMAIL="para@gmail.com" 12:17 < para000> export KEY_OU="Home" 12:17 < para000> # X509 Subject Field 12:17 < para000> export KEY_NAME="server" 12:17 < para000> wich one? 12:17 < para000> key_name?> 12:17 <@dazo> para000: when you do ./build-.... there is a a name used as an argument. that is used for the Common Name field 12:17 < para000> k 12:17 < para000> got it 12:18 < para000> so the file name that export 12:19 <@dazo> yeah, it is also used as filename 12:19 <@dazo> openssl x509 -noout -subject -in $CERT_FILE ... will give you an indication 12:19 < icyjug> dazo i am sorry but cant figure out how to install or use wireshark..let me ask the root problem 12:20 <@dazo> try tcpdump instead? 12:22 < para000> k, i understand where you are going now dazo 12:22 < icyjug> i am using airvpn as a good p2p vpn and using some scripts i get no dns leaks, ipv6 leaks and also wrote a killswitch using ufw from an article i read.. i test this setup through many websites and there are no leaks, not even when torrenting as tested here ipleak.net 12:23 < icyjug> but recently i used a p2p streaming app called popcorntime, without testing it 12:24 < icyjug> and i cant even test it normally like my qbittorrent for ip leaks 12:24 < para000> one more stupid question: if i do ./build-key client then take the output file and eidit its name to client1 , client2 etc. it works ? or i need to ./build-key all of them? 12:24 < icyjug> is there any ground to be worried? 12:25 <@dazo> para000: the CN= field inside certificates are not based on the file name 12:26 <@dazo> icyjug: well, really hard to say ... if you have some clever kill scripts which disallows everything except establishing VPN connections when OpenVPN is not running ... you've moved the responsibility of a failure to that script 12:27 <@dazo> if you need to worry, depends entirely on how much you trust that script 12:28 < icyjug> so, the only need to worry is on the killswitch implementation? 12:28 <@dazo> if that is designed to block anything but OpenVPN traffic going out on your physical network interface, yes 12:29 < icyjug> yes it blocks everything and allows only tun0 12:30 <@dazo> well, then you need to trust that script to always do the right thing .... to get that confidence? You need lots of testing, testing, testing, testing, testing .... did I mention testing, and testing? 12:30 < icyjug> my concern is that when i used this app the first time, (even though for less than 5 min) i had not yet used the killswitch script 12:31 < icyjug> i am just worried if there exists in theory a torrent app that could dump connection through tun0 12:31 <@dazo> and with testing I also mean testing when things go wrong, not just the expected behaviours ... what happens if openvpn dies unepxectedly (kill -9) ... what happens when your computer gets a new public IP ... what happens during re-negotiations, when it looses network connectivity, etc, etc, etc 12:31 < para000> dazo: do i need to edit /etc/ufw/before.rules as well? 12:32 <@dazo> icyjug: if you add default gateway via tun0 ... even torrent apps will send the traffic via tun0 12:32 < icyjug> oh damn it seems the best way is to use a client right? 12:33 <@dazo> para000: I have no idea ... I despise the ufw stuff ... that is the worst attempt to make iptables simpler while actually managing to do the opposite for no good reason 12:33 < icyjug> dazo please have a look it is very short :D http://pastebin.com/Q2Jt8cBY 12:34 <@dazo> icyjug: don't ask me .... what is best ... you haven't provided any goals 12:34 < icyjug> well for torrenting i mean 12:34 <@dazo> icyjug: I have no idea what those ufw commands results into 12:35 < icyjug> ok 12:35 <@dazo> as I just said to para000, I despise ufw ... 12:36 < icyjug> dazo do you think it is a better idea to use eddy client from airvpn? 12:36 <@dazo> I have no idea 12:36 < icyjug> ok :D 12:37 <@dazo> just don't take it for granted that airvpn will protect your back if someone tries to track you down due to illegal activities 12:37 <@dazo> airvpn may even provide your full identity or public IP addresses you've connected to without your knowledge 12:38 < icyjug> even though they say no logs? 12:38 <@dazo> how do you know they just say that without complying to it? 12:39 < icyjug> ok right 12:40 < icyjug> damn i just wanna be free to watch some movies at home as i used to 12:40 <@dazo> to be honest, from what I've heard ... Private Internet Access is one VPN provider who have had full transparency and pissed off the FBI due to this ... https://torrentfreak.com/vpn-providers-no-logging-claims-tested-in-fbi-case-160312/ 12:40 <@vpnHelper> Title: VPN Providers No-Logging Claims Tested in FBI Case - TorrentFreak (at torrentfreak.com) 12:40 < icyjug> why do you despise ufw btw ? 12:40 <@dazo> that is the worst attempt to make iptables simpler while actually managing to do the opposite for no good reason 12:41 <@dazo> it even sometimes is so clever it does the wrong thing 12:42 <@dazo> icyjug: but to take the moral side of watching movies ... you should pay for the stuff you consume ... go subscribe to netflix or hbo or whatever and actually contribute back instead of being a parasite abusing others work 13:40 < para000> dazo: are you here? 13:51 < para000> so i added this to openvpn server.conf 13:51 < para000> client-config-dir /etc/openvpn/ccd 13:51 < para000> now in there i crated client2.user 13:51 < para000> with this inside: ifconfig-push 10.8.0.3 10.8.0.1 13:52 < para000> and when i connect with client2.ovpn 13:52 < para000> i get 10.8.0.2 13:52 < para000> :( 13:52 < para000> do i need to do something more? 14:19 <@dazo> para000: please provide the output of: openssl x509 -noout -subject -in client2.crt (client2.crt needs to be the certificate file of the client) 14:55 < para000> subject= /C=US/ST=CA/L=SanFrancisco/O=Home/OU=Home/CN=client2/name=server/emailAddress=para@gmail.com 14:56 < para000> sorry dazo i was away from computer, was so mad, working for like 3 days now on this :P 15:42 < para000> anyone left here? 17:03 < chandoo> my clinet(android phone) has no net after vpn connection, how to troubleshoot this 17:17 < chandoo> after i connect to vpn server from my phone how to use vpn connection in apps 17:17 < chandoo> is it default for all apps or do i have to do something on android phone 17:45 < BtbN> configure the client to redirect all traffic, if the server doesn't push that already. 17:56 < chandoo> i added route 10.8.0.0/24 to client.ovpn 17:56 < chandoo> BtbN, 17:57 < BtbN> so accessing that network will get routed over your VPN 17:58 < chandoo> i dont see bbc.com in my phone browser yet 17:58 < chandoo> is that the right thing to do on client side? 17:58 < BtbN> why would bbc.com be on 10.8.0.0/24? 17:58 < chandoo> i mean browsing to check if i can connect to net 17:59 < para000> chandoo you need to edit you server first 17:59 < para000> what linux are you using? 17:59 < chandoo> centos 17:59 < BtbN> if you want to redirect arbitrary traffic, you need to set the default route 17:59 < BtbN> And a server that's set up for it. 17:59 < chandoo> i followed this document in setting up the whole thing https://www.digitalocean.com/community/tutorials/how-to-setup-and-configure-an-openvpn-server-on-centos-7#step-6-%E2%80%94-configuring-a-client 17:59 <@vpnHelper> Title: How To Setup and Configure an OpenVPN Server on CentOS 7 | DigitalOcean (at www.digitalocean.com) 17:59 < para000> is your configuration working on a windows or linux clinet to connect? 18:00 < chandoo> i am with in the lan 18:00 < chandoo> haven't test on lan 18:00 < chandoo> first device i am testing is on my android phone 18:01 < para000> let me check your guide 18:01 < para000> so most of this guids are out of date 18:01 < para000> do a openvpn --version 18:02 < para000> on your centos server 18:02 < para000> command: openvpn --version 18:02 < para000> BtbN: are you here? 18:03 < chandoo> OpenVPN 2.3.14 x86_64-redhat-linux-gnu 18:03 < para000> coppy more 18:03 < chandoo> para000, do you want the complete output 18:04 < para000> OpenVPN 2.4.0 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Dec 27 2016 18:04 < chandoo> http://paste.fedoraproject.org/520517/83660497 18:04 < chandoo> [root@kailash ~]# 18:05 < para000> i`m not an expert, but i tried with this guids on the internet and found out that is best to install openVPN from oficial website 18:06 < para000> https://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos 18:06 <@vpnHelper> Title: OpenvpnSoftwareRepos – OpenVPN Community (at community.openvpn.net) 18:31 < mojtaba> Hi, do you know how can I transfer dns requests? 18:31 < mojtaba> I have an Asus router, and I am using ubuntu. 18:32 < mojtaba> I am outside of my LAN, and when I ping 4.2.2.4, I get response. but no luck with ping google.com 18:32 < mojtaba> Any idea? 18:34 < w9qbj> Using OPENVPN on a Raspiberr Pi, the vpn net is 10.8.0.x /24 I'd like to change it to a 172.16.x.y/24 net. I've changed server.conf, i can connect, but nothing gets passed through. What am I missing?? 19:23 -!- Netsplit *.net <-> *.split quits: @mattock 19:23 -!- Netsplit *.net <-> *.split quits: @dazo, @danhunsaker 19:25 -!- Guest44814 [~dazo@openvpn/corp/developer/dazo] has joined #openvpn 19:25 -!- Netsplit over, joins: mattock 19:25 -!- mode/#openvpn [+o Guest44814] by ChanServ 19:25 -!- mode/#openvpn [+o mattock] by ChanServ 19:32 -!- danhunsaker [sid145261@openvpn/corp/danhunsaker] has joined #openvpn 19:32 -!- mode/#openvpn [+o danhunsaker] by ChanServ 20:04 < w9qbj> Using OPENVPN on a Raspiberr Pi, the vpn net is 10.8.0.x /24 I'd like to change it to a 172.16.x.y/24 net. I've changed server.conf, i can connect, but nothing gets passed through. What am I missing?? 20:12 <@ecrist> we need more info 22:42 <@krzee> w9qbj: probably firewall or routing 22:43 <@krzee> impossible to know with such little info tho 23:22 -!- ShadniX_ is now known as ShadniX --- Day changed Fri Jan 06 2017 02:41 -!- Netsplit *.net <-> *.split quits: @mattock, @krzee, @plaisthos, @danhunsaker, @syzzer, @Guest44814, +RBecker 02:46 -!- Netsplit over, joins: @danhunsaker, @mattock, @Guest44814, @syzzer, @krzee, @plaisthos, +RBecker 02:47 -!- deetwelv- is now known as deetwelve 03:05 -!- Tenhi_ is now known as Tenhi 04:53 < para000> anyone here? 05:00 < Joners> not a clue, im trying to find someone to talk to re AS but no reply on that channel either 05:01 < para000> what chanel? 05:26 < egrain> i have a windows client connecting and even though he has openssl 1.0.2j installed it says: peer info: IV_SSL=OpenSSL_1.0.2i__22_Sep_2016 05:26 < egrain> reinstalled everything multiple times. no changes. 05:26 < egrain> help please. 05:26 < wget> Hello everyone. EVen if I'm an Arch Linux user, I maintain the OpenVPN package on Chocolatey for Windows. Since 2.4., I'm experiencing a weird issue on Windows. While I know the services have completely changed, this is not working correctly on my side. 05:26 < wget> The interactive service is started (obviously) and OpenVpnService (new new service) is started as well (auto start). However, the GUI does not connect automatically to my VPN configuration. 05:27 < wget> The latter is located in C:\Users\USER\OpenVPN\config 05:27 < wget> And the "Silent connection" checkbox is checked in the OpenVPN GUI 05:27 < para000> do you have the lates version of OpenVPN client? 05:28 < para000> if yes i had a problem with that, and i need to go into settings and specifie the config folder path 05:28 < wget> Yes, this is the 2.4.0 I have, like specified :) 05:29 < egrain> my windows client and server are also 2.4. IV_VER=2.4.0 05:29 < wget> And the server I have is also 2.4 :) 05:30 < egrain> oh, wait, my server is on linux. 05:30 < egrain> anyway, who were you answering? i don't want to meddle between things. 05:31 < para000> wget: like i said i had a problem, i need to go in settings to specified the path. 05:31 < wget> egrain: I was answering to you. 05:31 < wget> My server is on linux. My client is a Windows 7 Ultimate. 05:31 < egrain> yeah, same here. 05:31 < egrain> okay. 05:31 < egrain> i'll pass it on. 05:31 < egrain> thanks a bunch. 05:31 < wget> para000: if you didn't specify the path and you asked to connect, was the client connecting? 05:32 < para000> wget: and for auto connect i usely use a .py script 05:32 < wget> para000: Hum. Ok. So it's a "normal" behavior to have no auto connection? 05:32 < wget> We had auto connection before with the 2.3 branch. 05:33 < wget> If we cannot ensure to have an auto connection with the 2.4 branch, I cannot push 2.4 to chocolatey until this problem is fixed. 05:33 < wget> (chocolatey is mainly used by tech savvies and companies) 05:33 < para000> i find it easy with .py script, didn`t try the openVPN one 05:34 < para000> as with .py i can preselect to autoconnect to what config i want 05:34 < para000> wget: wait for someone more experienced to come online 05:35 < wget> para000: could you share your Python script and specify in which location you put the file to be run automatically by Windows? 05:35 < wget> para000: ok will wait. 05:35 < para000> yes wget 05:35 < para000> let me find it fast 05:35 <@plaisthos> egrain: openvpn ships with its own openssl version 05:36 < wget> In the meantime I'm gonna update the Windows client VM I have to see if it fixes the issue (it shouldn't, but in doubt). 05:36 < wget> Since chocolatey requires perfect Powershell 2.0 compatibility I couldn't update the VM. 05:36 <@plaisthos> wget: there is a openvpn adminstrator user group iirc that specifies which users are allowed to have user configs 05:36 < egrain> plaisthos: so linux and windows client have different openssl versions? what are saying here. 05:36 <@plaisthos> egrain: linux distributions ship a openssl version, openvpn uses that 05:37 <@plaisthos> windows does not, so openvpn ships its own 05:37 < egrain> oh, i'm just being told exactly that. let me see what he did. 05:37 < para000> subprocess.Popen(['openvpn-gui', '--connect', 'client1.ovpn']) # start and connect vpn 05:37 < para000> wget: you need just this one line 05:37 <@plaisthos> wget: user configs don't start automatically iirc 05:38 <@plaisthos> the new non-interactive service starts them 05:38 <@plaisthos> but I am no windows expert 05:38 < egrain> oh, he copied the j version over the ones in the /bin folder. 05:38 < egrain> now it works. 05:38 < egrain> thanks. 05:38 < para000> plaisthos: do you have a minute 05:39 < wget> plaisthos: if I'm reading the openvpn for win32 documentation correcly, since the service OpenVPNServiceInteractive is launched by default to allow unprivileged users to start OpenVPN connections using OpenVPN GUI without any extra configuration 05:39 < wget> and in my use case, the user I'm connected to belongs to the Admin group. 05:40 <@plaisthos> and what error are you getting? 05:40 <@plaisthos> para000: 05:40 <@plaisthos> !ask 05:40 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc, or (#2) See also, How to ask questions the smart way here: http://catb.org/~esr/faqs/smart-questions.html, or (#3) if you had asked your question this might be an answer instead of a message from the bot about how to ask questions on IRC :) 05:41 < wget> plaisthos: I don't have any error stricly speaking, just that my configuration *is not loaded automatically* 05:41 < para000> k, i managed to configure the openvpn almost perfectly, but i can`t rout the clients to other external IPs 05:41 < para000> only for the main IP of the server 05:42 < para000> any idee how to do it? 05:42 <@plaisthos> wget: loaded automatically as in autostarted or does not show up on the tray icon 05:42 < para000> all my IPs are added to the server 05:42 < para000> cause i can ping all of them 05:42 <@plaisthos> para000: 05:43 <@plaisthos> !nat 05:43 <@plaisthos> bah 05:43 <@plaisthos> !factoids 05:43 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !openvznat !winnat and !fbsdnat for specific howto 05:43 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php 05:43 < wget> plaisthos: autostarted. the vpn does becomes actives (checked with ipconfig and route print) 05:43 < wget> *doesn't 05:43 < wget> *become 05:43 <@plaisthos> wget: I think interactive service does not do autostart 05:43 <@plaisthos> !ipforward 05:43 <@vpnHelper> "ipforward" is (#1) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall, or (#2) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward 05:44 < wget> plaisthos: Yep, ineteractive doesn't do anything related to starting connections, it just allows users to lanch connections without being administrator. 05:44 < wget> plaisthos: However when OpenVpnServer is started automatically it *SHOULD* take the default OpenVPN configuration and start it 05:45 < para000> plaisthos: do i need to create a subnet for every client and rout that one ? 05:45 <@plaisthos> !iroute 05:45 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd 05:45 <@plaisthos> if you want a subnet behind each client 05:46 <@plaisthos> otherwise I don't really understand what you are trying 05:47 < para000> plaisthos: ifconfig-push 10.8.0.201 255.255.255.0 this is my ccd file for client one 05:47 < para000> client one is getting the ip 10.8.0.201 05:48 < para000> now how do i forword this specific IP to a specific external IP 05:48 < para000> cause i tried verious methods 05:48 < para000> nothing vorked 05:48 < para000> worked* 05:48 <@plaisthos> I understand what "Oh nooo, CHECK_INCDEC_PARAM seeems to behave differently on X7 than X9, not good :s 05:48 <@plaisthos> argh 05:49 <@plaisthos> wrong copy&paste 05:49 <@plaisthos> I don't understand i forword this specific IP to a specific external IP 05:49 <@plaisthos> what are you trying to achieve? 05:50 < para000> i have 10 external IPs 05:50 < para000> i want client1 to connect to nr1 external ip 05:50 < para000> client2 to nr2 externl ip 05:50 < para000> and so on 05:50 <@plaisthos> either nat 05:50 < para000> so i crated a ccd directory 05:50 <@plaisthos> or give out that ips to the clients and configure routing accordingly 05:51 < para000> and gived every client an subnet ip 10.8.0.xxx 05:51 < para000> but now in nat how can i redirect only 1 ip form subnet not the entire subnet? 05:52 <@plaisthos> !iptables 05:52 <@vpnHelper> "iptables" is (#1) To test if netfilter ("iptables rules") are your problem, disable all rules with an ACCEPT policy. See https://github.com/QueuingKoala/netfilter-samples/tree/master/reset-rules for a script to do this., or (#2) See also the manpage section on firewalls at this link: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbBG, or (#3) These are just the basics to get you 05:52 <@vpnHelper> started as firewall design is beyond this channel's scope; you can also see #netfilter 05:52 <@plaisthos> !notovpn 05:53 <@vpnHelper> "notovpn" is (#1) "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem, or (#2) sorry, but we dont care. this channel is only for help with openvpn. 05:53 <@plaisthos> I know that iptables can do that but I never done that and have no idea how to do that 05:54 <@plaisthos> I would need to read iptables documentation myself 05:54 <@plaisthos> I would give the real ips to the clients and fix the routing 05:54 < para000> k. thx for your help 05:54 < para000> problem with real ip to client is that is not connecting 05:54 < para000> if for exempla i want to connect with external IP 2 05:55 < para000> i don`t get a connection 05:55 <@plaisthos> wget: I have no idea OpenVPNService is looking for the configs to start. I would assume C:\program files\openvpn\something 05:55 < para000> but if i try to ping that external IP 2 is working 05:56 < para000> do i need to put any command in server.conf to listen on all IPs? 05:56 < wget> Ok. I narrowed the issue. The config to be auto started still needs to be in C:\Program Files\OpenVPN\config. User configs are not started automatically. 05:56 < wget> Now the connection is started automatically, it isn't showing up in the OpenVPN-GUI. 05:56 <@plaisthos> that is expected 05:56 <@plaisthos> iirc 05:57 < wget> expected to not show in the OpenVPN GUI? 05:58 <@plaisthos> the ui shows only the connection for current user iirc 06:05 < davidgiluk> Greetings 06:07 < davidgiluk> a few minutes after I connect with OpenVPN I find the TCP connections I made hang; I kill the things using them (mutt/hexchat) and restart those and then it's fine and carries on fine all day 06:07 < davidgiluk> This is on openvpn 2.3.14 on fedora 25 over a UDP tunnel; this didn't used to happen until ~1.5 months ago, and I don't think my colleagues on the same ovpn servers are seeing it; any suggestions on where to look? 06:13 <@plaisthos> i would run tcpdump on the tun and the eth interface writing in a file and look at the pcap with wireshark 06:13 <@plaisthos> if openvpn client/server logs are not telling you anything 06:18 < davidgiluk> plaisthos: So I did that on the tun interface and on a remote host and https://paste.fedoraproject.org/520754/48370453/ is a summary 06:19 -!- Guest44814 is now known as dazo 06:19 < davidgiluk> plaisthos: If I was tcpdump'ing the ether interface what would I be looking for given the stream is encrypted, note that the VPN doesn't drop - it's just the tcp connections over the VPN that hang 07:19 < para000> plaisthos: still here? 07:24 <@plaisthos> para000: yes 09:19 <@krzee> lol 09:33 <@krzee> davidgiluk: you can tcpdump the tun interface and its not encrypted 09:35 < davidgiluk> krzee: Right, I did that (together with tcpdumping a remote server I had a telnet connection to at the same time) which is what I summarised https://paste.fedoraproject.org/520754/48370453/ 09:37 < davidgiluk> krzee: at some point the destination host stops receiving anything from me, but I see a dup ack that I dont knoe where it came from 09:53 < para000> krzee: every time i search the internet on the client machine my ping to www.google.com on that machine for the time of the search jumps to 2000+ from 160 for 5 seconds or so till the search ended? 10:24 < PugaBear> so if I want to use obfsproxy ( https://community.openvpn.net/openvpn/wiki/TrafficObfuscation ) do I need to make my openvpn server use TCP instead of UDP? since obfs uses TCP... Ive tried obfs before but I could never get it to connect, and I remember that changing the TCP/UDP settings in the client config (.ovpn) gave me some progress 10:24 <@vpnHelper> Title: TrafficObfuscation – OpenVPN Community (at community.openvpn.net) 10:25 < para000> how do i incress speed of my client ? 11:13 < iheartlinux> if I monitor a local tun via wireshark, should I see a ping directed to it's address? 11:21 <@dazo> iheartlinux: a tun/tap interface carries normal IP packets aimed at hosts/applications sending traffic via the VPN ... OpenVPN reads the tun/tap traffic, encrypts it, sends it to the remote host via a UDP/TCP connection, the remote OpenVPN process decrypts it, and writes these packets to its local tun/tap interface ... and vice versa 12:26 < diamerir> hello how do i view my openvpn profile and also connection log? 12:27 < diamerir> is any one eh here? then please tell me 12:29 < diamerir> i just did openvpn --config file ? 12:29 < diamerir> so? 13:06 < PugaBear> Im getting this error when I try to run OpenVPN (server side) http://paste.bn-mc.net/voqac (even as root) 13:06 < PugaBear> er sorry 13:06 < PugaBear> when I try to run obfsproxy 13:07 < PugaBear> I tried changing the permissions of that file but same error.. 14:19 < diamerir> heij 14:19 < diamerir> my vpn is leaking 14:19 < diamerir> hwo do i stopo it which option to use in arch linux? 14:19 < diamerir> i tried --block-dns-leak but that doesn't work 14:20 < diamerir> why is it given when it is just for windows ? 14:20 < diamerir> ecrist: danhunsaker mattock ? 14:28 < diamerir> please for god's sake 14:28 < diamerir> do it for god's sake atleast 14:28 < DArqueBishop> !patience 14:29 < DArqueBishop> Oh. 14:29 < DArqueBishop> !whining 14:29 <@vpnHelper> "whining" is < MacGyver> If somebody reads your question, and knows the answer, he'll answer it when and how he feels like it. This is IRC, not your company's paid tech support desk. Whining doesn't do any good except annoy the people who could help you. 14:30 < diamerir> please 14:31 < diamerir> DArqueBishop: can you tell now 14:31 < diamerir> time is one thing that is running out of my hands 14:32 < DArqueBishop> I don't actually know, else I would have answered. 14:33 < DArqueBishop> Like the factoid pointed out, you need to have patience. This is not paid technical support. 14:34 < DArqueBishop> Those who do know are probably doing other things that they're actually being paid to do. 14:42 < para000> diamerir: still here? 14:42 < para000> push "block-outside-dns" 14:42 < para000> did you tired this> 14:42 < para000> ? 14:49 <@dazo> diamerir: --block-dns-leak is a Windows only feature ... for Linux, you need to use additional tools to configure and reset DNS settings up on connect/disconnect 14:50 <@dazo> para000: it is absolutely wonderful that you want to help out here! We highly appreciate that ... but please don't try to guess solutions, that will more often just confuse users 14:51 <@dazo> !blockdns 14:51 <@vpnHelper> "blockdns" is (#1) --block-outside-dns is a Windows only option and there are no plans to add this for any other platforms. The reason is that it modifies the Windows Firewall on-the-fly, or (#2) You can achieve a similar functionality by using --up and --down (or using the down-root plugin) to manipulate the firewalls to deny DNS requests outside the VPN tunnel when it is running 14:51 <@dazo> !pushdns 14:51 <@vpnHelper> "pushdns" is (#1) push dhcp-option DNS a.b.c.d to push dns to the client, or (#2) For pushing DNS to a Windows client, see: !windns, or (#3) Unix-alikes are required to process the env-var in an --up script; read about --dhcp-option in the manpage, or (#4) For distros that use resolvconf(8) you can try the pull-resolv-conf script under the contrib/ source dir, or (#5) Mobile Client like OpenVPN for 14:51 <@vpnHelper> Android and OpenVPN Connect will happily accept push dhcp-option 14:51 <@dazo> diamerir: ^^^ look at !blockdns and !pushdns 14:54 * dazo calls it a week 14:55 <@ecrist> diamerir: why are you pinging everyone in the channel? 14:56 < diamerir> come okn guys 14:56 < diamerir> i try to draw maximum attention 15:26 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn 15:26 -!- mode/#openvpn [+v s7r] by ChanServ 15:35 < w9qbj> !pivpn 15:35 < w9qbj> !dns 15:35 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6], or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4, or (#3) you might be looking for !pushdns 15:36 < w9qbj> !raspberry 15:36 < w9qbj> !pi 15:40 < para000> !windns 15:40 <@vpnHelper> "windns" is (#1) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns, or (#2) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit, or (#3) http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7 19:32 < blipsblops> hello due to the release of openvpn2.4 for windows i'm now using tap-windows NDIS6 (prior to that i always used the I00x versions rather than I60x), this new tap interface causes performance problems here (win7). For instance when listening to some radio stream i'm not able to surf anymore, downloads slow to a trickle, packets are dropped, latency is very high pings 3500ms+ etc... Any known 19:32 < blipsblops> issue/fix related to this? 19:33 < blipsblops> also using the old "tap-windows 9.9.2" with openvpn2.4 fixes the problem, performance as usual. I know i could just install this tap interface separately but isn't the default openvpn package supposed to work out of the box? 19:39 < blipsblops> could some combination of parameters to "optimize" windows's tcp/ip stack be the cause for such behavior? 20:58 -!- F2Knight is now known as F2Knight[away] 21:11 < _vyscond> Hello guys 22:39 <@ecrist> hola 22:59 < ordex> hola hola ! 22:59 < ordex> :] 23:54 -!- ShadniX_ is now known as ShadniX --- Day changed Sat Jan 07 2017 03:12 < echosystm> hi guys 03:13 < echosystm> my vpn shuts down once every 24 or so and i have to restart the service 03:13 < echosystm> whats the best way to make that happen automatically? 04:56 -!- syzzer [~syzzer@openvpn/community/developer/syzzer] has quit [Ping timeout: 256 seconds] 05:19 -!- syzzer [~syzzer@openvpn/community/developer/syzzer] has joined #openvpn 05:19 -!- mode/#openvpn [+o syzzer] by ChanServ 11:03 < Ducky^> hi all, I have an openvpn server with a /16 subnet 11:04 < Ducky^> I was wondering if there is a way to allow certain ranges client to client access, i.e. 10.8.1.0/24 can ssh to 10.8.0.0/24 IPs but not vice versa 11:04 < Ducky^> I've been messing with firewalls but can't seem to find the right info 11:05 < Ducky^> if I enable masquerading on the default zone then I get client to client on all IPs, but I don't think that's the right method 11:05 < Ducky^> I'm using centos and firewalld 11:08 < Ducky^> alternatively, if there is another method of doing this, say only allowing client to client via key names or something 11:10 <@krzee> Ducky^: dont use the config option client-to-client 11:10 <@krzee> !c2c 11:10 <@vpnHelper> "c2c" is "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access things behind 11:10 <@vpnHelper> other clients 11:11 <@krzee> and yes with proper firewall rules you can do that 11:12 <@krzee> ##netfilter can go into depth with those rules once you have addressing right in openvpn, do you already have that setup? 11:12 < Ducky^> oh dear, I didn't realise that option avoided the firewall 11:12 < Ducky^> addressing is set up, I'm able to set certain keys to 10.8.1 and 10.8.0 with ipp.txt 11:13 < Ducky^> presumably that's all that's needed 11:14 < Ducky^> oh, no client-to-client was disabled 11:14 < Ducky^> so it wasn't affecting me 11:14 < julius> hi 11:14 < julius> got a problem with ccd, the ccd file is just ignored... here is my config: https://bpaste.net/show/3ed9981e5c11 11:14 < julius> any idea whats wrong? 11:15 < Ducky^> I'll ask netfilter, thanks krzee 11:15 <@krzee> !ipp 11:15 <@vpnHelper> "ipp" is (#1) the option --ifconfig-pool-persist ipp.txt does NOT create static ips, or (#2) Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, see !iporder and !static 11:16 < Ducky^> !iporder 11:16 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice)., or (#2) Use --client-config-dir file for static IP (next choice) !static for more info, or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice), or (#4) if you use --ifconfig-pool-persist see !ipp 11:16 < Ducky^> !static 11:16 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client, or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0, or (#3) also see !ccd and !iporder, or (#4) with static IPs, limit your --ifconfig-pool to exclude the static range, or (#5) See also: !addressing 11:17 <@krzee> julius: verb 4 please 11:18 <@krzee> !client-connect 11:18 <@vpnHelper> "client-connect" is --client-connect