Friends-- My first post here. Production environment Have been working with this about 2 1/2 weeks, 2-3 hours per night, all day on weekends, and finally got remote to be able to access files on server. Some work is getting done! Server ("earth") OS: Ubuntu 12.04.2 Client ("samba1") OS: Lubuntu 12.04.2 Local printer #1: 192.168.0.5 Local printer #2: 192.168.0.10 Local file server, serving Samba shares: 192.168.0.201 Local vnc server: 192.168.0.111 (this is WinXP, and the only Win box) 4 other Ubuntu boxes locally remote is 192.168.1.6 in its local network remote is behind a router server and all local computers are behind a router a ddns is used Intent: get remote computer to be able to print to local printers, and to access the vnc server. In addition, let the local computers see the file locks placed by remote machine (I suspect this is the same issue as the printing and vnc). server.conf: [code] port 1194 proto udp dev tun ca /etc/openvpn/ca.crt cert /etc/openvpn/earth.crt key /etc/openvpn/earth.key # This file should be kept secret dh /etc/openvpn/dh1024.pem server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "route 192.168.0.0 255.255.255.0" client-to-client keepalive 10 120 comp-lzo max-clients 1 persist-key persist-tun status openvpn-status.log verb 3 [/code] client.conf: [code]client dev tun proto udp remote [blanked].no-ip.org 1194 resolv-retry infinite nobind persist-key persist-tun ca /etc/openvpn/ca.crt cert /etc/openvpn/samba1.crt key /etc/openvpn/samba1.key remote-cert-tls server comp-lzo verb 3 [/code] ifconfig server:[code] eth0 Link encap:Ethernet HWaddr [blanked] inet addr:192.168.0.201 Bcast:192.168.0.255 Mask:255.255.255.0 inet6 addr: fe80::213:20ff:fe80:83ad/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:23420190 errors:0 dropped:0 overruns:0 frame:0 TX packets:17003747 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:2559473491 (2.5 GB) TX bytes:1906572766 (1.9 GB) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:1414 errors:0 dropped:0 overruns:0 frame:0 TX packets:1414 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:87738 (87.7 KB) TX bytes:87738 (87.7 KB) tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 inet addr:10.8.0.1 P-t-P:10.8.0.2 Mask:255.255.255.255 UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1 RX packets:16311 errors:0 dropped:0 overruns:0 frame:0 TX packets:14893 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:3100129 (3.1 MB) TX bytes:6867717 (6.8 MB)[/code] route server: [code]Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface default 192.168.0.1 0.0.0.0 UG 100 0 0 eth0 10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0 10.8.0.2 * 255.255.255.255 UH 0 0 0 tun0 localnet * 255.255.255.0 U 0 0 0 eth0[/code] ifconfig client (eth0 is a dead onboard card):[code] eth0 Link encap:Ethernet HWaddr [blanked] UP BROADCAST MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:0 (0.0 B) TX bytes:0 (0.0 B) Interrupt:17 Base address:0x2000 eth1 Link encap:Ethernet HWaddr [blanked] inet addr:192.168.1.6 Bcast:192.168.1.255 Mask:255.255.255.0 inet6 addr: fe80::204:75ff:fece:6f98/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:32052 errors:0 dropped:0 overruns:39 frame:0 TX packets:14760 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:10785294 (10.7 MB) TX bytes:2656008 (2.6 MB) Interrupt:22 Base address:0x2400 lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:450 errors:0 dropped:0 overruns:0 frame:0 TX packets:450 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:43469 (43.4 KB) TX bytes:43469 (43.4 KB) tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 inet addr:10.8.0.6 P-t-P:10.8.0.5 Mask:255.255.255.255 UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1 RX packets:8569 errors:0 dropped:0 overruns:0 frame:0 TX packets:8629 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:3844799 (3.8 MB) TX bytes:1444815 (1.4 MB)[/code] route client: [code]Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface default 192.168.1.1 0.0.0.0 UG 0 0 0 eth1 10.8.0.0 10.8.0.5 255.255.255.0 UG 0 0 0 tun0 10.8.0.5 * 255.255.255.255 UH 0 0 0 tun0 192.168.0.0 10.8.0.5 255.255.255.0 UG 0 0 0 tun0 192.168.1.0 * 255.255.255.0 U 1 0 0 eth1[/code] Friends, I am a real newbie around openvpn, and don't grasp yet all the nuances and meanings of bridging and nat and push, and the like, so please bear with me as I ask questions! My last couple of attempts to make this work were the client-to-client and push lines in the server.conf. If it is a clue, when I try to uncomment the user and group nobody lines, connection fails. 10.8.0.1 and 10.8.0.6 are able to ping each other. Other local computers cannot ping remote, nor can remote ping them. remote can ping 192.168.0.5 and 192.168.0.10 (the printers)(this does not make sense to me, if it cannot print to them). So can you help me realize my intent? Thanks! :- Doug.

hi there, [quote]I am guessing this means local client at 192.168.0.7 for instance should be able to see remote at 192.168.1.6/10.8.0.6, yes? But that is not happening: 192.168.0.7 cannot ping either of those addresses. Nor can remote ping 192.168.0.7. Is there a log for ssh to troubleshoot this?[/quote] using the term "clients" i mean openvpn clients, f.e you have 2 clients connected with ips 10.8.0.10 & 10.8.0.14 when client-to-client is enabled one client can see each other... local pcs (the ones inside openvpn servers lan) are not "clients" also your client is visible from your lan with 10.8.0.6 ip ONLY... to access its lan you need to create lan-to-lan connectivity.. (extra directives needed) [quote]Have I pushed all that needs to be pushed here? Does 10.8.0.0/24 need to be pushed, too?[/quote] when you use the server directive , openvpn creates the necessary routes to the client by itself, no need to push route 10.8.0.0 255.255.255.0 about routing stuff... for your internal lan pcs to access a unknown network (thats 10.8.0.0/24 for them) they use by default their default gateway and send packets destined for the vpn network to their default gateway,with that in mind you can: 1) setup a static route on your default gateway for the openvpn subnet or 2) set the openvpn server (lan ip) as the default gateway for the devices you want to be accessible from openvpn clients (your printer servers) the tracert that works is a good sign :) when i say printing protocol i dont mean cups...cups is not a protocol..ipp,lpd,smb are protocols i believe you are using lpd for printing... are you print servers have any other service (web config,ssh) to check their connectivity from openvpn client? yeap i believe you are close... Michael.

maikcat-- Not sure how to tell what protocol my printers are using. The address for both in the system-config-printer dialog starts with dnssd://, and both are using hplip. (Am having some problems with my hp p2035n driver, but my brother dcp-8085 is working well.) In one case I use an address that goes through smb://192.168.0.111/p2035n. Couldn't find anything on Google to help me figure out what protocol I am using. I can access administration for these printers in the local domain via 127.0.0.1:631, if that gives you any clue. [quote]f.e you have 2 clients connected with ips 10.8.0.10 & 10.8.0.14 when client-to-client is enabled one client can see each other...[/quote] OK, then since I only allow one client, I should remove the client to client line, yes? [quote]local pcs (the ones inside openvpn servers lan) are not "clients"[/quote] Thank you for helping me learn this important vocabulary, Michael! [quote]also your client is visible from your lan with 10.8.0.6 ip ONLY... to access its lan you need to create lan-to-lan connectivity.. (extra directives needed)[/quote] Well, it seems to me this is at least part of what I need. Do you agree, Michael? What are those directives, please? [quote]1) setup a static route on your default gateway for the openvpn subnet or 2) set the openvpn server (lan ip) as the default gateway for the devices you want to be accessible from openvpn clients (your printer servers)[/quote] I'm guessing this is the kind of directives you mean, maikcat. 2. seems to be more limited, so I am not sure that is what I want. Do you agree that all three problems I have (file locks, vnc connectivity, printing) are probably related? If so, then it might be harder to choose which devices control those, while a static route for everything makes our troubleshooting less difficult. Am I understanding this correctly? [quote]are you print servers have any other service (web config,ssh) to check their connectivity from openvpn client?[/quote] Just the cups Web interface, but I see nothing there which helps me diagnose connectivity. ssh connections are refused. [quote]yeap i believe you are close...[/quote] Wonderful! So what should I try?

hi there, [quote]In one case I use an address that goes through smb://192.168.0.111/p2035n.[/quote] the [b]smb[/b] is what you need, this tells me that you are printing via samba share...from its name i assume it has a jetdirect lan card what is its default gateway? [quote]OK, then since I only allow one client, I should remove the client to client line, yes?[/quote] if only one client will connect , then yes its safe to comment out client-to-client if you want your client (and NOT pcs that in the same LAN with your client) to be able to access things then its not necessary... 2 directives needed but i dont want to confuse you further.. [quote]while a static route for everything makes our troubleshooting less difficult. Am I understanding this correctly?[/quote] adding a static route to each local pc yes it would make troubleshooting easier but its more easier to setup to your lan pcs the openvpn server as their default gateway... CUPS interface by default only listens to loopback address ,did you setup CUPS to allow connections from the lan to its web management port? (631) please create a detailed diagram about: OS used network topology if ping from openvpn client to printers work ,then your problem is NOT ip connectivity... regards, Michael.

[quote]Thank you for helping me, maikcat![/quote] you welcome :mrgreen: [quote]I will do some Googling tomorrow and see if I can figure out what a default gateway is[/quote] default gateway is usually the ip address of lans router... why i have the feeling that you dont know much about networking.... ;) [quote]The printer is physically cabled to a usb port on this pc. This same printer (hp p2035n) also has an ethernet connection to the lan at 192.168.0.5. I print to it both ways.[/quote] :shock: if your printer has buildin Lan,why on earth are you using its usb port????? [quote]Diagram: Local PCs (Ubuntu & WinXP, 192.168.0.0/24) --> Local server (Ubuntu, 192.168.0.201) --> Router (192.168.0.1) --> Internet --> Router (192.168.1.1) --> Client (192.168.1.6/10.8.0.6) Is that what you wanted? (I need to Google what topology means, probably?)[/quote] the above diagram is sufficient... [quote]Again, my first concern is to get file locks working.[/quote] stupid question...what file locks are? [quote]I plan to work on this somewhat intensively tomorrow, so if you can give me some more clues, that would be wonderful, Michael. I have been googling some key terms you have used in your posts, and learning (and confusing myself).[/quote] try to first learn about tcp/ip basic stuff & networking concepts THEN jump into vpn's concepts.. ;) [quote]I am curious why the printer connection is so crucial to connecting these two lans together?[/quote] its not crucial,but if you have one thing to work f.e vnc all the others will work too... i admire your courage using linux though... :) regards, Michael.

allow remote client to print vnc to local computers

dgermann

Friends--

My first post here.

Production environment

Have been working with this about 2 1/2 weeks, 2-3 hours per night, all day on weekends, and finally got remote to be able to access files on server. Some work is getting done!

Server ("earth") OS: Ubuntu 12.04.2
Client ("samba1") OS: Lubuntu 12.04.2
Local printer #1: 192.168.0.5
Local printer #2: 192.168.0.10
Local file server, serving Samba shares: 192.168.0.201
Local vnc server: 192.168.0.111 (this is WinXP, and the only Win box)
4 other Ubuntu boxes locally
remote is 192.168.1.6 in its local network
remote is behind a router
server and all local computers are behind a router
a ddns is used

Intent: get remote computer to be able to print to local printers, and to access the vnc server. In addition, let the local computers see the file locks placed by remote machine (I suspect this is the same issue as the printing and vnc).

server.conf:

    port 1194
    proto udp
    dev tun
    ca /etc/openvpn/ca.crt
    cert /etc/openvpn/earth.crt
    key /etc/openvpn/earth.key  # This file should be kept secret
    dh /etc/openvpn/dh1024.pem
    server 10.8.0.0 255.255.255.0
    ifconfig-pool-persist ipp.txt
    push "route 192.168.0.0 255.255.255.0"
    client-to-client
    keepalive 10 120
    comp-lzo
    max-clients 1
    persist-key
    persist-tun
    status openvpn-status.log
    verb 3

client.conf:

client
dev tun
proto udp
remote [blanked].no-ip.org 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/samba1.crt
key /etc/openvpn/samba1.key
remote-cert-tls server
comp-lzo
verb 3

ifconfig server:

eth0      Link encap:Ethernet  HWaddr [blanked]
          inet addr:192.168.0.201  Bcast:192.168.0.255  Mask:255.255.255.0
          inet6 addr: fe80::213:20ff:fe80:83ad/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:23420190 errors:0 dropped:0 overruns:0 frame:0
          TX packets:17003747 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:2559473491 (2.5 GB)  TX bytes:1906572766 (1.9 GB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:1414 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1414 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:87738 (87.7 KB)  TX bytes:87738 (87.7 KB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:16311 errors:0 dropped:0 overruns:0 frame:0
          TX packets:14893 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:3100129 (3.1 MB)  TX bytes:6867717 (6.8 MB)

route server:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.0.1     0.0.0.0         UG    100    0        0 eth0
10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
10.8.0.2        *               255.255.255.255 UH    0      0        0 tun0
localnet        *               255.255.255.0   U     0      0        0 eth0

ifconfig client (eth0 is a dead onboard card):

eth0      Link encap:Ethernet  HWaddr [blanked]  
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
          Interrupt:17 Base address:0x2000 

eth1      Link encap:Ethernet  HWaddr [blanked]
          inet addr:192.168.1.6  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::204:75ff:fece:6f98/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:32052 errors:0 dropped:0 overruns:39 frame:0
          TX packets:14760 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:10785294 (10.7 MB)  TX bytes:2656008 (2.6 MB)
          Interrupt:22 Base address:0x2400 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:450 errors:0 dropped:0 overruns:0 frame:0
          TX packets:450 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:43469 (43.4 KB)  TX bytes:43469 (43.4 KB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.6  P-t-P:10.8.0.5  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:8569 errors:0 dropped:0 overruns:0 frame:0
          TX packets:8629 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:3844799 (3.8 MB)  TX bytes:1444815 (1.4 MB)

route client:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.1.1     0.0.0.0         UG    0      0        0 eth1
10.8.0.0        10.8.0.5        255.255.255.0   UG    0      0        0 tun0
10.8.0.5        *               255.255.255.255 UH    0      0        0 tun0
192.168.0.0     10.8.0.5        255.255.255.0   UG    0      0        0 tun0
192.168.1.0     *               255.255.255.0   U     1      0        0 eth1

Friends, I am a real newbie around openvpn, and don't grasp yet all the nuances and meanings of bridging and nat and push, and the like, so please bear with me as I ask questions!

My last couple of attempts to make this work were the client-to-client and push lines in the server.conf. If it is a clue, when I try to uncomment the user and group nobody lines, connection fails.

10.8.0.1 and 10.8.0.6 are able to ping each other. Other local computers cannot ping remote, nor can remote ping them. remote can ping 192.168.0.5 and 192.168.0.10 (the printers)(this does not make sense to me, if it cannot print to them).

So can you help me realize my intent?

Thanks!

:- Doug.

maikcat

hi there,

for start your configs look ok.. 🙂

My last couple of attempts to make this work were the client-to-client

client-to-client enables the communication between 2 clients..

and push lines in the server.conf.

yes you need to push to your clients your local network..

10.8.0.1 and 10.8.0.6 are able to ping each other. Other local computers cannot ping remote, nor can remote ping them.

are those local pc have a static route for 10.8.0.0/24 network pointing to your
openvpn servers lan ip?

remote can ping 192.168.0.5 and 192.168.0.10 (the printers)(this does not make sense to me, if it cannot print to them).

if you can ping them from your openvpn client then you have ip connectivity...

which protocol you are using for printing?

Michael.

dgermann

Michael--

Thanks for replying so quickly! Thanks for confirming no major issues in the configs! That is really a relief to me.

client-to-client enables the communication between 2 clients..

I am guessing this means local client at 192.168.0.7 for instance should be able to see remote at 192.168.1.6/10.8.0.6, yes? But that is not happening: 192.168.0.7 cannot ping either of those addresses. Nor can remote ping 192.168.0.7. Is there a log for ssh to troubleshoot this?

yes you need to push to your clients your local network..

Have I pushed all that needs to be pushed here? Does 10.8.0.0/24 need to be pushed, too?

are those local pc have a static route for 10.8.0.0/24 network pointing to your openvpn servers lan ip?

Ahh, you have touched the weak place where I do not understand fully your question. Let me take a couple of guesses:

1. I have not set up the remote computer to have a static 10.8.0.0/24 ipaddress. I have set it up with a static one in its own /etc/hosts for 192.168.0.6. If I need to set it up with a static 10.8.0.6, would I do it in /etc/hosts too?

2. Ahh, you said local PCs! Only 192.168.0.201 (the file server/openvpn server/samba server), and 192.168.0.111 (the vnc server, and in some cases it acts as a print server) as well as the printers have static ipaddresses. What specifically must I do and in what file to accomplish this pointing, please?

3. The /etc/hosts file on the other linux boxes locally all have a line 192.168.0.201 earth. Is this enough?

if you can ping them from your openvpn client then you have ip connectivity...

Well, I guess I do:

doug@samba1:~$ traceroute 192.168.0.5
traceroute to 192.168.0.5 (192.168.0.5), 30 hops max, 60 byte packets
 1  10.8.0.1 (10.8.0.1)  25.427 ms  32.319 ms  32.305 ms
 2  192.168.0.5 (192.168.0.5)  32.183 ms  32.067 ms  31.881 ms
doug@samba1:~$ traceroute 192.168.0.10
traceroute to 192.168.0.10 (192.168.0.10), 30 hops max, 60 byte packets
 1  10.8.0.1 (10.8.0.1)  26.302 ms  26.200 ms  26.014 ms
 2  192.168.0.10 (192.168.0.10)  24.024 ms  23.861 ms  23.685 ms

This tells me it is going through the openvpn server 10.8.0.1.

which protocol you are using for printing?

Cups; appears to be version 1.5.3-0ubuntu6 on my desktop, not sure how to tell on the remote, since I only have ssh connectivity to remote. (I ssh to the server and from there ssh to the remote, using 10.8.0.6).

Michael, you give me hope by pointing out that the printer connectivity is at least partially there. I suspect you are telling me we are very close! Thanks!

:- Doug.

dgermann

Further info:

Just ran

lp -d dcp8085dn test.txt

and there is an entry in /var/log/cups/error_log that reads:

E [13/Feb/2013:20:51:23 -0500] [Job 15] The printer is not responding.
E [13/Feb/2013:20:52:43 -0500] [Job 14] Aborting job because it has no files.
E [13/Feb/2013:20:52:56 -0500] [Job 15] The printer is not responding.
E [13/Feb/2013:20:54:29 -0500] [Job 15] The printer is not responding.

Clues for us?

:- Doug.

dgermann

Oh, job 15 was the one is just sent using the lp command. I suspect 14 was the one sent yesterday by the remote user.

:- Doug.

maikcat

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

dgermann

maikcat--

Not sure how to tell what protocol my printers are using. The address for both in the system-config-printer dialog starts with dnssd://, and both are using hplip. (Am having some problems with my hp p2035n driver, but my brother dcp-8085 is working well.) In one case I use an address that goes through smb://192.168.0.111/p2035n.

Couldn't find anything on Google to help me figure out what protocol I am using. I can access administration for these printers in the local domain via 127.0.0.1:631, if that gives you any clue.

f.e you have 2 clients connected with ips 10.8.0.10 & 10.8.0.14
when client-to-client is enabled one client can see each other...

OK, then since I only allow one client, I should remove the client to client line, yes?

local pcs (the ones inside openvpn servers lan) are not "clients"

Thank you for helping me learn this important vocabulary, Michael!

also your client is visible from your lan with 10.8.0.6 ip ONLY...
to access its lan you need to create lan-to-lan connectivity.. (extra directives needed)

Well, it seems to me this is at least part of what I need. Do you agree, Michael? What are those directives, please?

1) setup a static route on your default gateway for the openvpn subnet
or
2) set the openvpn server (lan ip) as the default gateway for the devices you want to be accessible
from openvpn clients (your printer servers)

I'm guessing this is the kind of directives you mean, maikcat. 2. seems to be more limited, so I am not sure that is what I want. Do you agree that all three problems I have (file locks, vnc connectivity, printing) are probably related? If so, then it might be harder to choose which devices control those, while a static route for everything makes our troubleshooting less difficult. Am I understanding this correctly?

are you print servers have any other service (web config,ssh) to check their connectivity from openvpn client?

Just the cups Web interface, but I see nothing there which helps me diagnose connectivity. ssh connections are refused.

yeap i believe you are close...

Wonderful! So what should I try?

maikcat

hi there,

In one case I use an address that goes through smb://192.168.0.111/p2035n.

the smb is what you need,
this tells me that you are printing via samba share...from its name i assume it has a jetdirect lan card
what is its default gateway?

OK, then since I only allow one client, I should remove the client to client line, yes?

if only one client will connect , then yes its safe to comment out client-to-client

if you want your client (and NOT pcs that in the same LAN with your client) to be able
to access things then its not necessary...
2 directives needed but i dont want to confuse you further..

while a static route for everything makes our troubleshooting less difficult. Am I understanding this correctly?

adding a static route to each local pc yes it would make troubleshooting easier but its more
easier to setup to your lan pcs the openvpn server as their default gateway...

CUPS interface by default only listens to loopback address ,did you setup CUPS to allow connections
from the lan to its web management port? (631)

please create a detailed diagram about:

OS used
network topology

if ping from openvpn client to printers work ,then your problem is NOT ip connectivity...

regards,

Michael.

dgermann

maikcat--

Thank you for helping me, maikcat!

this tells me that you are printing via samba share...from its name i assume it has a jetdirect lan card
what is its default gateway?

I don't know how to tell. I will do some Googling tomorrow and see if I can figure out what a default gateway is. There is no hp card in the pc at 192.168.0.111 as far as I can remember. It is a computer about 6 years old. The printer is physically cabled to a usb port on this pc.

This same printer (hp p2035n) also has an ethernet connection to the lan at 192.168.0.5. I print to it both ways.

The other printer is strictly accessed through its ethernet cable.

I am curious why the printer connection is so crucial to connecting these two lans together?

OK, then tomorrow I will comment out client-to-client.

I don't know how to set up a default gateway. (That's probably obvious since I don't know what a default gateway is!) Is that one of the two directives you mention?

The OS used by the server and two or three other local PCs is Ubuntu 12.04.2. One local pc (192.168.0.111) is WinXP. The openvpn client is Lubuntu 12.04.2.

Diagram:

Local PCs (Ubuntu & WinXP, 192.168.0.0/24)
--> Local server (Ubuntu, 192.168.0.201)
--> Router (192.168.0.1)
--> Internet
--> Router (192.168.1.1)
--> Client (192.168.1.6/10.8.0.6)

Is that what you wanted? (I need to Google what topology means, probably?)

I plan to work on this somewhat intensively tomorrow, so if you can give me some more clues, that would be wonderful, Michael. I have been googling some key terms you have used in your posts, and learning (and confusing myself).

Again, my first concern is to get file locks working. Then the VNC. Least important at this point is the printing, because someone local can always do the printing for the person at the remote location, if it is only a document or two. Printing is not a big thing this person does. (If that makes a difference to what you would prescribe, Michael!)

Thanks for your help. It feels like you have a life preserver you are thowing to me, and I am in the sea, floundering!

:- Doug.

maikcat

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

dgermann

Michael--

Thanks for educating me!

The question for me is not so much what is a default gateway but how to set one up? Is it merely a setting in /etc/hosts? Some other file? Is that all I need to make this work, Michael?

i admire your courage using linux though...

I have been using Linux for about 10 years and am pretty comfortable with most of the things I need to do on a daily basis. Networking within my lan has been no big task, at least once I figured out samba when I was just getting started. But when it comes to iptables and routing, I know pretty much nothing at all!

default gateway is usually the ip address of lans router...

Oh! I thought it had a special meaning for openvpn purposes! The local is 192.168.0.1, and the remote is 192.168.1.1.

if your printer has buildin Lan,why on earth are you using its usb port?????

Simple: when I first installed it, one computer we used a lot was Win95, and it could not print to an ipaddress. Over the years we have left it as it was since it was working. I only plugged in its ethernet cable about 2 months ago because of a printer problem.

what file locks are?

We do a lot of word processing using LibreOffice. There are many common files. For instance there is George's to do list, which is kept in george.odt. Susan might add something to be done, and George might mark off that he has completed a different task. No problem if they edit the file one after the other. But if they are both in the file at the same time, whoever saves last has his or her text preserved--and the other's is lost.

A project could get lost. Worse, changes made to documents going to the outside world might not get saved and the outside parties get the wrong document.

File locks say to the computers: George is editing this file, so you cannot open it, or you can open it only read only. This keeps the file edits safe and sequential.

When we are all on the same lan, the system (I think it is part of LibreOffice, although I suspect Samba has some effect, too) creates a small file that is named something like ".~lock.george.odt#". That way all the computers on the lan see the lock and respect it.

This works internally for us. When I open a file the other internal computers see this lock file. The files show up to the server that way. And even the remote computer can see these. Unfortunately, the locks created by remote cannot be seen by the local computers.

I suspect that, as you say, if we solve one problem we may solve them all, then working on the vnc connectivity or the file locks will give us the printing, too.

So my main question is, how do I get the internal computers to see the remote? What specific lines or directives do i need to add to what files?

Can you give me these directives, Michael?

Thanks!

:- Doug.

dgermann

Michael--

Here is my progress report from today:

I followed: http://openvpn.net/index.php/open-source/documentation/howto.html#scope
https://forums.openvpn.net/topic11355.html
http://nikinuryadin.wordpress.com/2010/04/16/step-by-step-setting-up-openvpn-in-debian-with-routing-tun-connection/

sudo nano server.conf:
client-config-dir /etc/openvpn/ccd
route 192.168.1.0 255.255.255.0
sudo mkdir ccd
sudo nano ccd/samba1: iroute 192.168.1.0 255.255.255.0
sudo sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1
(so this appears to me to be already set up correctly)
netstat -i (appears correct for promiscuous mode because both eth0 and tun0 have M in the flg col)

before restart server can ping 10.8.0.6, and remote can ping both 10.8.0.1 and 192.168.0.201 (both are the same server), but not 192.168.0.7 nor .111; 192.168.0.7 cannot ping 10.8.0.6, but can .1

on local router, added advanced routing > 192.168.1.0 255.255.255.0 to 192.168.0.201 >enabled > saved

sudo /etc/init.d/networking restart
sudo service openvpn restart

Now: remote can ping server either way, but still not 192.168.0.7 nor 111, but can ping .5 and .10
192.168.0.7 can ping 10.8.0.1 and .6 and remote by name
192.168.0.7 can traceroute to 192.168.1.6 and remote by name

route on server now looks a little different:

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.0.1     0.0.0.0         UG    100    0        0 eth0
10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
10.8.0.2        *               255.255.255.255 UH    0      0        0 tun0
localnet        *               255.255.255.0   U     0      0        0 eth0
192.168.1.0     10.8.0.2        255.255.255.0   UG    0      0        0 tun0

route on client gives:

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.1.1     0.0.0.0         UG    0      0        0 eth1
10.8.0.0        10.8.0.5        255.255.255.0   UG    0      0        0 tun0
10.8.0.5        *               255.255.255.255 UH    0      0        0 tun0
192.168.0.0     10.8.0.5        255.255.255.0   UG    0      0        0 tun0
192.168.1.0     *               255.255.255.0   U     1      0        0 eth1

Michael, it looks like I have discovered some of the directives you mean and we are getting closer. I have not yet been able to see if file locks or vnc are working from the remote side.

Do those gateways 10.8.0 on the client and server need to be the same? If so, how do I make that happen?

What am I missing? What is my next step, Michael?

Thanks for your help, Michael!

maikcat

hello again,

this caught my attention..

but not 192.168.0.7 nor .111; 192.168.0.7 cannot ping 10.8.0.6, but can .1

192.168.0.7 device can ping 10.8.0.1 but not 10.8.0.6?
if yes routing is ok...

does 10.8.0.6 has any firewall enabled on it?

also to check that your ccd file is correct also add to it

ifconfig-push 10.8.0.22 10.8.0.21

restart your client, check if he's tun ip is 10.8.0.22,
if it is ,then ccd is parsed correctly if not..we talk again 🙂

regards
Michael.

dgermann

maikcat--

You are wonderful! Thank you for all your help!

Lots of progress to report:

The first of my hopes has been met: we now have file locking both ways. 😃 VNC is still not working, nor is printing.

Here's what I did and the results of some tests:

1. I added the line you said to the ccd file. Restarted openvpn on both server and client (are both restarts necessary?). Remote's route and ifconfig results are:

default         192.168.1.1     0.0.0.0         UG    0      0        0 eth1
10.8.0.0        10.8.0.21       255.255.255.0   UG    0      0        0 tun0
10.8.0.21       *               255.255.255.255 UH    0      0        0 tun0
192.168.0.0     10.8.0.21       255.255.255.0   UG    0      0        0 tun0
192.168.1.0     *               255.255.255.0   U     1      0        0 eth1

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.22  P-t-P:10.8.0.21  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:8149 errors:0 dropped:0 overruns:0 frame:0
          TX packets:8711 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:1784315 (1.7 MB)  TX bytes:2119160 (2.1 MB)

Do these look good to you Michael?

How did you choose the 10.8.0.21 and 10.8.0.22 addresses?

2. This command from remote just sits there without visible response:

rdesktop 192.168.0.111

sudo less /var/log/syslog |grep rdesktop and |grep 192.168.0.111 each produce no results.

This is the connection I most want to make now. Any ideas, Michael?

3. Using putty, 192.168.0.111 (a winxp box) can ssh into 192.168.1.6, the remote computer. But it can neither ssh nor ping 10.8.0.22. Remote cannot ssh into the winxp box, nor ping it, even if the firewall on the winxp is disabled.

4. Remote can ping these successfully:
192.168.0.5 (printer1)
192.168.0.10 (printer2)
192.168.0.201 (server)
10.8.0.1 (server)

5. Remote cannot ping these:
192.168.0.111 (winxp, vnc server)
192.168.0.7 (ubuntu desktop)

6. 192.168.0.7 (local ubuntu desktop) can ping these addresses for remote successfully:
(BTW, this box is the only of the the linux machines which has a firewall enabled; it is set to allow 1194/tcp from 192.168.0.0/24)
remote by name
192.168.1.6

7. 192.168.0.7 cannot ping these, also addresses of remote:
10.8.0.6
10.8.0.21
10.8.0.22

8. Server can ping these addresses for remote successfully:
10.8.0.22
192.168.1.6

9. Server cannot ping these addresses of remote:
10.8.0.6
10.8.0.21

10. Server's route and ifconfig are now showing as:

default         192.168.0.1     0.0.0.0         UG    100    0        0 eth0
10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
10.8.0.2        *               255.255.255.255 UH    0      0        0 tun0
localnet        *               255.255.255.0   U     0      0        0 eth0
192.168.1.0     10.8.0.2        255.255.255.0   UG    0      0        0 tun0

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:9150 errors:0 dropped:0 overruns:0 frame:0
          TX packets:8825 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:2165167 (2.1 MB)  TX bytes:1836411 (1.8 MB)

192.168.0.7 device can ping 10.8.0.1 but not 10.8.0.6?
if yes routing is ok...

192.168.0.7 can currently ping 10.8.0.1, but not 10.8.0.22, yes. So this seems like it passes your test. <grin>

So my big question now is how to get connectivity from remote 192.168.1.6/10.8.0.22 to the vnc connection at 192.168.0.111?

Michael, thank you for all your help!

maikcat

Do these look good to you Michael?

your client got .22 ip which means ccd file parsed correctly.. 🙂

How did you choose the 10.8.0.21 and 10.8.0.22 addresses?

read below..

Each pair of ifconfig-push addresses represent the virtual client and server IP endpoints. They must be taken from successive /30 subnets in order to be compatible with Windows clients and the TAP-Win32 driver. Specifically, the last octet in the IP address of each endpoint pair must be taken from this set:

[ 1, 2] [ 5, 6] [ 9, 10] [ 13, 14] [ 17, 18]
[ 21, 22] [ 25, 26] [ 29, 30] [ 33, 34] [ 37, 38]
[ 41, 42] [ 45, 46] [ 49, 50] [ 53, 54] [ 57, 58]
[ 61, 62] [ 65, 66] [ 69, 70] [ 73, 74] [ 77, 78]
[ 81, 82] [ 85, 86] [ 89, 90] [ 93, 94] [ 97, 98]
[101,102] [105,106] [109,110] [113,114] [117,118]
[121,122] [125,126] [129,130] [133,134] [137,138]
[141,142] [145,146] [149,150] [153,154] [157,158]
[161,162] [165,166] [169,170] [173,174] [177,178]
[181,182] [185,186] [189,190] [193,194] [197,198]
[201,202] [205,206] [209,210] [213,214] [217,218]
[221,222] [225,226] [229,230] [233,234] [237,238]
[241,242] [245,246] [249,250] [253,254]

can you disable for testing ANY FIREWALL running on affected desktops?

if you do a traceroute to 0.111 from your openvpn client what do see?

3. Using putty, 192.168.0.111 (a winxp box) can ssh into 192.168.1.6, the remote computer. But it can neither ssh nor ping 10.8.0.22. Remote cannot ssh into the winxp box, nor ping it, even if the firewall on the winxp is disabled.

can you set to the xp (0.111) the default gateway to be the openvpn servers lan ip?
please post the output of

netstat -nr
on your xp box..
btw trying to ssh to the xp box is meaningless.. (xp does not have ssh server :? )

generally check if any antivirus software also blocks/filters network traffic...

Michael.

dgermann

Michael--

Thank you very much for sticking with me through this long project!

Thank you for your tutorial on ifconfig-push addresses!

generally check if any antivirus software also blocks/filters network traffic...

On the WinXP box I have ClamWin, and its FAQs says it does not include an on-access scanner. Also use Clam to run some virus scans via crontab on all computers, so for the same reason I suspect that is not blocking anything. Windows built in virus protection is turned off.

if you do a traceroute to 0.111 from your openvpn client what do see?

C:\>tracert 192.168.1.6

Tracing route to 192.168.1.6 over a maximum of 30 hops

  1    <1 ms    <1 ms    <1 ms  192.168.0.1
  2    <1 ms    <1 ms    <1 ms  192.168.0.201
  3    19 ms    23 ms    19 ms  192.168.1.6

Trace complete.

C:\>tracert 10.8.0.22

Tracing route to 10.8.0.22 over a maximum of 30 hops

  1    <1 ms    <1 ms    <1 ms  192.168.0.1
  2     *        *        *     Request timed out.
  3     *        *        *     Request timed out.
  4     *        *        *     Request timed out.
  5     *        *        *     Request timed out.
  6     *        *        *     Request timed out.
  7     *        *        *     Request timed out.
  8     *        *        *     Request timed out.
  9     *        *        *     Request timed out.
 10     *        *        *     Request timed out.
 11     *        *        *     Request timed out.
 12     *        *        *     Request timed out.
 13     *        *        *     Request timed out.
 14     *        *        *     Request timed out.
 15     *        *        *     Request timed out.
 16     *        *        *     Request timed out.
 17     *        *        *     Request timed out.
 18     *        *        *     Request timed out.
 19     *        *        *     Request timed out.
 20     *        *        *     Request timed out.
 21     *        *        *     Request timed out.
 22     *        *        *     Request timed out.
 23     *        *        *     Request timed out.
 24     *        *        *     Request timed out.
 25     *        *        *     Request timed out.
 26     *        *        *     Request timed out.
 27     *        *        *     Request timed out.
 28     *        *        *     Request timed out.
 29     *        *        *     Request timed out.
 30     *        *        *     Request timed out.

Trace complete.

please post the output of

netstat -nr
on your xp box..

C:\>netstat -nr

Route Table
===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...00 11 11 c7 c4 b8 ...... Intel(R) PRO/100 VE Network Connection - Packet
Scheduler Miniport
===========================================================================
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.0.1   192.168.0.111       20
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1       1
      192.168.0.0    255.255.255.0    192.168.0.111   192.168.0.111       20
    192.168.0.111  255.255.255.255        127.0.0.1       127.0.0.1       20
    192.168.0.255  255.255.255.255    192.168.0.111   192.168.0.111       20
        224.0.0.0        240.0.0.0    192.168.0.111   192.168.0.111       20
  255.255.255.255  255.255.255.255    192.168.0.111   192.168.0.111       1
Default Gateway:       192.168.0.1
===========================================================================
Persistent Routes:
  None

C:\>

can you set to the xp (0.111) the default gateway to be the openvpn servers lan ip?

I'm not entirely sure what to do or where, Michael. I have done this:
On the XP box, I went to control panel > network connections > local area connection properties > Internet Protocol (TCP/IP) Properties >advanced TCP/IP Settings > Default gateways where I found 192.168.0.1 (the local router) Automatic was set. I added 192.168.0.201 (the local server/openvpn server) automatic.

Is this the right place? Should I have deleted the other (0.1)?

After this, 0.111 can ping 192.168.1.6, but not 10.8.0.22. Remote cannot ping 192.168.0.111. The server can ping 0.111. And this:

C:\>netstat -nr

Route Table
===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...00 11 11 c7 c4 b8 ...... Intel(R) PRO/100 VE Network Connection - Packe
Scheduler Miniport
===========================================================================
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.0.1   192.168.0.111       20
          0.0.0.0          0.0.0.0    192.168.0.201   192.168.0.111       20
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1       1
      192.168.0.0    255.255.255.0    192.168.0.111   192.168.0.111       20
    192.168.0.111  255.255.255.255        127.0.0.1       127.0.0.1       20
    192.168.0.255  255.255.255.255    192.168.0.111   192.168.0.111       20
        224.0.0.0        240.0.0.0    192.168.0.111   192.168.0.111       20
  255.255.255.255  255.255.255.255    192.168.0.111   192.168.0.111       1
Default Gateway:       192.168.0.1
===========================================================================
Persistent Routes:
  None

C:\>

And this from remote:

~$ traceroute 192.168.0.111
traceroute to 192.168.0.111 (192.168.0.111), 30 hops max, 60 byte packets
 1  10.8.0.1 (10.8.0.1)  34.096 ms  33.978 ms  33.771 ms
 2  * * *
 3  * * *
 4  * * *
 5  * * *
 6  * * *
 7  * * *
 8  * * *
 9  * * *
10  * * *
11  * * *
12  * * *
13  * * *
14  * * *
15  * * *
16  * * *
17  * * *
18  * * *
19  * * *
20  * * *
21  * * *
22  * * *
23  * * *
24  * * *
25  * * *
26  * * *
27  * * *
28  * * *
29  * * *
30  * * *

So it is getting as far as the server 10.8.0.1, but somehow it does not know how to jump from there to 192.168.x.x. Yes?

I also tried removing the 192.168.0.1 default gateway on the XP box, and now the traceroute from remote shows:

~$ traceroute 192.168.0.111
traceroute to 192.168.0.111 (192.168.0.111), 30 hops max, 60 byte packets
 1  10.8.0.1 (10.8.0.1)  32.727 ms  32.754 ms  32.622 ms
 2  192.168.0.111 (192.168.0.111)  31.914 ms  31.801 ms  31.715 ms

XP can still connect to the Internet with IE. XP can also ping 10.8.0.22 and 192.168.0.6 (both addresses of remote)! Turned XP firewall back on and these pings and tracerts still work.

Now remote is able to get into the rdesktop! Woo Hoo! Great! Thank you, Michael!

Printing however is not working yet. From remote, printing to 0.10 gives a not connected error, and printing to 0.111 gives us "http error: status 1000." Remote cannot traceroute to 192.168.0.111; but with the xp firewall off it can traceroute there, in just two hops.

The XP firewall has settings for File and Printer Sharing and also for Printer. There is also an "Advanced" tab here. Are any of those what I want? Oh, so close!

What next, O guru?

maikcat

hello again...

On the WinXP box I have ClamWin

clamwin :shock:

treat clamwin as you do NOT have any antivirus protection at all.... :?

from your tracert output,

please also add to your internet router a static route for 10.8.0.0/24 network pointing to your openvpn server lan ip.

XP can still connect to the Internet with IE. XP can also ping 10.8.0.22 and 192.168.0.6 (both addresses of remote)! Turned XP firewall back on and these pings and tracerts still work.

Now remote is able to get into the rdesktop!

now you talking right.... 🙂

From remote, printing to 0.10 gives a not connected error, and printing to 0.111 gives us "http error: status 1000." Remote cannot traceroute to 192.168.0.111; but with the xp firewall off it can traceroute there, in just two hops.

http error 1000 ,i dont know this error what is about...
i assume that network connectivity is enough for printing services to work,and your cups doesnt need further configuration...

regards,

Michael.

dgermann

Michael--

Many, many thanks!

please also add to your internet router a static route for 10.8.0.0/24 network pointing to your openvpn server lan ip.

OK, I went to advanced routing and set up destination 10.8.0.0 (it would not accept "/24" at the end of it), 255.255.255.0, default gateway 192.168.0.201, enabled and saved. Do those sound like the way you meant? Or do I have it backwards?

I already had a route there for 10.8.0.1 with a default gateway of 192.168.0.201....

I googled the printing error message and found a couple of bug reports under RedHat (I'm in Ubuntu) from 2010. While I was checking, the printer at 192.168.0.10 printed what remote had sent 14 hours ago! A little slow 😉 , but there is some connectivity. On remote, I get:

~$ lpstat -a
dcp8085dn accepting requests since Tue 19 Feb 2013 07:46:40 AM EST
p2035n accepting requests since Sat 09 Feb 2013 03:48:17 PM EST
PDF accepting requests since Thu 24 Jan 2013 11:41:29 PM EST

The bug reports are here: https://bugzilla.redhat.com/show_bug.cgi?id=587744 and here: https://bugzilla.redhat.com/show_bug.cgi?id=583054; there are also a couple ideas here I want to try tonight: http://ubuntuforums.org/showthread.php?t=1420559.

So Michael, what virus checker do you use on your linux and winxp boxes? (The XP does not have email). (Hope you don't mind an off-topic question.)

Thanks, Michael.

dgermann

Michael--

We have not tested fully, but it looks like we have printing working now, with your last suggestions! Thank you very, very much!

So my next question is (should I start a new thread or stay in this one? It would be easier to stay here, so I don't have to post all the info all over and you don't have to read it all over!) How should I go about strenghthening security on this set-up? Or is it already of the best security?

Thanks, Michael!

maikcat

good to know that things worked out for you....🙂

first the off topic questions...

So Michael, what virus checker do you use on your linux and winxp boxes? (The XP does not have email). (Hope you don't mind an off-topic question.)

consider the lack of online scanner of clamwin the biggest issue,because you will get infected and you will not
get the slightest warning...

better safe than sorry 🙂

from my personal expirience for windows great antivirus/antimalware software among others are:

trend micro's suite
malware bytes antimalware
kaspersky labs suite

for linux (as workstation) the only expirience i have (yeap no expirience...) is that my corporate laptop uses symantec... :ugeek:

to the other questions now..

How should I go about strenghthening security on this set-up? Or is it already of the best security?

security is NEVER enough......

some additions to your setup ,yes can be made

f.e

use AES cipher

cipher AES-256-CBC

use SHA512

auth SHA512

use tls-auth (dont remember if you used this one though)
use larger keys (>2048 bit)

the sha512 needs openvpn 2.1.1 and above to work....
also add to your server config

tls-cipher DHE-RSA-AES256-SHA

regards,

Michael.