I have gotten myself a little lost, I only wish to access resources on the ubuntu server that openvpn server is installed on, I have only installed openssh and openvpn, I did not install the bridge utilities. All of the searches I've done come back with results for accessing the local lan. I would like to keep the install as simple as possible to access just the server. I have a connection to the server using the default pool with the ios app and the ios app log shows the server config push route option of the server local lan. The server routing table shows the local lan on eth1 and the default pool on tun but I cannot get a response from the ssh server when using an ssh client user@192.168.23.59, the ssh client does connect when the iphone is on the 192.168.23.0 subnet and not connected to the vpn. ios config; [code]client resolv-retry 20 keepalive 10 60 nobind mute-replay-warnings ns-cert-type server comp-lzo verb 1 persist-key persist-tun explicit-exit-notify 1 dev tun proto udp port 1194 cipher AES-128-CBC cert iphonetest.crt key iphonetest.key ca ca.crt remote ************ 1194 [/code] ios log; [code]2014-12-14 22:26:30 VERIFY OK: depth=0 cert. version : 3 serial number : 01 issuer name : C=US, OU=test3, CN=test, ??=test2 subject name : C=US, O=test4, OU=test3, CN=1204desk32, ??=test2 issued on : 2014-12-14 21:42:44 expires on : 2024-12-11 21:42:44 signed using : RSA with SHA1 RSA key size : 1024 bits basic constraints : CA=false cert. type : SSL Server key usage : Digital Signature, Key Encipherment ext key usage : TLS Web Server Authentication 2014-12-14 22:26:31 SSL Handshake: TLSv1.0/TLS-DHE-RSA-WITH-AES-256-CBC-SHA 2014-12-14 22:26:31 Session is ACTIVE 2014-12-14 22:26:31 EVENT: GET_CONFIG 2014-12-14 22:26:31 Sending PUSH_REQUEST to server... 2014-12-14 22:26:31 OPTIONS: 0 [route] [192.168.23.0] [255.255.255.0] 1 [route] [10.8.0.1] 2 [topology] [net30] 3 [ping] [10] 4 [ping-restart] [120] 5 [ifconfig] [10.8.0.6] [10.8.0.5][/code] Thanks.

please post your server configs/logs. also are you trying to test while in the SAME network? Michael.

Thanks for responding. I see my subject isn't quite right, it should be asking the simplest config to access tcp resources on the server, for example, ssh and apache, with the same lan address, 192.168.53.59, from the lan, and from the wan through openvpn, without having to add a route to the server lan gateway even though a port forward is required on the server lan gateway. I understand a route is required on the gateway in order for lan nodes other than the server to respond to the vpn client but that's not necessary in this case. I will not have access to the test server for at least a day, but after reviewing the server.conf example on the openvpn site, I was using the Ubuntu manual instructions, I believe that I failed to enable the ethernet bridging even though I enabled the push route as can be seen in my ios log. The only changes I made from the default server.conf is to add the keys and the push route. In answer to your question my tests were done connecting from the wan by turning off the wifi on the iphone. I have to attempt to enable this on the production server tonight before I can get back to the test server, hopefully enabling the ethernet bridging in server.conf is the key to this.

If I'm correct, then this server.conf should accomplish the goal. [code] port 1194 proto udp dev tun ca ca.crt cert 1204desk32.crt key 1204desk32.key dh dh1024.pem server 10.8.0.0 255.255.255.0 server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100 push "route 192.168.23.0 255.255.255.0" keepalive 10 120 comp-lzo max-clients 2 persist-key persist-tun status openvpn-status.log verb 3[/code]

first avoid bridging , it will complicate things + needs a very DIFFERENT config file. to keep it simple use server x.x.x.x 255.255.255.0 directive where x.x.x.x use a private network range, after that enable ip forwarding on server and keep the push directive inside your server config. thats all. Michael.

[quote="fast2"]Code: server 10.8.0.0 255.255.255.0 server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100 [/quote]You [u]cannot[/u] specify --server [b]and [/b]--server-bridge .. remove --server-bridge.

Does this look right? From both your posts, the following should give me access to https type resources on the openvpn server. ios config; [code]client resolv-retry 20 keepalive 10 60 nobind mute-replay-warnings ns-cert-type server comp-lzo verb 1 persist-key persist-tun explicit-exit-notify 1 dev tun proto udp port 1194 cipher AES-128-CBC cert iphonetest.crt key iphonetest.key ca ca.crt remote ************ 1194 [/code] server.conf; [code] port 1194 proto udp dev tun ca ca.crt cert 1204desk32.crt key 1204desk32.key dh dh1024.pem server 10.8.0.0 255.255.255.0 push "route 192.168.23.0 255.255.255.0" keepalive 10 120 comp-lzo max-clients 2 persist-key persist-tun status openvpn-status.log verb 3[/code] and lastly, this; http://openvpn.net/index.php/open-source/faq/77-server/265-how-do-i-enable-ip-forwarding.html

[quote="fast2"]Does this look right?[/quote]Looks good. [quote="fast2"]the following should give me access to https type resources [b]on the openvpn server[/b][/quote]Yes. You will require more steps to access other resources on the server LAN, either by routing or NAT. These HOWTOs will help: [list][*][url=http://openvpn.net/index.php/open-source/documentation/howto.html#scope]HOWTO: Expanding the scope of the VPN to include additional machines[/url] [*][url=http://openvpn.net/index.php/open-source/documentation/howto.html#redirect]HOWTO: Routing all client traffic (including web-traffic) through the VPN[/url][/list]

Still wouldn't access resources on the vpn server but I found an inconsistency error in the syslog because the server default is blowfish and the ios client config I was using as posted above specified AES, so I enabled AES on the server and that allowed connection without having to use itunes to reload an edited client config. So the only difference form the above configs is to add, enable: cipher AES-128-CBC Thank you.

Well spotted: blowfish-CBC is the openvpn default.

Here's another one for the noodle, I ran the setup on the production server and it did not require changing the ip_forward file value to 1, I have full access to resources on that server and the ip_forward file is still at 0.

What is the simplest config to access the openvpn server?

fast2

I titled my thread with what I wanted. I wanted access to the openvpn server, I didn't ask for access to the lan the openvpn server resides on.

Then, a couple of days later, after my request for help was finally moderated and went public I posted the info I had available, I did not have server logs available and again clarified what my need was, access to resources on the openvpn server.

I also stated in answer to your question, "In answer to your question my tests were done connecting from the wan by turning off the wifi on the iphone."

Then a couple of days after waiting for moderation again, I posted a client config, a server config and the link to the page about ip forwarding and asked if that would do it, Traffic said "Looks good."

Well that didn't work.

I figured out there was a cipher conflict and was done. I had what I needed, my problem was solved.

@Traffic was in fact helpful to me, even if he didn't read the configs I posted and see the cipher issue, he also apparently didn't realize that ip forwarding was not necessary when access to the lan that openvpn server resides on is not needed.

I came back after I solved my needs and followed up by stating the cipher was incorrect and that ip forwarding was unnecessary, I didn't have to do that, but I took the time to follow up because I felt I should give something back.

I believe you, @maikcat, didn't make the effort to actually read my posts, I think you skimmed them because you feel that you know this so well that you don't have to, so your advice didn't apply to what I asked for, you created problems and frustration by not understanding what I was asking for, but it didn't matter because I was already done, with a working config that worked as I asked for, you even stated that my config couldn't work when in fact it was working because you couldn't be bothered to understand what I asked for.

**********

So, my requests for help were delayed for almost a week for moderation.
Advice was not given that applied to the request for help.
Advice was incorrect for the request for help.
When I solved my problem and followed up by stating how it worked I was told I was wrong and it couldn't work.

I don't feel this forum is helpful and therefore I question the reason for its existence.
I do feel that @Traffic made an effort to be helpful.
I feel that you, @maikcat, are arrogant, condescending and not helpful and no matter what I say or demonstrate to you, you will never give consideration to that opinion.
I assume that you're the big fish here and therefore you act accordingly.

This is how I feel based on my experience here. I don't know what more I can say.

Thank you @traffic.

@maikcat, well, enjoy your sandbox.

maikcat

I titled my thread with what I wanted

thats true

I didn't ask for access to the lan the openvpn server resides on.

do you really insist on that?
your previous post says different...but maybe my english are not too good.

Then, a couple of days later, after my request for help was finally moderated

perhaps you dont know that there are a few mods here (who can approve posts)
and also they are volunteers,they DO have full time job , family etc.
also they happen to be to different continents too,so a time gap between YOUR post
and MY approval is expected , after all its an OPEN forum

I figured out there was a cipher conflict and was done. I had what I needed, my problem was solved.

Good for you , without posting full logs and configs no one will ever noticed this misconfig.

@Traffic was in fact helpful to me

thats nice for you to say considering your last 4 posts , everyone here was garbage...

I came back after I solved my needs and followed up by stating the cipher was incorrect and that ip forwarding was unnecessary, I didn't have to do that, but I took the time to follow up because I felt I should give something back.

now you talking right chief....

that is why i am here also, i dont have to do moderation or helping others (like you)
or at least trying to (also you can search for the closed threads and check those i
helped someone to solve their problem and i dare you to quote on me if i am "arrogant"
as you claim, or you think i am paid? did you pay to post?)
i simply do help people because i believe i have a good knowledge of openvpn and i can give something
back to the community like other mods here, so i feel we are in the same side here.

I believe you, @maikcat, didn't make the effort to actually read my posts, I think you skimmed them because you feel that you know this so well that you don't have to

you are right about the skimming part , i admited it , shoot me.

I don't feel this forum is helpful and therefore I question the reason for its existence.

thats your opinion , tell this to others who solved their problem.
you are free to never again post openvpn problems here and try to find solution yourself,

i want to ask however, are you generally using opensource based software?

I feel that you, @maikcat, are arrogant, condescending and not helpful and no matter what I say or demonstrate to you, you will never give consideration to that opinion.

i am arrogant because i asked your configs (forum rules remember?) and suggested
you avoid bridging (you also mentioned that you didnt installed bridge-utils)
also i asked about the existence of NAT and dared to say my opinion about ip forwarding,

did you EVER wondered in my 4 years of posts what configs/setups i have witnessed?
usually people doesnt say everything about THEIR setup and i must ask this ask that
to get the picture,if by this i am arrogant..then so be it.

I assume that you're the big fish here and therefore you act accordingly.

big fish? yea with 10K a month i am the "big" fish here.

@maikcat, well, enjoy your sandbox.

sandbox? come on, are we in 2nd grade?

at least i sign my posts with my name...

Michael.

maikcat

one more thing...

to see how much "arrogant" i am i suggest to the forum owners to promote you to moderator

so you get the chance to hear users nagging about their delayed approvals of their posts etc etc.

i also wait response from you if you are generally using open source based software.

Have a nice day.

Michael.

fast2

maikcat wrote i also wait response from you if you are generally using open source based software.

Michael.

Predominately, yes.

This openvpn install was on ubuntu with owncloud and plex, it was done because the soho router doesn't support nat redirection.

Traffic

No offense but ...

fast2 wroteI titled my thread with what I wanted

The Title:

What is the simplest config to access the openvpn server?

Answer:

Client config:

remote x.x.x.x
dev tun
ifconfig 10.8.0.2 10.8.0.1

fast2

Traffic wrote Client config:

remote x.x.x.x
dev tun
ifconfig 10.8.0.2 10.8.0.1

Will that config 'access' the openvpn server or 'connect to' the openvpn server?

Traffic

fast2 wroteWill that config 'access' the openvpn server or 'connect to' the openvpn server?

It is the answer to the question in your post title ...

fast2

Traffic wrote
fast2 wroteWill that config 'access' the openvpn server or 'connect to' the openvpn server?
It is the answer to the question in your post title ...

Well, the post title had a condition against simpliest config, and I don't think your definition of access matches up with the rest of the world's.

In the end, you simply make it more and more clear that you're not really interested in helping, I don't know if you guys are bitter, you're just trolls, who knows, but in the end it still goes back to my basic statements that were ignored when @maikcat was cherry picking and editing my statements for his replies.

So, my requests for help were delayed for almost a week for moderation.
Advice was not given that applied to the request for help.
Advice was incorrect for the request for help.
When I solved my problem and followed up by stating how it worked I was told I was wrong and it couldn't work.

The way I see it, is one participates to help, jerking users around can only serve to bolster your ego, and there is a whole world of stuff out there you could spend your life on other than trolling forums.

Traffic

fast2 wroteTraffic wrote:
fast2 wrote:
Will that config 'access' the openvpn server or 'connect to' the openvpn server?
It is the answer to the question in your post title ...

It will connect to and access resources on the server.

fast2 wroteWell, the post title had a condition against simpliest config

Condition Not specified ...

fast2 wroteIn the end, you simply make it more and more clear that you're not really interested in helping, I don't know if you guys are bitter, you're just trolls, who knows, but in the end it still goes back to my basic statements that were ignored when @maikcat was cherry picking and editing my statements for his replies.

We are not trolls .. we are here to help and we do help.
Example: https://forums.openvpn.net/topic18028.html#p48766

If your post goes off topic and you quote yourself incorrectly and you insult people who did help you ..

And you do not read the help we offer ...
https://forums.openvpn.net/topic17742.html#p47726

Then you only have yourself to blame. :mrgreen:

I am done with this thread .. for good.

fast2

Traffic wrote It will connect to and access resources on the server.

Curious.
I thought, at minimum, the client config required reference to the local certificates so the server would allow connection and access but I'm not an openvpn expert, which is why I was here looking for help...

Enjoy your sandbox.

maikcat

Will that config 'access' the openvpn server or 'connect to' the openvpn server?

Well, the post title had a condition against simpliest config, and I don't think your definition of access matches up with the rest of the world's.

I would like to inform you that openvpn is for creating ip based tunnels between 2 endpoints
and FYI has NOTHING to do with accessing resources on servers/clients,

openvpn client "connects" to openvpn server which authenticates clients if client is accepted
tunnel is up , if not then no tunnel is created simple as that.

traffic is right , the config posted IS creating a tunnel between 2 endpoints nothing more nothing less,
then if the required services are configured to respond to this virtual interface then yes you can access them
via the tunnel, so its time to discover what openvpn is designed to do and what its not.

The way I see it, is one participates to help, jerking users around can only serve to bolster your ego, and there is a whole world of stuff out there you could spend your life on other than trolling forums.

read your last 5 posts and discover who is a troll...

on the quoting stuff , i understand that quoting this:

from your FIRST post...

Quote:
I only wish to access resources on the ubuntu server that openvpn server is installed on

from your LAST post

Quote:
I cannot access addresses on the lan outside the openvpn server.

Which is all I asked for.

really upseted you , but these were YOUR words not mine, at least i admit my mistakes.

btw, why are you still here? dont you have a sandbox like we do?

Michael.

« Previous Page