guides to create openvpn server in linux?

By metro2012
in Smart Home, Network & Security

 Share

Recommended Posts

Rising Star

metro2012

Posted
  • Author
Posted

Server:


port 1194
proto udp
dev tun
ca keys/ca/ca.crt
cert keys/ca/svr.crt
key keys/ca/svr.key
dh keys/ca/dh2048.pem
server 10.10.10.0 255.255.255.0
crl-verify keys/ca/crl.pem
ifconfig-pool-persist servers/SVR/logs/ipp.txt
cipher AES-128-CBC
user root
group root
status servers/SVR/logs/openvpn-status.log
log-append servers/SVR/logs/openvpn.log
verb 2
mute 20
max-clients 200
management 127.0.0.1 5574
keepalive 10 120
client-config-dir /etc/openvpn/servers/SVR/ccd
client-to-client
comp-lzo
persist-key
persist-tun
ccd-exclusive
push "route 192.168.2.0 255.255.255.0"

Client:


client
proto udp
dev tun
ca ca.crt
dh dh2048.pem
cert nb1600clientremote.crt
key nb1600clientremote.key
remote 123.456.789.012 1194 //My remote public IP
cipher AES-128-CBC
user root
group root
verb 2
mute 20
keepalive 10 120
comp-lzo
persist-key
persist-tun
float
resolv-retry infinite
nobind

Grand Master

+BudMan MVC

Posted
  • MVC
Posted

"that the nb1600 cannot see my public ip anymore. it can see the internet because pinging google works,"

What?? That statement is just gibberish..

Do you mean ping your public IP.. Which one your home one or your work one? see means what? The nb1600 connected to your private side of your network would have no reason ever to "see" your home routers public IP? I have no idea what that statement is suppose to mean even. If you mean ping your public IP while on the private side of your router, this is not really something that is common to be able to do - that would be nat reflection or loopback forwarding, etc. not all routers support that. I don't understand what your trying to convey with that statement.

"is there a possibility of the routing tables in my router overloading and thus not allowing/understanding more connections?"

Again -- this make no sense, routing tables don't have anything to do with connections. State table maybe. Are you still talking about your home internet router or your work internet router, or the is it the nb1600 router at work? Or is that a linux box now?

Did you ever actually forward the port your using on your work internet router to the vpn server on your work network?

Whatever you think was working, I don't think it was to be honest.

As to your ftp problem, yeah if you can load your on local address, and that works on another machine then yes I would agree something wrong with the ftp server on that machine.

Rising Star

metro2012

Posted
  • Author
Posted

was away from home....

"that the nb1600 cannot see my public ip anymore. it can see the internet because pinging google works,"

What?? That statement is just gibberish..

Do you mean ping your public IP.. Which one your home one or your work one? see means what? The nb1600 connected to your private side of your network would have no reason ever to "see" your home routers public IP? I have no idea what that statement is suppose to mean even. If you mean ping your public IP while on the private side of our router, this is not really something that is common to be able to do - that would be nat reflection or loopback forwarding, etc. not all routers support that. I don't understand what your trying to convey with that statement.

from the nb1600 at my home network, it cannot ping my workplace's public ip. i can ping google (and others as well).

i restarted the router at my workplace and then the nb1600 could ping my workplace's public ip and thus restored the vpn connection.

"is there a possibility of the routing tables in my router overloading and thus not allowing/understanding more connections?"

Again -- this make no sense, routing tables don't have anything to do with connections. State table maybe. Are you still talking about your home internet router or your work internet router, or the is it the nb1600 router at work? Or is that a linux box now?

Did you ever actually forward the port your using on your work internet router to the vpn server on your work network?

the "routing tales in my router" refer to the ones in my workplaces router. i was talking about the router at my workplace.

like i mentioned, i restarted it (the router at my workplace) and it worked instantly.

and yes, the ports are forward.

we are going to try now to chain (with a switch) things of LAN2 and see if they work (they should, just commenting on it) and also see what is wrong with that ftp server.....

ill comment further things :)

thank u for all the help

Grand Master

+BudMan MVC

Posted
  • MVC
Posted

And ftp is a complicated protocol - are you using passive or active? Your router prob has a ftp helper that changes the IPs on you ;) It couldn't the internet routers, since your inside an encrypted tunnel. If you are exactly - still not convinced you have the setup actually working the way you think you do.

So your saying you can not even make a control channel connection. This is the first connection on port 21, the data connection is where active or passive come into play. And where the ftp helpers either HELP!! or cause you pain ;)

Here is how ftp works, be it active or passive

http://slacksite.com/other/ftp.html

BTW - what IPs are you giving the clients on the remote end? What is there gateway IP your giving them?

Rising Star

metro2012

Posted
  • Author
Posted

And ftp is a complicated protocol - are you using passive or active?

default on the filezilla server.

Your router prob has a ftp helper that changes the IPs on you ;)

how do i find this out/remove it/fix it/etc?

So your saying you can not even make a control channel connection. This is the first connection on port 21, the data connection is where active or passive come into play. And where the ftp helpers either HELP!! or cause you pain ;)

Here is how ftp works, be it active or passive

http://slacksite.com/other/ftp.html

no. the only thing i can do is a teamviewer lan connection and ping it. nothing else.

BTW - what IPs are you giving the clients on the remote end? What is there gateway IP your giving them?

the gateway (lan2's ip) is 172.16.3.1 ; the clients are 172.16.3.x

Grand Master

+BudMan MVC

Posted
  • MVC
Posted

Maybe your making connection via teamviwer vs the lan connection you say.

If that was the case and you were connecting via the tunnel then everything would work, at min you would make the control connection side of the ftp session.

Unless you have some firewall blocking ports somewhere in between - but seem odd that TV lan connection would work, since that uses port 5938 by default for lan connections. I just did a sniff of my box trying to connect to a lan IP on my network. And it only sent packets on 5938

post-14624-0-52314100-1341950254_thumb.j

So why would that oddball port be open, but not very common 21?

If you can not make a control port connection, but tv works - for all I know your going through the teamviewer servers to make the connection.

Are you TV to a different IP then what your trying to FTP too? Maybe this IP your trying to ftp too does not have route or default gateway so it can talk to the nb1600 router?

As to ftp being passive or active - that is the client side not the server side. Sure your server could only support 1 mode.. But you choose what mode you want via the client not the server. And this has nothing to do with a simple control connection to 21.

So if you saying you can not make this connection even - then you have a routing issue, or a firewall issue. Routing could be that the remote side does not know how to get back to you. Or could be your never getting there in the first place.

If you say you can ping the the IP that your trying to ftp to - this points to either you pinging something different than the actual device, or something blocking tcp 21, or IP your trying to hit is not even listening on 21, etc.

So you created a route on your work side internet router (192.168.100.100) for this 172.16.3.x/24 network to hit the 192.168.100.7 interface on your vpn router in the office? So I wonder why in your config for server on this page you state your only pushing route

"push "route 192.168.2.0 255.255.255.0"

So your actual VPN client the nb1600 on the remote side how would it route to 192.168.100.x/24?? You don't push the default connectivity.

push "redirect-gateway def1"

This command tells the vpn client to use the vpn connection as its default route.

Nor do you have that setup in the client config from what you posted.

So you have this remote nb1600 as a openvpn client. It gets a 10.10.10.0/24 IP as its vpn IP, and then it has a 172.16.3.0/24 network hanging off its 2nd interface. how do devices on the 172.16.3.0/24 know how to get to the 192.168.100 network at your work side? From your configs you posted I don't see how that is possible at all.

So your remote computer/device on 172.16.3.14 say, knows that its gateway is the 172.16.3.1 interface of the nb1600.. But how does the nb1600 know to route the traffic through the vpn connection? You only pushed a route to 192.168.2.0/24 -- from your configs posted I don't see the commands to tell the remote vpn client to use the vpn connection as its default route. And even if you did. As I have stated before WHY YOU NEED TO UNDERSTAND the remote network this nb1600 is sitting on is maybe its 1st (wan interface) is connected to a 192.168.100.0/24 network -- So sure it can make a connection to your openvpn server. But how its it going to route traffic for clients on its 172.16.3 network through the vpn connection to get to a 192.168.100 network when it has a interface directly connected to that network already - so its just going to route traffic out that interface.

So from your box on the work network, lets see a traceroute to this 172.16.3.x device. And then from the device you say you can TV too on the 172.16.3 network -- lets see a traceroute back to your 192.168.100.x network.

Grand Master

+BudMan MVC

Posted
  • MVC
Posted

So for example, here at work and using openvpn to my home network.

So my box here is on 10.56.41.89 - to get to box on my home 192.168.1.0/24 network it uses its vpn connection to get to the 192.168.1.0/24

Ethernet adapter ovpn:

Connection-specific DNS Suffix . : local.lan

Description . . . . . . . . . . . : TAP-Win32 Adapter V9

Physical Address. . . . . . . . . : 00-FF-79-1A-85-63

Dhcp Enabled. . . . . . . . . . . : Yes

Autoconfiguration Enabled . . . . : Yes

IP Address. . . . . . . . . . . . : 10.0.200.6

Subnet Mask . . . . . . . . . . . : 255.255.255.252

Default Gateway . . . . . . . . . :

DHCP Server . . . . . . . . . . . : 10.0.200.5

DNS Servers . . . . . . . . . . . : 192.168.1.253

Lease Obtained. . . . . . . . . . : Tuesday, July 10, 2012 10:01:29 AM

Lease Expires . . . . . . . . . . : Wednesday, July 10, 2013 10:01:29 AM

trimmed down route table to show the route to the 192.168.1.0/24 network

Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0       10.56.41.1     10.56.41.89       10
       10.0.200.0    255.255.255.0       10.0.200.5      10.0.200.6       1
       10.0.200.4  255.255.255.252       10.0.200.6      10.0.200.6       30
       10.0.200.6  255.255.255.255        127.0.0.1       127.0.0.1       30
       10.56.41.0    255.255.255.0      10.56.41.89     10.56.41.89       10
      10.56.41.89  255.255.255.255        127.0.0.1       127.0.0.1       10
   10.255.255.255  255.255.255.255       10.0.200.6      10.0.200.6       30
   10.255.255.255  255.255.255.255      10.56.41.89     10.56.41.89       10
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1       1
      192.168.1.0    255.255.255.0       10.0.200.5      10.0.200.6       1

See the last route there -- saying hey to get to 192.168.1.0, use your 10.0.200.6 interface and talk to 10.0.200.5

D:\>tracert 192.168.1.100

Tracing route to i5-w7.local.lan [192.168.1.100]

over a maximum of 30 hops:

1 377 ms 373 ms 369 ms 10.0.200.1

2 370 ms 370 ms 373 ms i5-w7.local.lan [192.168.1.100]

Now I think you might be confused with the 10.0.200.1 address in that trace? That is the IP address of my pfsense router on the 10.0.200.0 network, the .5 is only the endpoint of the vpn tunnel. Once it hits that it gets routed to the interface 10.0.200.1. VPN tunnels can be a bit odd ;) Here for example is off my pfsense router that is running open, showing its interface that has the 10.0.200.1 address 

ovpns1: flags=8051<up,pointopoint,running,multicast> metric 0 mtu 1500
        options=80000<linkstate>
        inet6 fe80::250:56ff:fe00:2%ovpns1 prefixlen 64 scopeid 0xb
        inet 10.0.200.1 --> 10.0.200.2 netmask 0xffffffff
        nd6 options=3<performnud,accept_rtadv>
        Opened by PID 15262

Which is actually a pointtopoint to 10.0.200.2 :) Like I said this stuff can be a bit odd.

Now from a box on my 192.168.1.0 network to get back to this 10.56 box

Its not going to work - that side has no route or understanding how to get to a 10.56 network. It would push it out its default route (internet) - which is never going to be able to get to a private 10.56 network.

budman@ubuntu:~$ traceroute 10.56.41.89

traceroute to 10.56.41.89 (10.56.41.89), 30 hops max, 60 byte packets

1 pfsense.local.lan (192.168.1.253) 3.140 ms 2.999 ms 2.950 ms

2 * * *

3 * * *

4 * * *

But it knows how to get to 10.0.200 network.

budman@ubuntu:~$ traceroute 10.0.200.6

traceroute to 10.0.200.6 (10.0.200.6), 30 hops max, 60 byte packets

1 pfsense.local.lan (192.168.1.253) 2.964 ms 2.895 ms 2.790 ms

2 10.0.200.6 (10.0.200.6) 750.272 ms 750.240 ms 750.168 ms

Here is the route table from the pfsense (openvpn server) router at my home site.

Internet:
Destination        Gateway            Flags    Refs      Use  Netif Expire
default            24.13.xx.xx       UGS         0   241811    em1
10.0.200.0/24      10.0.200.2         UGS         0    39238 ovpns1
10.0.200.1         link#11            UHS         0        0    lo0
10.0.200.2         link#11            UH          0        0 ovpns1
24.13.xxx.0/21     link#2             U           0    31340    em1
24.13.xxx.58       link#2             UHS         0        0    lo0
127.0.0.1          link#6             UH          0      256    lo0
192.168.1.0/24     link#1             U           0   230687    em0
192.168.1.253      link#1             UHS         0        0    lo0

There is no route to the 10.56, so if clients that are using this box as it gateway try and go to a 10.56.41 network this router does not know to send it down the vpn connection. So where would it go, it would go down my internet connection which is the default route.

Mine is a much easier setup, but see how there can be routing issues.. My remote side does not know how to get to 10.56.41.x

The setup your trying to do is a very convoluted setup.. But what your trying to do is similar to my 192.168.1.0 home network trying to get to a 10.56.41.0/24 network. Both endpoints of your vpn, server and client are inside private networks behind nat. And then on one side your trying to route to clients on the server side connection on that vpn servers wan interface. And from your posts, your not even aware of the network setup on the remote side, and you don't think you even need too? Which tells me your not understanding these basic routing concepts.

Your going to have problems with this sort of setup, and you really need to understand what the network range your putting the remote side on is, so that you don't run into conflicts.

Not sure how much farther we can go with this, maybe you can readdress what your doing after you have had some time to study for your CCNA? You had mentioned that earlier in the thread.</performnud,accept_rtadv></linkstate></up,pointopoint,running,multicast>

Rising Star

metro2012

Posted
  • Author
Posted

If you can not make a control port connection, but tv works - for all I know your going through the teamviewer servers to make the connection.

this seems unlikely as (to avoid this in any way shape or form) i put the "accept exclusively" option,

Are you TV to a different IP then what your trying to FTP too? Maybe this IP your trying to ftp too does not have route or default gateway so it can talk to the nb1600 router?

if it didnt have the route/default gateway, how could i ping it? the tv thing was stupid and just to try it out, but pinging it?

As to ftp being passive or active - that is the client side not the server side. Sure your server could only support 1 mode.. But you choose what mode you want via the client not the server. And this has nothing to do with a simple control connection to 21.

i ment that u could limit it on the server side rite?? i might have explained it wrong, srry.

i am using a default instalation meaning that it is out of the box which i think uses passive.

So if you saying you can not make this connection even - then you have a routing issue, or a firewall issue. Routing could be that the remote side does not know how to get back to you. Or could be your never getting there in the first place.

no. filezilla (server) says when some ip trys to connect and it doesnt say anything

If you say you can ping the the IP that your trying to ftp to - this points to either you pinging something different than the actual device, or something blocking tcp 21, or IP your trying to hit is not even listening on 21, etc.

i see u refer to tcp 21; openvpn uses udp. nothing to do with this rite?

So you created a route on your work side internet router (192.168.100.100) for this 172.16.3.x/24 network to hit the 192.168.100.7 interface on your vpn router in the office? So I wonder why in your config for server on this page you state your only pushing route

"push "route 192.168.2.0 255.255.255.0"

tis is something i neighter cannot answer (nor can the "tech guy") as it is copy paste.

where did u get "192.168.100.7" from? or is is just some ip u made up on the spot?

So your actual VPN client the nb1600 on the remote side how would it route to 192.168.100.x/24?? You don't push the default connectivity.

push "redirect-gateway def1"

This command tells the vpn client to use the vpn connection as its default route.

Nor do you have that setup in the client config from what you posted.

So you have this remote nb1600 as a openvpn client. It gets a 10.10.10.0/24 IP as its vpn IP, and then it has a 172.16.3.0/24 network hanging off its 2nd interface. how do devices on the 172.16.3.0/24 know how to get to the 192.168.100 network at your work side? From your configs you posted I don't see how that is possible at all.

So your remote computer/device on 172.16.3.14 say, knows that its gateway is the 172.16.3.1 interface of the nb1600.. But how does the nb1600 know to route the traffic through the vpn connection? You only pushed a route to 192.168.2.0/24 -- from your configs posted I don't see the commands to tell the remote vpn client to use the vpn connection as its default route. And even if you did. As I have stated before WHY YOU NEED TO UNDERSTAND the remote network this nb1600 is sitting on is maybe its 1st (wan interface) is connected to a 192.168.100.0/24 network -- So sure it can make a connection to your openvpn server. But how its it going to route traffic for clients on its 172.16.3 network through the vpn connection to get to a 192.168.100 network when it has a interface directly connected to that network already - so its just going to route traffic out that interface.

So from your box on the work network, lets see a traceroute to this 172.16.3.x device. And then from the device you say you can TV too on the 172.16.3 network -- lets see a traceroute back to your 192.168.100.x network.

did u read what i put in the ccd configuration? there is additional routes there specified which may answeer all ur questions (not sure because like i said its simply copy/paste, nothing more)

Rising Star

metro2012

Posted
  • Author
Posted

So for example, here at work and using openvpn to my home network.

So my box here is on 10.56.41.89 - to get to box on my home 192.168.1.0/24 network it uses its vpn connection to get to the 192.168.1.0/24

Ethernet adapter ovpn:

Connection-specific DNS Suffix . : local.lan

Description . . . . . . . . . . . : TAP-Win32 Adapter V9

Physical Address. . . . . . . . . : 00-FF-79-1A-85-63

Dhcp Enabled. . . . . . . . . . . : Yes

Autoconfiguration Enabled . . . . : Yes

IP Address. . . . . . . . . . . . : 10.0.200.6

Subnet Mask . . . . . . . . . . . : 255.255.255.252

Default Gateway . . . . . . . . . :

DHCP Server . . . . . . . . . . . : 10.0.200.5

DNS Servers . . . . . . . . . . . : 192.168.1.253

Lease Obtained. . . . . . . . . . : Tuesday, July 10, 2012 10:01:29 AM

Lease Expires . . . . . . . . . . : Wednesday, July 10, 2013 10:01:29 AM

trimmed down route table to show the route to the 192.168.1.0/24 network

this is also something that has "bothered" me.....on a pc to the openvpn server connection, i cant see usnig ipconfig my private vpn ip (which lets say would be 10.10.10.9). i think it shows blank for both that ip and the default gateway. ill post that tommorow.

Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0       10.56.41.1     10.56.41.89       10
       10.0.200.0    255.255.255.0       10.0.200.5      10.0.200.6       1
       10.0.200.4  255.255.255.252       10.0.200.6      10.0.200.6       30
       10.0.200.6  255.255.255.255        127.0.0.1       127.0.0.1       30
       10.56.41.0    255.255.255.0      10.56.41.89     10.56.41.89       10
      10.56.41.89  255.255.255.255        127.0.0.1       127.0.0.1       10
   10.255.255.255  255.255.255.255       10.0.200.6      10.0.200.6       30
   10.255.255.255  255.255.255.255      10.56.41.89     10.56.41.89       10
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1       1
      192.168.1.0    255.255.255.0       10.0.200.5      10.0.200.6       1

ive always misunderstood/confused routes but i always thought of them as how to get to different networks via what gateways (or routers). i am sorry if i am mistaken.

Now I think you might be confused with the 10.0.200.1 address in that trace? That is the IP address of my pfsense router on the 10.0.200.0 network, the .5 is only the endpoint of the vpn tunnel. Once it hits that it gets routed to the interface 10.0.200.1. VPN tunnels can be a bit odd ;) Here for example is off my pfsense router that is running open, showing its interface that has the 10.0.200.1 address 

ovpns1: flags=8051&lt;up,pointopoint,running,multicast&gt; metric 0 mtu 1500
        options=80000&lt;linkstate&gt;
        inet6 fe80::250:56ff:fe00:2%ovpns1 prefixlen 64 scopeid 0xb
        inet 10.0.200.1 --&gt; 10.0.200.2 netmask 0xffffffff
        nd6 options=3&lt;performnud,accept_rtadv&gt;
        Opened by PID 15262

Which is actually a pointtopoint to 10.0.200.2 :) Like I said this stuff can be a bit odd.

its not odd, i call it wanting to take a knife and slice thru your vanes....

The setup your trying to do is a very convoluted setup.. But what your trying to do is similar to my 192.168.1.0 home network trying to get to a 10.56.41.0/24 network. Both endpoints of your vpn, server and client are inside private networks behind nat. And then on one side your trying to route to clients on the server side connection on that vpn servers wan interface. And from your posts, your not even aware of the network setup on the remote side, and you don't think you even need too? Which tells me your not understanding these basic routing concepts.

i understand that the setup im trying to accomplish is very....odd in the sense that usually its a PC to a remote network.

Your going to have problems with this sort of setup, and you really need to understand what the network range your putting the remote side on is, so that you don't run into conflicts.

Not sure how much farther we can go with this, maybe you can readdress what your doing after you have had some time to study for your CCNA? You had mentioned that earlier in the thread.</performnud,accept_rtadv></linkstate></up,pointopoint,running,multicast>

yes, in octuber im going to take a 3 month prepartoy course for the ccna exam.....im obviously not ready at all but i hope the course can clear things up....a lot....

thank u for all ur help. ill reread this again tommorow and post any other information (more so about that 10.10.10.x address not showing up)

Rising Star

metro2012

Posted
  • Author
Posted

OK, here we go.....more information.

my boss took home another (completely different) nb1600 and i preconfigured it for his home network. he plugged it in, simply set the 172.16.3.1 and 172.16.3.x gateway/ip on the machine hooked up to lan2 (another windows ce net machine) and it perfectly worked. the odd thing about it, is that ftp worked too (anon). he was very happy as there was no configuration needed what so ever.

onto other topics: i mentioned that i did not have a 10.10.10.x address. my mistake. ipconfig /all show me.....

this is from my pc:

Adaptador de Ethernet Conexi?n de ?rea local 2:

Sufijo DNS espec?fico para la conexi?n. . :

Descripci?n . . . . . . . . . . . . . . . : TAP-Win32 Adapter V8

Direcci?n f?sica. . . . . . . . . . . . . : **-**-**-**-** (I know its virutal but....)

DHCP habilitado . . . . . . . . . . . . . : s?

Configuraci?n autom?tica habilitada . . . : s?

V?nculo: direcci?n IPv6 local. . . : fe80::b848:4935:d6d8:d78f%23(Preferido)

Direcci?n IPv4. . . . . . . . . . . . . . : 10.10.10.113(Preferido)

M?scara de subred . . . . . . . . . . . . : 255.255.255.252

Concesi?n obtenida. . . . . . . . . . . . : mi?rcoles, 11 de julio de 2012 9:45:58

La concesi?n expira . . . . . . . . . . . : jueves, 11 de julio de 2013 9:45:57

Puerta de enlace predeterminada . . . . . :

Servidor DHCP . . . . . . . . . . . . . . : 10.10.10.114

IAID DHCPv6 . . . . . . . . . . . . . . . : 385941414

DUID de cliente DHCPv6. . . . . . . . . . : **-**-**-**-** (I know its virutal but....)

Servidores DNS. . . . . . . . . . . . . . : fec0:0:0:ffff::1%1

fec0:0:0:ffff::2%1

fec0:0:0:ffff::3%1

NetBIOS sobre TCP/IP. . . . . . . . . . . : habilitado

This is correct.

On to other things, like the routuing issue that was brought up.....

when i make a nb1600 certificate, i put the following lines in where it says "ccd file contents":

ifconfig-push 10.10.10.237 10.10.10.238

iroute 172.16.3.0 255.255.255.0

push "redirect-gateway"

push "dhcp-option DNS 10.10.10.1"

Im going to try to tell u what i THINK each line means.

Line 1: This simply gives a ip in the tunnel. teh tech guy told me that i could only use determined ips such as this:

10.10.10.236 NOT USABLE

10.10.10.237 USABLE

10.10.10.238 USABLE

10.10.10.239 NOT USABLE

10.10.10.240 NOT USABLE

10.10.10.241 USABLE

10.10.10.242 USABLE

10.10.10.243 NOT USABLE

he told me that the first afress in the set (such as 10.10.10.236) were network address (like when u put 10.10.10.0) and the last in the set (such as 10.10.10.239) is a broadcast address (like 10.10.10.255 moving on....

Line 2: This represents the network on LAN2 which i want to see when i connect remotely

Line 3: No idea at all.

Line 4: if the ips on line 1 cannt be assigned it uses this ip to get a ip address from dhcp (i do no thave a dhcp server at that ip)

now this is the setup of a certifcate when im on a pc trying to connect and give support (ccd file contents)

ifconfig-push 10.10.10.113 10.10.10.114

iroute 192.168.0.0 255.255.255.0

push "route 192.168.0.0 255.255.0.0"

push "route 172.16.0.0 255.255.0.0"

Line 1: same as line 1 above

Line 2: the network I AM on

Line 3 and 4: the lans i want to see

Rising Star

metro2012

Posted
  • Author
Posted

(setting that aside for a moment)

ive set up two different nb1600 with the first's lan2 set to 172.16.3.1 and the second's lan2 set to 172.16.2.1 with a submask (both) of 255.255.255.0 in theory they shouldnt see each other.

problem is that they do and this is not wanted. how can i avoid this or limit it? might have to do with the post i said before so.....

Grand Master

+BudMan MVC

Posted
  • MVC
Posted

The option

client-to-client

is normally used to allow clients to talk to each other. Which you have listed in your config you posted a few posts back.

Have not had chance to read you other posts yet.

Rising Star

metro2012

Posted
  • Author
Posted

The option

client-to-client

is normally used to allow clients to talk to each other. Which you have listed in your config you posted a few posts back.

Have not had chance to read you other posts yet.

ill try to disable that server side and see if i (a admin) can access all of them and the clients cant access each other. thank u.

Rising Star

metro2012

Posted
  • Author
Posted

yup, it was that in the server config "client-to-client" but i just want some to have that ability and not all. the problem is that when i enable that server side, it is enabled for all. the tech support should have access to all but the clients should nto have access to anything. how can i configure this?

Grand Master

+BudMan MVC

Posted
  • MVC
Posted

If they are at your location, the server side of the vpn - they would have access to all remote connections coming in. Its just the clients to your server can not talk to other clients.

Rising Star

metro2012

Posted
  • Author
Posted

If they are at your location, the server side of the vpn - they would have access to all remote connections coming in. Its just the clients to your server can not talk to other clients.

the thing is that all clients that connect to the openvpn server are just that: clients. i need to seperate them into 2 groups: admins which have access to all and the others which only have access to their subnet (172.16.3.x should not access 172.16.2.x) right now afaik i am only making admin type of accounts. client-to-client enables talking to each other, like i commented it.

how can i limit this??

Grand Master

+BudMan MVC

Posted
  • MVC
Posted

What???

The computers at the office site are not clients. So your saying people need to connect via vpn -- from where? And connect to all the vpn sites, but you don't want vpn sites to be able to talk to vpn sites?

We have been going at this for almost 8 pages now, for what a couple of weeks - and you have yet to actually give details of WHAT you want. It has been like pulling teeth to get any info.

I post up what I think your talking about, and you say yeah!! Thats its, then 2 post laters - no thats not it, we want X. Then I explain how I understand X, and you say yup thats it. Then you say no its not really X it's Y.

I am not sure if its just language issue or just that you don't really know what you want.

Rising Star

metro2012

Posted
  • Author
Posted

What???

The computers at the office site are not clients. So your saying people need to connect via vpn -- from where? And connect to all the vpn sites, but you don't want vpn sites to be able to talk to vpn sites?

if i connect to the openvpn server at my office, that makes me a client right? i have to connect to that server in order to access the rest....

We have been going at this for almost 8 pages now, for what a couple of weeks - and you have yet to actually give details of WHAT you want. It has been like pulling teeth to get any info.

basically remote support being able to access a common network (which would be a vpn tunnel)

I post up what I think your talking about, and you say yeah!! Thats its, then 2 post laters - no thats not it, we want X. Then I explain how I understand X, and you say yup thats it. Then you say no its not really X it's Y.

i consider it more like pi......yeah its 3.14159 but thats not the value 100%.......... its complicated

I am not sure if its just language issue or just that you don't really know what you want.

im completely sure what i want but it must be a language issue that i cannot express correctly.....

more drawings:

untitlxcvbed.png

network 1 should be able to access 2 3 and 4. the others should not access anyone else except 1

This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.

  • Posts

    • The official Funny Pictures thread

      By Steven P. · Posted

    • Samsung Galaxy Z Fold 8, Flip 8, Z Fold Wide: Everything you need to know

      By Hamid Ganji · Posted

      Samsung Galaxy Z Fold 8, Flip 8, Z Fold Wide: Everything you need to know by Hamid Ganji Galaxy Z Fold 7 - Image via Samsung The next generation of Samsung foldables is set to be unveiled next month at the second Unpacked event of the year. Samsung’s 2026 foldables are not expected to offer significant upgrades over their predecessors, with the Korean firm instead focusing on design refinements and conventional upgrades such as faster processors and better cameras. However, Samsung is reportedly planning to unveil an all-new passport-style foldable this year to rival Apple’s first foldable iPhone, which is expected to debut this September. Here’s a roundup of everything we know about Samsung’s upcoming foldable devices ahead of their official debut. When can we expect Samsung’s new foldables? The Galaxy Z Fold 7 and Z Flip 7 series were unveiled in July, and Samsung is expected to maintain this timeframe in 2026. Based on previous reports from Korean sources, Samsung will hold its Unpacked event on July 22 in London, UK, to pull back the curtain on the Galaxy Z Fold 8 series. The devices are also expected to hit the shelves a few weeks after launch. However, Samsung has yet to announce an official date. A new naming scheme? One of the most interesting changes we might see this year is a new naming scheme for Samsung’s latest foldables. SamMobile reported that since Samsung is expected to unveil three foldables this year, it has adopted a new naming strategy to simplify product identification for customers. Accordingly, the standard Galaxy Z Fold 8 will reportedly be called the Galaxy Z Fold 8 Ultra and will serve as the direct successor to last year’s Galaxy Z Fold 7. The “Ultra” suffix suggests the phone could feature higher-end specifications, such as additional rear camera modules. Samsung’s new passport-style foldable is expected to carry the Galaxy Z Fold 8 name without any suffix. This model is reportedly equipped with two rear cameras. No major changes are expected for the Flip model. Galaxy Z Fold 8 Ultra and Z Flip 8 anticipated specs Rumors over the past few months suggest Samsung is preparing several upgrades for its upcoming foldables, although the devices may continue to rely on larger batteries and faster charging speeds rather than dramatic design changes. The primary focus this year is expected to be the Galaxy Z Fold 8 and its wide-screen design. Galaxy Z Fold 8 Ultra official CAD renders - Image via AndroidHeadlines Here are the anticipated specifications for the Galaxy Z Fold 8 Ultra based on previous leaks: 6.5-inch outer display and 8-inch inner display, 120Hz refresh rate, and 2,600 nits peak brightness Snapdragon 8 Elite Gen 5 processor, paired with 12GB or 16GB of RAM and 256GB, 512GB, or 1TB of storage 4.1mm thickness when unfolded and a weight of 210g 200MP main camera, 50MP ultrawide camera, 10MP or 12MP telephoto camera, 10MP cover camera, and 10MP selfie camera 5,000mAh battery with 45W wired charging Android 17 and One UI 9 As for the Galaxy Z Flip 8, the device is not expected to be a major departure from its predecessor, although it could become slightly slimmer. Expected specifications include: Snapdragon 8 Elite Gen 5 or Exynos 2600 processor 12GB of RAM with 256GB and 512GB storage options 6.9-inch Dynamic AMOLED 2X inner dispaly and 4.1-inch Super AMOLED outer dispaly 50MP main camera, 12MP ultrawide camera, and 10MP selfie camera 4,300mAh battery with 25W wired charging Android 17 and One UI 9 Samsung’s foldables are also expected to launch with Gemini Intelligence, Google’s AI suite for automating tasks in Android ecosystem. Moreover, given current memory and component costs, some Galaxy Z Fold 8 Ultra and Z Flip 8 variants could see a price hike. Galaxy Z Fold 8 adopts a wide-screen design The centerpiece of the upcoming Unpacked event could be the Galaxy Z Fold 8, previously rumored as the Galaxy Z Fold Wide. This model adopts a passport-style form factor and is expected to compete directly with Apple’s iPhone Fold. Galaxy Z Fold 8 official CAD renders - Image via AndroidHeadlines Here’s what to expect: 7.6-inch primary OLED display and 5.4-inch cover display, 120Hz refresh rate, 2,600 nits peak brightness, and 4:3 aspect ratio Snapdragon 8 Elite Gen 5 processor, 12GB or 16GB of RAM, and 256GB, 512GB, or 1TB storage options 4,800mAh battery with 45W wired charging 50MP main camera, 50MP ultrawide camera, and 10MP selfie camera Android 17 and One UI 9 The three new foldable phones are unlikely to be the only devices unveiled at Samsung’s Unpacked event. The company is also expected to introduce the Galaxy Watch Ultra 2 and the Galaxy Watch 9 series.
    • Dopamine 3.0.6

      By Jaybonaut · Posted

      Thanks
    • 7 Days: Killing uBlock Origin bypasses, Euro Office faces fire, and will AI replace you?

      By Aditya Tiwari · Posted

      7 Days: Killing uBlock Origin bypasses, Euro Office faces fire, and will AI replace you? by Aditya Tiwari 7 Days is a weekly roundup of picks of what's been happening in the world of technology - written with a dash of humor, a hint of exasperation, and an endless supply of (black) coffee. This week's highlights include WWDC 2026 announcements, updates on child safety, and Meta's use of data from outside businesses to optimize your feed. Let's get started. You can check out the recent issues of the 7 Days weekly roundup. Killing uBlock Origin bypasses The hottest news of the week was about Google Chrome effectively ending most uBlock Origin workarounds (a free, open-source ad blocker extension) by permanently dropping MV2 extensions and their bypasses. Chrome is transitioning towards newer MV3 extensions. A recent discussion thread highlighted how the latest and upcoming versions of the most popular browser are expected to be its final releases with support for MV2 extensions. Genuinely European? Euro-Office faces fire The recently launched cloud-based office suite, Euro-Office, is facing criticism at home. The LibreOffice developer wrote an open letter criticizing Euro-Office for its marketing claim that it's the "first open-source office suite developed in Europe," since the honor has belonged to OpenOffice since 2001. The Document Foundation has called out Euro-Office, arguing that it can't consider "itself genuinely European" as long as it keeps pushing Microsoft defaults on users, adding that "it has to speak ODF as its mother tongue." Will AI replace you? Image: Tara Winstead via Pexels Microsoft's AI boss, Mustafa Suleyman, said in an interview earlier this year that AI would replace office workers within 12 to 18 months. Joining the ranks of top executives who have softened their stance on AI replacing humans, Suleyman recently walked back his earlier remarks and now says that AI will automate tasks, not replace entire white-collar jobs. He defended his earlier comments by arguing that they referred only to individual actions people perform at their desks. Louis Rossmann wants to sue Samsung Image: Louis Rossmann Tech repair entrepreneur and right-to-repair activist Louis Rossmann contacted Samsung support over a failed 4TB Samsung 990 Pro NVMe SSD. After back-and-forth communication, Samsung offered a $330 refund instead of a replacement, but Rossmann found that the SSD was readily available for new buyers at a higher price. He has issued a formal 60-day notice and intends to file a suit in Texas small claims court, as Samsung's actions reflect a failure to honor its warranty obligations. Samsung reached out to Neowin to clarify its updated stance that customers in such situations will receive a refund equal to the product's current market price. Child safety or mass surveillance? Image: Jonathan Borba via Pexels Signal accused the UK government of using child safety and device-level explicit content ban as a cover for mass surveillance. Calling the plan "dystopian," Signal warned that it violates everyone's fundamental right to privacy. The messaging platform believes that the government should keep children "safe" and "protected," but it should do so through social services and education. Fears of social media regulation Image via DepositPhotos.com More governments across the globe are tightening their grip on social media and bringing stricter regulations in the name of child safety. Bluesky COO, Rose Wang, warned that social media regulations could destroy competition from small startups and that heavy regulatory compliance costs favor deep-pocketed tech giants while locking out new entrants. Our Features Image: Pexels Our coffee-powered team publishes a platter of editorials, opinion posts, and guides. Here's what they got for the week: UK **** blockers are a looming privacy disaster, we must be able to see the source code This week in software news Image: Proton Catch up on some of the latest software news updates that arrived throughout the week: Dark clouds over PC makers: Building on our report from last month, Dell officially acknowledged that its own remediation software was causing BSOD issues and unexpected system restarts. HP is also facing equally frustrating issues involving recent Windows Secure Boot updates on Windows 11. Controversial icon: Spotify finally removed the disco ball icon from its app and replaced it with the familiar flat green logo after weeks of mixed reactions online. While some people don't like the new design, the retro, three-dimensional look has generated a following of its own. Even other brands are coming up with their versions of the disco logo. NVIDIA fixes stuff: A new hotfix driver 610.52 fixes various issues related to monitors and displays, noting that G-SYNC-related frame pacing troubles should now be resolved on Ada Lovelace GPUs. The feedback thread also points out that the hotfix patches a BSOD issue. FIFA World Cup tracker: Opera is redesigning its Android browser with a built-in football tracker for the upcoming World Cup in the US. The new homepage is now "more immersive" with easier access to common browser features. Command line for Proton: The Swiss technology company has launched a command line version of the Proton Drive, which you can use to manage your encrypted files directly from a terminal across all major platforms, including Windows, macOS, and Linux. This week in hardware news Image: Thermaltake Catch up on some of the latest software news updates that arrived throughout the week: Intel and AMD PCs in one case: Thermaltake's CAPO X dual-system chassis brings you the best of both worlds by supporting two microATX (mATX) motherboards and up to two 360 mm AIO liquid coolers. If you want ideas, maybe you can use one as your main PC and another as an AI agent. Google Tensor production: While TSMC will remain the lead producer, the search giant is reportedly in talks with Samsung to hand over part of the production of its next-generation Tensor AI chips. The upcoming TPUs are reportedly codenamed “Icefish” and will be produced using Samsung's 2-nanometer process technology. Lethal fake phone chargers: UK-based consumer rights organization Which? has warned that "potentially lethal knock-off chargers" are still being sold on online marketplaces, including Amazon and eBay, despite the dangers of such chargers having been exposed. This week in Google News Image: Google Catch up on some of the latest Google news updates that arrived throughout the week: Sliding into DMs: You might remember that YouTube had a direct messaging feature back in the day. It's now rolling out a revamped direct messaging inbox that lets you share Shorts, videos, and live streams and have conversations about them. New in NotebookLM: The AI-powered note-taking app got some new agentic capabilities and more advanced reasoning, thanks to support for Gemini 3.5 and Antigravity. NotebookLM can now generate outputs in more formats, making it easier to start new projects with less information. This week in Apple News Image: Apple Catch up on some of the latest Apple news updates that arrived throughout the week: WWDC 2026: This week was all about Apple's annual developer conference, where the iPhone-maker finally unveiled an upgraded Siri AI and a platter of new Apple Intelligence features. Siri AI now has a cross-platform app, which is supported on select models of iPhone, iPad, Mac, Apple Watch, and Vision Pro. What's different about WWDC: I wrote a detailed feature this week discussing how Apple changed the WWDC keynote this year, blurring the lines between its operating systems. Apple didn't have dedicated segments for its operating systems this year and didn't even publish the official press releases. Liquid Glass slider (finally): It's that time of the year when Apple previews fresh updates for iPhone, iPad, Mac, Apple Watch, AirPods, and other platforms. A new transparency slider for Liquid Glass is coming to iOS 27, iPadOS 27, and macOS 27 Golden Gate. Is your device supported?: If you're wondering whether your Apple device supports the new developer beta builds, you can check the respective compatibility lists for iOS 27, iPadOS 27, macOS 27, and watchOS 27. Siri AI not coming to Europe: Yes, that's true due to complications related to the Digital Markets Act (DMA). While Apple penned a blog post to tell its side of the story, a European Commission spokesperson told Neowin that the DMA does not prohibit Apple from launching its services in the EU; the company is simply required to comply with the law. New child safety features: Apple announced a trove of new safety features for kids, including a simpler setup experience for parents, Ask to Browse, Time Allowances, and a redesigned Screen Time UI. Parents can now visit a new website to find answers to common questions around child safety features. More cloud power: Apple's Private Cloud Compute cloud infrastructure will now run beyond its own data centers for the first time. It's working with Google and NVIDIA to run new Apple Intelligence workloads on Google Cloud systems powered by NVIDIA GPUs. This week in Meta news Catch up on the latest Meta news updates that arrived throughout the week: Data from outside: Meta is rolling out a new update globally to personalize your AI responses and primary feeds using data from outside businesses. It already targets ads based on shopping activity, but the latest development enables it to personalize other "parts of your experience." There is a toggle in the Settings to disable activity from other businesses; however, it won't prevent companies from sending your data to Meta. Level playing field: The European Commission has ordered the social media giant to restore access to WhatsApp for third-party AI chatbots, including ChatGPT and Copilot. Meta previously blocked rival AI chatbots from operating on WhatsApp, prompting the Commission to launch an antitrust investigation. Spying on users: On the flip side, WhatsApp accused the Israeli cyber-intelligence firm, NSO Group, of deploying a fresh wave of targeted "spear phishing" attacks against its users, which were thwarted by WhatsApp's security teams. Reorder profile grid: Adding some customization for the profile grid feature, Instagram now lets you rearrange posts in your profile without deleting and reuploading content. Go to your profile and long-press any thumbnail to find the "Reorder grid" option. This week in AI news Catch up on the latest artificial intelligence news updates that arrived throughout the week: Claude RAM hogger: Windows users are getting infuriated by Claude Desktop's hidden 1.8GB Hyper-V VM bug, which spins up if you use Claude Cowork or agent mode even once. It shows a Vmmem process in Task Manager, indicating 0% CPU usage but 1.8GB of RAM usage. Claude Fable 5: The new state-of-the-art AI model from Anthropic beats OpenAI's ChatGPT-5.5 in multiple AI benchmarks. Claude Fable 5 sits above the Opus models and outperforms most other generally available models across knowledge work, vision, scientific research, and more. However, the model was abruptly suspended after receiving an export control directive from the US government. Stack Overflow for AI agents: The popular Q&A platform has launched Stack Overflow for Agents in beta, which AI agents can use to share, find, and reuse coding knowledge. It explained that AI agents operate in isolation, creating an Ephemeral Intelligence Gap, and valuable tokens are wasted on something another agent has already solved. Upgrading Codex: OpenAI is buying a company called Ona, which makes secure cloud execution and orchestration technology for developers. The ChatGPT-maker aims to make Codex agents run for days without being tied to a local machine or an active session. It also announced a new developer mode in Chrome. This week in open-source news Catch up on some of the latest open-source and Linux updates that arrived throughout the week: Linux 7.1 rc7: Linux Torvalds dropped an optimized rc7 with crucial fixes for AMD and laptop hardware. He said that a stable version of Linux 7.1 could arrive next week, adding that the latest RC is not small, but smaller than recent releases. Alpine Linux 3.24: The latest Alpine Linux release added support for COSMIC Desktop, Linux 6.18, IPv6 installer support, automatic serial console configuration for headless setups, and major package updates and removals. This week in Microsoft News Microsoft had to shut down more than 70 GitHub repos after they were compromised by malware, Teams is getting a controversial tracking feature that users may hate, and the company explained why the new update makes PowerToys faster. You can check out Taras's freshly baked Microsoft Weekly roundup to catch up on all the interesting stories this week. This week in gaming The latest issue of Pulasthi's Weekend PC Game Deals curates several exciting games on sale this week. On the Epic Games Store, the new titles on display for grabs include Warhammer 40K Speed Freeks and The Ouroboros King. NVIDIA GeForce NOW's summer sale lowered the prices of both the Performance and Ultimate membership options for a limited time period. Meanwhile, the Xbox Free Play Days brought Undead Labs' post-apocalyptic title State of Decay 2, as well as two Team17-published titles. That said, here are some more stories from the gaming world: Dragon's Dogma 2: Dark Arisen expansion to bring snowy region, new updates also coming Playground drops 30 minutes of Fable gameplay, shows off life sim and morality system Playground Games confirms Forza Horizon 6 save wipe bug Doom: The Dark Ages Revelations expansion gives the Slayer a brutal Chain Spear State of Decay 3 is out in 2027, reveals Plague Nests with new co-op gameplay trailer From the review corner This week, Taras got his hands on the DuRoBo Krono portable e-ink reader, which comes with a $279 price tag. It's a smartphone-sized device with a rotating dial, sitting somewhere between premium and cheap in terms of build quality. Speaking of the pros, the physical controls are cool, the smart dial is useful, the battery life is good, and Android 15 has no-nonsense software. On the flip side, the device lacks software customization, the built-in AI needs improvement, the smart dial is a bit wobbly, and there is no ambient light sensor. EA Sports UFC 6 EA Sports UFC 6 does a better job at onboarding new players than most fighting games, according to Pulasthi's detailed review. The game comes with rewarding combat systems, top-notch animation, impressive impact physics, and visible damage on fighters. However, the menus lag a lot, grappling isn't very fun, and the flow state feels a little misplaced. More price drops! We got you covered with some hot tech deals all week. For some reason, if you missed out on a great discount, here is a summary of some recent deals that are still alive: GIGABYTE Radeon RX 9070 XT Gaming OC ICE 16G - $649.99 (13% off) 1TB Samsung T7 Portable SSD - $189.98 (31% off) AirPods Pro 3 - $179 ($50 off) Edifier R1280Ts Powered Bookshelf Speakers - $129.99 (24% off) To view all of our recent deals, click here. So, these were some of the biggest tech news and other updates from this week. There will be more issues of our 7 Days series in the coming weeks and months, so stay tuned. You can also support Neowin by registering for a free member account or subscribing to extra member benefits, along with an ad-free tier option. Have a great weekend!
    • AMD 9070XT

      By cooky560 · Posted

      Well I've done a grand total of nothing, and it now clocks between 2010mhz and 1995mhz (stock is 1710mhz) and hovers around 80c, warmer than it used to, but tolerable clocks seem to have returned. Thanks for all the advice on this thread. Will review the evidence and make a choice.

  • Recent Achievements

    • Week One Done
      rolfus earned a badge
      Week One Done
    • One Month Later
      Leroy Jethro Gibbs earned a badge
      One Month Later
    • Conversation Starter
      flexorcist earned a badge
      Conversation Starter
    • One Month Later
      AndreaB earned a badge
      One Month Later
    • One Month Later
      agatameier earned a badge
      One Month Later

  • Popular Contributors

    1. 1
      +primortal
      505
    2. 2
      +Edouard
      199
    3. 3
      PsYcHoKiLLa
      142
    4. 4
      ATLien_0
      89
    5. 5
      Steven P.
      80
    Show More

  • Tell a friend

    Love Neowin? Tell a friend!