guides to create openvpn server in linux?

[metro2012]

Quoting system was not working :s

[+BudMan MVC]

"Using TCP port 80 for the VPN allows passing most firewalls in a factory or on customer side."

Sure -- and what if you have to auth? Have to tell who you are in most companies for the proxy to let you out. Quite often 80 is only allowed for the proxy server, etc. You can not directly get to the internet on any port. Only the proxy can get out, and you have to point to the proxy, and you have to auth to it.

Expecting to drop something into a remote network and have it work without any understanding of the remote network address space or how they control internet access is not very likely.

My last drawing shows the setup for on how to access your devices. But again the port your using for openvpn has to be open on the remote side. You have to forward this port on your internet router to your nb1600. And only the devices connected to the lan port of the router on your side will be able to connect to the devices on the remote sites.

if you want your normal lan devices to be able to get to the remote, without your vpn enpoint being your gateway you would have to create host routes pointing to the nb1600 interface. Not a very efficient setup.

I am not sure how much farther we can go with this.. You clearly need some basic understanding of routing, and if the guy that was suppose to set it up does not want to touch the command line.. JFC I feel sorry for you - have them send out an actual tech.

[+John Teacake MVC]

How many of these rouge people are they out there! It makes me really sad!

[metro2012]

He did indeed say that routes needed to be created in order for this setup to work; these routes I'm not too sure how to create so maybe starting from there wud be good.

About the port thing, my boss commented that the setup was shown using the discontinued model and it worked and no ports were opened up. :s that's y I ask about the 80 port....

They sadly don't have another tech it seems to mount this thing and automatically assigned this guy. When I was with him, it seemed he didn't really control wha he was doing and just trying thigns out.

I'll gjive it another go tomm and say some outcomes.

Thanks for ur help budman

[+BudMan MVC]

"it worked and no ports were opened up. "

Come on -- do I really need to explain how company A might be different then company B? Yes its quite possible that you could connect a device to company A network and it would get an IP and port 80 would be open. But I can tell you for a fact, that is not common security practice.

For starters you can not even plug in a device into say my company network without IT approving the MAC of the device, you can not talk on the network at all because of NAC (network access control) until device has been allowed by IT. Then again even if you could get an IP and talk on the network. There is no default route to the internet, you can not get to the internet. Only the Proxy can access the internet, so again you have to work with the remote IT side and get this information. Sure openvpn can work over a proxy - I do it every day ;) If that is the case that would have to be configured - and not from the gui ;)

Now in your conf file on the remote router you could tell it to use a proxy with the http-proxy command in the conf file

http-proxy [proxyserver] [port] [textfile with login data]

So without understanding such stuff about the remote network - how could you expect it to work, unless its just some wide open network with no securities in place at all?

That nb1600 is clearly a industrial grade router, and has some really cool features. And yes it could do what you want for sure. But there has to be a bit of understanding to set it up! Again in my last drawing I showed you how it could be done so you can control -- sure more than one device on the remote side and more than 1 pc on your side.

My point about the endpointing the vpn inside your network -- did you read this link I gave about the problem of what your trying to do. And why you might want to bridge vs route.

http://www.grc.com/vpn/routing.htm

This goes over what have been trying to explain to you about the vpn endpoint being inside your network vs your gateway. Going to ask this again for I think the 4th time. What is the make and model number of your internet router?? Maybe it can be the endpoint for these remote routers. Or you could put in say a linux or bsd based PC as your internet router at your home site. And then all these remote routers could use your networks gateway as their endpoint, and all your PCs could get to any remote device they wanted without any weird routing or bridging having to be setup.

[metro2012]

"it worked and no ports were opened up. "

Come on -- do I really need to explain how company A might be different then company B? Yes its quite possible that you could connect a device to company A network and it would get an IP and port 80 would be open. But I can tell you for a fact, that is not common security practice.

For starters you can not even plug in a device into say my company network without IT approving the MAC of the device, you can not talk on the network at all because of NAC (network access control) until device has been allowed by IT. Then again even if you could get an IP and talk on the network. There is no default route to the internet, you can not get to the internet. Only the Proxy can access the internet, so again you have to work with the remote IT side and get this information. Sure openvpn can work over a proxy - I do it every day ;) If that is the case that would have to be configured - and not from the gui ;)

well i know for a fact tha neither my company or the other company hav too much invested in a it dept.....not because they dont care jus because its a area they are not intrested in.

jus to show u how many company doesnt even care, before i came in, u could actually access the router knowing its public ip and the password was "admin"; yes u read rite: admin

so on a security level, from our stan point, really there is near none.

Now in your conf file on the remote router you could tell it to use a proxy with the http-proxy command in the conf file

http-proxy [proxyserver] [port] [textfile with login data]

tommorow when i get to work, ill try to comment some things that the "tech guy" told me i had to configure to put in some routes.

So without understanding such stuff about the remote network - how could you expect it to work, unless its just some wide open network with no securities in place at all?

i believe u are referring specifically to open/closed ports; how it was sold to us (which i from the start saw it as weird that no ports were required to close and open) it works without closing/opening ports.

does talk2m work like this as well (as is wit no network config) or do u have to close/open ports?

That nb1600 is clearly a industrial grade router, and has some really cool features. And yes it could do what you want for sure. But there has to be a bit of understanding to set it up! Again in my last drawing I showed you how it could be done so you can control -- sure more than one device on the remote side and more than 1 pc on your side.

i saw ur drawing but i do not know how to configure that on the software side of things in the web gui. i cud post some screenshots if u want and see if from there maybe there is a posssibility of doing it. in port b and port d, u have 10.10.10.1 assigned but what is the gateway? because these ports need internet acess

My point about the endpointing the vpn inside your network -- did you read this link I gave about the problem of what your trying to do. And why you might want to bridge vs route.

http://www.grc.com/vpn/routing.htm

i read it but i understand (i might have understood incorrectly) that briding is just like a switch, meaning there arent sevreal ip to deal with while routing is with ips. routing i believe is needed (the "tech guy" told me that briding wouldnt do it) because out of that port d there can be more than one equipment connected to a switch.

This goes over what have been trying to explain to you about the vpn endpoint being inside your network vs your gateway. Going to ask this again for I think the 4th time. What is the make and model number of your internet router?? Maybe it can be the endpoint for these remote routers. Or you could put in say a linux or bsd based PC as your internet router at your home site. And then all these remote routers could use your networks gateway as their endpoint, and all your PCs could get to any remote device they wanted without any weird routing or bridging having to be setup.

i know our internet router is aZyXEL but ill have to get back to u on the model.

thanks again for helping and have patiences.

[+BudMan MVC]

"i believe u are referring specifically to open/closed ports; how it was sold to us (which i from the start saw it as weird that no ports were required to close and open) it works without closing/opening ports."

On the remote side you don't have to do a forward. And sure if a port is open they can get out fine. But for the remote side to get to the router on your end, then you have to forward the port on your router on the internet ZyXEL router.

"briding is just like a switch, meaning there arent sevreal ip to deal with while routing is with ips."

No -- where did you get that idea??

So what part do you not understand about that link and gateways? I posted it because it explains it way better than I would prob do.

So your computer at 192.168.100.14 say.. How does he know to use the router on your end to get to the remote site? Its not on his local network so he talks to his gateway 192.168.100.100

Does 192.168.100.100 know how to get to that remote network connected to port D of your other router?

[metro2012]

"i believe u are referring specifically to open/closed ports; how it was sold to us (which i from the start saw it as weird that no ports were required to close and open) it works without closing/opening ports."

On the remote side you don't have to do a forward. And sure if a port is open they can get out fine. But for the remote side to get to the router on your end, then you have to forward the port on your router on the internet ZyXEL router.

yes. i understood that u have to open ports on site b and thats not what u ment; u ment i have to open a port on my side.

"briding is just like a switch, meaning there arent sevreal ip to deal with while routing is with ips."

No -- where did you get that idea??

i misunderstood the article. i reread it now and frmo what i see, all of site b's connected material (lets say 192.168.90.x) is shared with everything hanging out of port d.

all of site c's connected material (lets say 192.168.80.x) is shared with everything hanging out of ITS port d.

but, with bridging, is everything on 192.168.90.x shared with 192.168.80.x? if so its out of the question as these companies are seperete.

in the article this was said:

...

The process is known as defining "static routes" which would be placed into every other network machine on the LAN. But this requires manual configuration of network routing tables, and many simple network appliances such as networked printers, gateway routers, and other devices lack any provision for this sort of advanced packet routing

...

i was told these static routes have to be created.

So your computer at 192.168.100.14 say.. How does he know to use the router on your end to get to the remote site? Its not on his local network so he talks to his gateway 192.168.100.100

Does 192.168.100.100 know how to get to that remote network connected to port D of your other router?

i believe in order to get to that port d i have to create a static route......there seems to be no other way.

[metro2012]

i can now confirm that our internet router is ZyWall 10

[metro2012]

i took some screenshots of the client.....this is a pc connected directly to the lan2 port of the client nb1600. maybe u see sumthing that i dont see. if u need or are intrested in more screenshots ask.

ill now take and upload some of the server.

[metro2012]

this is the server. once again connected to its lan2

if once again u need anything else u see there, go ahead and ill put more screenshots

[+BudMan MVC]

I have the manual - I know exactly what you can do with it. Your problem is lack of understanding basic networking. Again I showed you how to make the thing work. You can connect devices to port B or router 1 and access stuff on router 2. port D

Once you forward the port on your internet router.

No just because you bridge does not mean stuff and site 3 would be shared with site 4. And only stuff connected to the 2nd lan port of the devices would be bridged with stuff at your site.

[metro2012]

I have the manual - I know exactly what you can do with it. Your problem is lack of understanding basic networking. Again I showed you how to make the thing work. You can connect devices to port B or router 1 and access stuff on router 2. port D

Once you forward the port on your internet router.

No just because you bridge does not mean stuff and site 3 would be shared with site 4. And only stuff connected to the 2nd lan port of the devices would be bridged with stuff at your site.

then maybe bridge mode is the correct way to go. ill try it out in bridge mode instead of routing and see how it goes.

thank u for advice. ill try it out now but i might not be able to give a result until tommorow.

[metro2012]

i tried changing to bridge mode and it compains it is only possible in tap mode (not tun)

[metro2012]

i also reanalyzed ur drawing and i noticed sumthing when it comes to testing this setup out..........

currently we are testing this out with a 3g dongle since we dont have direct access to site 2 (its a couple hundreds of kilometers away and obviously we cant go back/forth).

so my question is, wud this work with a 3g dongle?

[metro2012]

i think tha was one of the reasons why ur drawing even it if it made sense, i couldnt implement it as testing wud be near impossible (unless it works thru a dongle)

[+BudMan MVC]

dongle -- please post link to make and model.

How ae you trying to test this? if need be just connect the wan interfaces of the routers together with a cross over cable.

[metro2012]

well here is some news u may not like (i didnt because i feel like i lost alot of time)

now instead of 2 nb1600, he wants to use just one and a linux box as server (like u mentioned in pages before) because its easier to setup and its like the discontinued model....bf just gets worst.

btw, i acutally printed out ur drawing (the last one); he did not understand it. i just want u to know what im dealign with, budman. the reason we dont change to someone else is because his copany seels alot of parts to ours so....its kind of a "must".

anyways shud i make a new thread or contoinue here?

i got site 2 to speak with the server here (site two has become my house, literally. i took home the client nb1600 and hooked it up perfectly with my home network) but now i cant connect ot the server here at the office (usint its local ip so i dont have to go thru the ientire internet, so to speak) and access it (my site 2, my home)

my home network uses 192.168.1.0 255.255.255.0 basic home network. at my house the lan1 (port c) has been assigned 192.168.1.90 and port d is still 172.16.3.1 (with a machine at 172.16.3.188) i added this in the client certificate:

ifconfig-push 10.7.0.5 10.7.0.6

iroute 192.168.100.0 255.255.255.0 (i am connecting to the vpn server in my office network from my office)

push "route 192.168.100.0 255.255.255.0"

push "route 192.168.1.0 255.255.255.0"

push "route 172.16.0.0 255.255.0.0"

The tunnel seems to connect and it gives me a tunnel ip but this appears in the client log:

Wed Jul 04 11:29:18 2012 ROUTE: route addition failed using CreateIpForwardEntry: One or more arguments are not correct. [if_index=23]

Wed Jul 04 11:29:18 2012 ROUTE: route addition failed using CreateIpForwardEntry: One or more arguments are not correct. [if_index=23]

Wed Jul 04 11:29:18 2012 ROUTE: route addition failed using CreateIpForwardEntry: One or more arguments are not correct. [if_index=23]

Wed Jul 04 11:29:18 2012 ROUTE: route addition failed using CreateIpForwardEntry: One or more arguments are not correct. [if_index=23]

Wed Jul 04 11:29:18 2012 Initialization Sequence Completed

running openvpn as admin on windows 7

thanks again :)

[metro2012]

Got it to work finally :) there is just a tiny issue:

i client 1 cant connect to vnc but can connect to ftp (which asks me for a password which is nonexistent)

yet client 2 can connect to vnc but cannot connect to ftp (doesnt ask him for anything just timesout)

[+BudMan MVC]

What?? Please draw up what your trying to do.. This makes now sense

"i took home the client nb1600 and hooked it up perfectly with my home network) but now i cant connect ot the server here at the office (usint its local ip so i dont have to go thru the ientire internet, so to speak) and access it (my site 2, my home)"

No **** you can not connect to your office router using some private ip!! "usint its local ip so i dont have to go thru the ientire internet"

If you boss can not understand a basic drawing showing 2 internet routers - do I need to actually show the vpn connection. Its in the legend on the side.

So are you going to put the ubuntu server at the edge of your network and use it as your internet router? If so then what your wanting to do can be done really simple.

edit: Here does this make more sense to your boss?

If you place the vpn endpoint at the edge of your network. it solves a whole lot of issues!! Now your machines on your network want to talk to 10.0.10.2 they just talk to their normal gateway. your internet router will route the traffic down the vpn to the sites vpn router and then it will route to the network having off its second port. Only route you need to push is your main sites network.

[metro2012]

no no, not my boss. the "tech guy" is the person that doesnt understand the drawing. like i mentioned, it now works using a ubuntu box and the nb1600 at different clients. i can perfectly use a vnc sort of thing on it, it replies pings, etc....

the only thing is that ftp works strange: when its on a local networ, it doesnt ask me for user name or password. when connecting thru the vpn though, it asks me for a username and password (windows ce net that is) i have no idea why cud that be.

thank u for all the help and i hope this doesnt give any problems in the future because this is a test server; now we haev to move it to a REAL server :(

[+BudMan MVC]

And how do you have it setup, you created routes on your machines to the endpoint? Or are you bridging? To be honest I don't think its actually working.

I have not idea what your using for ftp, but yeah you should get prompted no matter what ftp server your using. Never heard of a ftp server that you did not have to auth - are you talking just anonymous access to a ftp? Do you have some network rules on it? Only allow certain IPs?

[metro2012]

And how do you have it setup, you created routes on your machines to the endpoint? Or are you bridging? To be honest I don't think its actually working.

i created the routes when it inputed me for the ccd configuration. entered (well copy pasted) it and now it works :) all routing, no bridging.

I have not idea what your using for ftp, but yeah you should get prompted no matter what ftp server your using. Never heard of a ftp server that you did not have to auth - are you talking just anonymous access to a ftp? Do you have some network rules on it? Only allow certain IPs?

the server is the one included in windows ce net. and yes, the access on the local side was always anonymous (and when usint the talk2m system) no network rules or no certain ips. is there like a default user or something that comes with windows ce net?

[+BudMan MVC]

Could you show me the configs you have on both the server and client.

So you created routes on your 192.168.100.x hosts? You created routes on your internet router?

Sorry but there is NO way for a client on your 192.168.100.x network to get to IPs on the other end without a route to them. Routes you create on the linux or the nb1600 router have nothing to do with what your computers on 192.168.100.x network see or how to get there.

So I am curious where you created these routes. If you don't want to post the configs - please PM.

And could you either post or PM me the traceroute to these clients at your home - which is where I assume you have the vpn router setup?

Could you layout your test network for me.

So from this

http://msdn.microsof...y/ms901071.aspx

Windows CE uses the Windows NT? LAN Manager protocol (RPC_C_AUTHN_WINNT), which is also known as NTLM, to authenticate callers. This is the default authentication service for communications on Windows NT.

From here you setup the userlist in the registry

http://msdn.microsof...y/ms901285.aspx

What are you using to try and ftp to it? Your browser? Your browser is noting to send ntlm if site is not trusted? You might have to put the IP in your trusted sites? Most ftp clients do not send NTLM as auth method.

So how exactly are you accessing this ftp server and I might might be able to help.

[metro2012]

Could you show me the configs you have on both the server and client.

yes, ill pm u when i get to work (9ish) the server and client config.

So from this

http://msdn.microsof...y/ms901071.aspx

Windows CE uses the Windows NT? LAN Manager protocol (RPC_C_AUTHN_WINNT), which is also known as NTLM, to authenticate callers. This is the default authentication service for communications on Windows NT.

From here you setup the userlist in the registry

http://msdn.microsof...y/ms901285.aspx

What are you using to try and ftp to it? Your browser? Your browser is noting to send ntlm if site is not trusted? You might have to put the IP in your trusted sites? Most ftp clients do not send NTLM as auth method.

So how exactly are you accessing this ftp server and I might might be able to help.

i access it via windows explorer

we think the ftp server cud be broken (if thats even possible) because on another (similar machine) via ftp://127.0.0.1, we can access its ftp listing. now, i do that on the machine im trying to access, it keeps loading, meaning it simply does not find it. so for some reason the ftp server isnt correctly.

more problems: at home, i restarted my home network (well my power went out) and it seems that the nb1600 cannot see my public ip anymore. it can see the internet because pinging google works, but it just cant see my public ip. yesterday this happened as well and i restarted the router at my workplace and it worked again. is there a possibility of the routing tables in my router overloading and thus not allowing/understanding more connections? because other than that, it doesnt make too much sense to me....