Recommended Posts

Server:


port 1194
proto udp
dev tun
ca keys/ca/ca.crt
cert keys/ca/svr.crt
key keys/ca/svr.key
dh keys/ca/dh2048.pem
server 10.10.10.0 255.255.255.0
crl-verify keys/ca/crl.pem
ifconfig-pool-persist servers/SVR/logs/ipp.txt
cipher AES-128-CBC
user root
group root
status servers/SVR/logs/openvpn-status.log
log-append servers/SVR/logs/openvpn.log
verb 2
mute 20
max-clients 200
management 127.0.0.1 5574
keepalive 10 120
client-config-dir /etc/openvpn/servers/SVR/ccd
client-to-client
comp-lzo
persist-key
persist-tun
ccd-exclusive
push "route 192.168.2.0 255.255.255.0"

Client:


client
proto udp
dev tun
ca ca.crt
dh dh2048.pem
cert nb1600clientremote.crt
key nb1600clientremote.key
remote 123.456.789.012 1194 //My remote public IP
cipher AES-128-CBC
user root
group root
verb 2
mute 20
keepalive 10 120
comp-lzo
persist-key
persist-tun
float
resolv-retry infinite
nobind

"that the nb1600 cannot see my public ip anymore. it can see the internet because pinging google works,"

What?? That statement is just gibberish..

Do you mean ping your public IP.. Which one your home one or your work one? see means what? The nb1600 connected to your private side of your network would have no reason ever to "see" your home routers public IP? I have no idea what that statement is suppose to mean even. If you mean ping your public IP while on the private side of your router, this is not really something that is common to be able to do - that would be nat reflection or loopback forwarding, etc. not all routers support that. I don't understand what your trying to convey with that statement.

"is there a possibility of the routing tables in my router overloading and thus not allowing/understanding more connections?"

Again -- this make no sense, routing tables don't have anything to do with connections. State table maybe. Are you still talking about your home internet router or your work internet router, or the is it the nb1600 router at work? Or is that a linux box now?

Did you ever actually forward the port your using on your work internet router to the vpn server on your work network?

Whatever you think was working, I don't think it was to be honest.

As to your ftp problem, yeah if you can load your on local address, and that works on another machine then yes I would agree something wrong with the ftp server on that machine.

was away from home....

"that the nb1600 cannot see my public ip anymore. it can see the internet because pinging google works,"

What?? That statement is just gibberish..

Do you mean ping your public IP.. Which one your home one or your work one? see means what? The nb1600 connected to your private side of your network would have no reason ever to "see" your home routers public IP? I have no idea what that statement is suppose to mean even. If you mean ping your public IP while on the private side of our router, this is not really something that is common to be able to do - that would be nat reflection or loopback forwarding, etc. not all routers support that. I don't understand what your trying to convey with that statement.

from the nb1600 at my home network, it cannot ping my workplace's public ip. i can ping google (and others as well).

i restarted the router at my workplace and then the nb1600 could ping my workplace's public ip and thus restored the vpn connection.

"is there a possibility of the routing tables in my router overloading and thus not allowing/understanding more connections?"

Again -- this make no sense, routing tables don't have anything to do with connections. State table maybe. Are you still talking about your home internet router or your work internet router, or the is it the nb1600 router at work? Or is that a linux box now?

Did you ever actually forward the port your using on your work internet router to the vpn server on your work network?

the "routing tales in my router" refer to the ones in my workplaces router. i was talking about the router at my workplace.

like i mentioned, i restarted it (the router at my workplace) and it worked instantly.

and yes, the ports are forward.

we are going to try now to chain (with a switch) things of LAN2 and see if they work (they should, just commenting on it) and also see what is wrong with that ftp server.....

ill comment further things :)

thank u for all the help

And ftp is a complicated protocol - are you using passive or active? Your router prob has a ftp helper that changes the IPs on you ;) It couldn't the internet routers, since your inside an encrypted tunnel. If you are exactly - still not convinced you have the setup actually working the way you think you do.

So your saying you can not even make a control channel connection. This is the first connection on port 21, the data connection is where active or passive come into play. And where the ftp helpers either HELP!! or cause you pain ;)

Here is how ftp works, be it active or passive

http://slacksite.com/other/ftp.html

BTW - what IPs are you giving the clients on the remote end? What is there gateway IP your giving them?

And ftp is a complicated protocol - are you using passive or active?

default on the filezilla server.

Your router prob has a ftp helper that changes the IPs on you ;)

how do i find this out/remove it/fix it/etc?

So your saying you can not even make a control channel connection. This is the first connection on port 21, the data connection is where active or passive come into play. And where the ftp helpers either HELP!! or cause you pain ;)

Here is how ftp works, be it active or passive

http://slacksite.com/other/ftp.html

no. the only thing i can do is a teamviewer lan connection and ping it. nothing else.

BTW - what IPs are you giving the clients on the remote end? What is there gateway IP your giving them?

the gateway (lan2's ip) is 172.16.3.1 ; the clients are 172.16.3.x

Maybe your making connection via teamviwer vs the lan connection you say.

If that was the case and you were connecting via the tunnel then everything would work, at min you would make the control connection side of the ftp session.

Unless you have some firewall blocking ports somewhere in between - but seem odd that TV lan connection would work, since that uses port 5938 by default for lan connections. I just did a sniff of my box trying to connect to a lan IP on my network. And it only sent packets on 5938

post-14624-0-52314100-1341950254_thumb.j

So why would that oddball port be open, but not very common 21?

If you can not make a control port connection, but tv works - for all I know your going through the teamviewer servers to make the connection.

Are you TV to a different IP then what your trying to FTP too? Maybe this IP your trying to ftp too does not have route or default gateway so it can talk to the nb1600 router?

As to ftp being passive or active - that is the client side not the server side. Sure your server could only support 1 mode.. But you choose what mode you want via the client not the server. And this has nothing to do with a simple control connection to 21.

So if you saying you can not make this connection even - then you have a routing issue, or a firewall issue. Routing could be that the remote side does not know how to get back to you. Or could be your never getting there in the first place.

If you say you can ping the the IP that your trying to ftp to - this points to either you pinging something different than the actual device, or something blocking tcp 21, or IP your trying to hit is not even listening on 21, etc.

So you created a route on your work side internet router (192.168.100.100) for this 172.16.3.x/24 network to hit the 192.168.100.7 interface on your vpn router in the office? So I wonder why in your config for server on this page you state your only pushing route

"push "route 192.168.2.0 255.255.255.0"

So your actual VPN client the nb1600 on the remote side how would it route to 192.168.100.x/24?? You don't push the default connectivity.

push "redirect-gateway def1"

This command tells the vpn client to use the vpn connection as its default route.

Nor do you have that setup in the client config from what you posted.

So you have this remote nb1600 as a openvpn client. It gets a 10.10.10.0/24 IP as its vpn IP, and then it has a 172.16.3.0/24 network hanging off its 2nd interface. how do devices on the 172.16.3.0/24 know how to get to the 192.168.100 network at your work side? From your configs you posted I don't see how that is possible at all.

So your remote computer/device on 172.16.3.14 say, knows that its gateway is the 172.16.3.1 interface of the nb1600.. But how does the nb1600 know to route the traffic through the vpn connection? You only pushed a route to 192.168.2.0/24 -- from your configs posted I don't see the commands to tell the remote vpn client to use the vpn connection as its default route. And even if you did. As I have stated before WHY YOU NEED TO UNDERSTAND the remote network this nb1600 is sitting on is maybe its 1st (wan interface) is connected to a 192.168.100.0/24 network -- So sure it can make a connection to your openvpn server. But how its it going to route traffic for clients on its 172.16.3 network through the vpn connection to get to a 192.168.100 network when it has a interface directly connected to that network already - so its just going to route traffic out that interface.

So from your box on the work network, lets see a traceroute to this 172.16.3.x device. And then from the device you say you can TV too on the 172.16.3 network -- lets see a traceroute back to your 192.168.100.x network.

So for example, here at work and using openvpn to my home network.

So my box here is on 10.56.41.89 - to get to box on my home 192.168.1.0/24 network it uses its vpn connection to get to the 192.168.1.0/24

Ethernet adapter ovpn:

Connection-specific DNS Suffix . : local.lan

Description . . . . . . . . . . . : TAP-Win32 Adapter V9

Physical Address. . . . . . . . . : 00-FF-79-1A-85-63

Dhcp Enabled. . . . . . . . . . . : Yes

Autoconfiguration Enabled . . . . : Yes

IP Address. . . . . . . . . . . . : 10.0.200.6

Subnet Mask . . . . . . . . . . . : 255.255.255.252

Default Gateway . . . . . . . . . :

DHCP Server . . . . . . . . . . . : 10.0.200.5

DNS Servers . . . . . . . . . . . : 192.168.1.253

Lease Obtained. . . . . . . . . . : Tuesday, July 10, 2012 10:01:29 AM

Lease Expires . . . . . . . . . . : Wednesday, July 10, 2013 10:01:29 AM

trimmed down route table to show the route to the 192.168.1.0/24 network

Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0       10.56.41.1     10.56.41.89       10
       10.0.200.0    255.255.255.0       10.0.200.5      10.0.200.6       1
       10.0.200.4  255.255.255.252       10.0.200.6      10.0.200.6       30
       10.0.200.6  255.255.255.255        127.0.0.1       127.0.0.1       30
       10.56.41.0    255.255.255.0      10.56.41.89     10.56.41.89       10
      10.56.41.89  255.255.255.255        127.0.0.1       127.0.0.1       10
   10.255.255.255  255.255.255.255       10.0.200.6      10.0.200.6       30
   10.255.255.255  255.255.255.255      10.56.41.89     10.56.41.89       10
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1       1
      192.168.1.0    255.255.255.0       10.0.200.5      10.0.200.6       1

See the last route there -- saying hey to get to 192.168.1.0, use your 10.0.200.6 interface and talk to 10.0.200.5

D:\>tracert 192.168.1.100

Tracing route to i5-w7.local.lan [192.168.1.100]

over a maximum of 30 hops:

1 377 ms 373 ms 369 ms 10.0.200.1

2 370 ms 370 ms 373 ms i5-w7.local.lan [192.168.1.100]

Now I think you might be confused with the 10.0.200.1 address in that trace? That is the IP address of my pfsense router on the 10.0.200.0 network, the .5 is only the endpoint of the vpn tunnel. Once it hits that it gets routed to the interface 10.0.200.1. VPN tunnels can be a bit odd ;) Here for example is off my pfsense router that is running open, showing its interface that has the 10.0.200.1 address

ovpns1: flags=8051<up,pointopoint,running,multicast> metric 0 mtu 1500
        options=80000<linkstate>
        inet6 fe80::250:56ff:fe00:2%ovpns1 prefixlen 64 scopeid 0xb
        inet 10.0.200.1 --> 10.0.200.2 netmask 0xffffffff
        nd6 options=3<performnud,accept_rtadv>
        Opened by PID 15262

Which is actually a pointtopoint to 10.0.200.2 :) Like I said this stuff can be a bit odd.

Now from a box on my 192.168.1.0 network to get back to this 10.56 box

Its not going to work - that side has no route or understanding how to get to a 10.56 network. It would push it out its default route (internet) - which is never going to be able to get to a private 10.56 network.

budman@ubuntu:~$ traceroute 10.56.41.89

traceroute to 10.56.41.89 (10.56.41.89), 30 hops max, 60 byte packets

1 pfsense.local.lan (192.168.1.253) 3.140 ms 2.999 ms 2.950 ms

2 * * *

3 * * *

4 * * *

But it knows how to get to 10.0.200 network.

budman@ubuntu:~$ traceroute 10.0.200.6

traceroute to 10.0.200.6 (10.0.200.6), 30 hops max, 60 byte packets

1 pfsense.local.lan (192.168.1.253) 2.964 ms 2.895 ms 2.790 ms

2 10.0.200.6 (10.0.200.6) 750.272 ms 750.240 ms 750.168 ms

Here is the route table from the pfsense (openvpn server) router at my home site.

Internet:
Destination        Gateway            Flags    Refs      Use  Netif Expire
default            24.13.xx.xx       UGS         0   241811    em1
10.0.200.0/24      10.0.200.2         UGS         0    39238 ovpns1
10.0.200.1         link#11            UHS         0        0    lo0
10.0.200.2         link#11            UH          0        0 ovpns1
24.13.xxx.0/21     link#2             U           0    31340    em1
24.13.xxx.58       link#2             UHS         0        0    lo0
127.0.0.1          link#6             UH          0      256    lo0
192.168.1.0/24     link#1             U           0   230687    em0
192.168.1.253      link#1             UHS         0        0    lo0

There is no route to the 10.56, so if clients that are using this box as it gateway try and go to a 10.56.41 network this router does not know to send it down the vpn connection. So where would it go, it would go down my internet connection which is the default route.

Mine is a much easier setup, but see how there can be routing issues.. My remote side does not know how to get to 10.56.41.x

The setup your trying to do is a very convoluted setup.. But what your trying to do is similar to my 192.168.1.0 home network trying to get to a 10.56.41.0/24 network. Both endpoints of your vpn, server and client are inside private networks behind nat. And then on one side your trying to route to clients on the server side connection on that vpn servers wan interface. And from your posts, your not even aware of the network setup on the remote side, and you don't think you even need too? Which tells me your not understanding these basic routing concepts.

Your going to have problems with this sort of setup, and you really need to understand what the network range your putting the remote side on is, so that you don't run into conflicts.

Not sure how much farther we can go with this, maybe you can readdress what your doing after you have had some time to study for your CCNA? You had mentioned that earlier in the thread.</performnud,accept_rtadv></linkstate></up,pointopoint,running,multicast>

If you can not make a control port connection, but tv works - for all I know your going through the teamviewer servers to make the connection.

this seems unlikely as (to avoid this in any way shape or form) i put the "accept exclusively" option,

Are you TV to a different IP then what your trying to FTP too? Maybe this IP your trying to ftp too does not have route or default gateway so it can talk to the nb1600 router?

if it didnt have the route/default gateway, how could i ping it? the tv thing was stupid and just to try it out, but pinging it?

As to ftp being passive or active - that is the client side not the server side. Sure your server could only support 1 mode.. But you choose what mode you want via the client not the server. And this has nothing to do with a simple control connection to 21.

i ment that u could limit it on the server side rite?? i might have explained it wrong, srry.

i am using a default instalation meaning that it is out of the box which i think uses passive.

So if you saying you can not make this connection even - then you have a routing issue, or a firewall issue. Routing could be that the remote side does not know how to get back to you. Or could be your never getting there in the first place.

no. filezilla (server) says when some ip trys to connect and it doesnt say anything

If you say you can ping the the IP that your trying to ftp to - this points to either you pinging something different than the actual device, or something blocking tcp 21, or IP your trying to hit is not even listening on 21, etc.

i see u refer to tcp 21; openvpn uses udp. nothing to do with this rite?

So you created a route on your work side internet router (192.168.100.100) for this 172.16.3.x/24 network to hit the 192.168.100.7 interface on your vpn router in the office? So I wonder why in your config for server on this page you state your only pushing route

"push "route 192.168.2.0 255.255.255.0"

tis is something i neighter cannot answer (nor can the "tech guy") as it is copy paste.

where did u get "192.168.100.7" from? or is is just some ip u made up on the spot?

So your actual VPN client the nb1600 on the remote side how would it route to 192.168.100.x/24?? You don't push the default connectivity.

push "redirect-gateway def1"

This command tells the vpn client to use the vpn connection as its default route.

Nor do you have that setup in the client config from what you posted.

So you have this remote nb1600 as a openvpn client. It gets a 10.10.10.0/24 IP as its vpn IP, and then it has a 172.16.3.0/24 network hanging off its 2nd interface. how do devices on the 172.16.3.0/24 know how to get to the 192.168.100 network at your work side? From your configs you posted I don't see how that is possible at all.

So your remote computer/device on 172.16.3.14 say, knows that its gateway is the 172.16.3.1 interface of the nb1600.. But how does the nb1600 know to route the traffic through the vpn connection? You only pushed a route to 192.168.2.0/24 -- from your configs posted I don't see the commands to tell the remote vpn client to use the vpn connection as its default route. And even if you did. As I have stated before WHY YOU NEED TO UNDERSTAND the remote network this nb1600 is sitting on is maybe its 1st (wan interface) is connected to a 192.168.100.0/24 network -- So sure it can make a connection to your openvpn server. But how its it going to route traffic for clients on its 172.16.3 network through the vpn connection to get to a 192.168.100 network when it has a interface directly connected to that network already - so its just going to route traffic out that interface.

So from your box on the work network, lets see a traceroute to this 172.16.3.x device. And then from the device you say you can TV too on the 172.16.3 network -- lets see a traceroute back to your 192.168.100.x network.

did u read what i put in the ccd configuration? there is additional routes there specified which may answeer all ur questions (not sure because like i said its simply copy/paste, nothing more)

So for example, here at work and using openvpn to my home network.

So my box here is on 10.56.41.89 - to get to box on my home 192.168.1.0/24 network it uses its vpn connection to get to the 192.168.1.0/24

Ethernet adapter ovpn:

Connection-specific DNS Suffix . : local.lan

Description . . . . . . . . . . . : TAP-Win32 Adapter V9

Physical Address. . . . . . . . . : 00-FF-79-1A-85-63

Dhcp Enabled. . . . . . . . . . . : Yes

Autoconfiguration Enabled . . . . : Yes

IP Address. . . . . . . . . . . . : 10.0.200.6

Subnet Mask . . . . . . . . . . . : 255.255.255.252

Default Gateway . . . . . . . . . :

DHCP Server . . . . . . . . . . . : 10.0.200.5

DNS Servers . . . . . . . . . . . : 192.168.1.253

Lease Obtained. . . . . . . . . . : Tuesday, July 10, 2012 10:01:29 AM

Lease Expires . . . . . . . . . . : Wednesday, July 10, 2013 10:01:29 AM

trimmed down route table to show the route to the 192.168.1.0/24 network

this is also something that has "bothered" me.....on a pc to the openvpn server connection, i cant see usnig ipconfig my private vpn ip (which lets say would be 10.10.10.9). i think it shows blank for both that ip and the default gateway. ill post that tommorow.

Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0       10.56.41.1     10.56.41.89       10
       10.0.200.0    255.255.255.0       10.0.200.5      10.0.200.6       1
       10.0.200.4  255.255.255.252       10.0.200.6      10.0.200.6       30
       10.0.200.6  255.255.255.255        127.0.0.1       127.0.0.1       30
       10.56.41.0    255.255.255.0      10.56.41.89     10.56.41.89       10
      10.56.41.89  255.255.255.255        127.0.0.1       127.0.0.1       10
   10.255.255.255  255.255.255.255       10.0.200.6      10.0.200.6       30
   10.255.255.255  255.255.255.255      10.56.41.89     10.56.41.89       10
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1       1
      192.168.1.0    255.255.255.0       10.0.200.5      10.0.200.6       1

ive always misunderstood/confused routes but i always thought of them as how to get to different networks via what gateways (or routers). i am sorry if i am mistaken.

Now I think you might be confused with the 10.0.200.1 address in that trace? That is the IP address of my pfsense router on the 10.0.200.0 network, the .5 is only the endpoint of the vpn tunnel. Once it hits that it gets routed to the interface 10.0.200.1. VPN tunnels can be a bit odd ;) Here for example is off my pfsense router that is running open, showing its interface that has the 10.0.200.1 address

ovpns1: flags=8051&lt;up,pointopoint,running,multicast&gt; metric 0 mtu 1500
        options=80000&lt;linkstate&gt;
        inet6 fe80::250:56ff:fe00:2%ovpns1 prefixlen 64 scopeid 0xb
        inet 10.0.200.1 --&gt; 10.0.200.2 netmask 0xffffffff
        nd6 options=3&lt;performnud,accept_rtadv&gt;
        Opened by PID 15262

Which is actually a pointtopoint to 10.0.200.2 :) Like I said this stuff can be a bit odd.

its not odd, i call it wanting to take a knife and slice thru your vanes....

The setup your trying to do is a very convoluted setup.. But what your trying to do is similar to my 192.168.1.0 home network trying to get to a 10.56.41.0/24 network. Both endpoints of your vpn, server and client are inside private networks behind nat. And then on one side your trying to route to clients on the server side connection on that vpn servers wan interface. And from your posts, your not even aware of the network setup on the remote side, and you don't think you even need too? Which tells me your not understanding these basic routing concepts.

i understand that the setup im trying to accomplish is very....odd in the sense that usually its a PC to a remote network.

Your going to have problems with this sort of setup, and you really need to understand what the network range your putting the remote side on is, so that you don't run into conflicts.

Not sure how much farther we can go with this, maybe you can readdress what your doing after you have had some time to study for your CCNA? You had mentioned that earlier in the thread.</performnud,accept_rtadv></linkstate></up,pointopoint,running,multicast>

yes, in octuber im going to take a 3 month prepartoy course for the ccna exam.....im obviously not ready at all but i hope the course can clear things up....a lot....

thank u for all ur help. ill reread this again tommorow and post any other information (more so about that 10.10.10.x address not showing up)

OK, here we go.....more information.

my boss took home another (completely different) nb1600 and i preconfigured it for his home network. he plugged it in, simply set the 172.16.3.1 and 172.16.3.x gateway/ip on the machine hooked up to lan2 (another windows ce net machine) and it perfectly worked. the odd thing about it, is that ftp worked too (anon). he was very happy as there was no configuration needed what so ever.

onto other topics: i mentioned that i did not have a 10.10.10.x address. my mistake. ipconfig /all show me.....

this is from my pc:

Adaptador de Ethernet Conexi?n de ?rea local 2:

Sufijo DNS espec?fico para la conexi?n. . :

Descripci?n . . . . . . . . . . . . . . . : TAP-Win32 Adapter V8

Direcci?n f?sica. . . . . . . . . . . . . : **-**-**-**-** (I know its virutal but....)

DHCP habilitado . . . . . . . . . . . . . : s?

Configuraci?n autom?tica habilitada . . . : s?

V?nculo: direcci?n IPv6 local. . . : fe80::b848:4935:d6d8:d78f%23(Preferido)

Direcci?n IPv4. . . . . . . . . . . . . . : 10.10.10.113(Preferido)

M?scara de subred . . . . . . . . . . . . : 255.255.255.252

Concesi?n obtenida. . . . . . . . . . . . : mi?rcoles, 11 de julio de 2012 9:45:58

La concesi?n expira . . . . . . . . . . . : jueves, 11 de julio de 2013 9:45:57

Puerta de enlace predeterminada . . . . . :

Servidor DHCP . . . . . . . . . . . . . . : 10.10.10.114

IAID DHCPv6 . . . . . . . . . . . . . . . : 385941414

DUID de cliente DHCPv6. . . . . . . . . . : **-**-**-**-** (I know its virutal but....)

Servidores DNS. . . . . . . . . . . . . . : fec0:0:0:ffff::1%1

fec0:0:0:ffff::2%1

fec0:0:0:ffff::3%1

NetBIOS sobre TCP/IP. . . . . . . . . . . : habilitado

This is correct.

On to other things, like the routuing issue that was brought up.....

when i make a nb1600 certificate, i put the following lines in where it says "ccd file contents":

ifconfig-push 10.10.10.237 10.10.10.238

iroute 172.16.3.0 255.255.255.0

push "redirect-gateway"

push "dhcp-option DNS 10.10.10.1"

Im going to try to tell u what i THINK each line means.

Line 1: This simply gives a ip in the tunnel. teh tech guy told me that i could only use determined ips such as this:

10.10.10.236 NOT USABLE

10.10.10.237 USABLE

10.10.10.238 USABLE

10.10.10.239 NOT USABLE

10.10.10.240 NOT USABLE

10.10.10.241 USABLE

10.10.10.242 USABLE

10.10.10.243 NOT USABLE

he told me that the first afress in the set (such as 10.10.10.236) were network address (like when u put 10.10.10.0) and the last in the set (such as 10.10.10.239) is a broadcast address (like 10.10.10.255 moving on....

Line 2: This represents the network on LAN2 which i want to see when i connect remotely

Line 3: No idea at all.

Line 4: if the ips on line 1 cannt be assigned it uses this ip to get a ip address from dhcp (i do no thave a dhcp server at that ip)

now this is the setup of a certifcate when im on a pc trying to connect and give support (ccd file contents)

ifconfig-push 10.10.10.113 10.10.10.114

iroute 192.168.0.0 255.255.255.0

push "route 192.168.0.0 255.255.0.0"

push "route 172.16.0.0 255.255.0.0"

Line 1: same as line 1 above

Line 2: the network I AM on

Line 3 and 4: the lans i want to see

(setting that aside for a moment)

ive set up two different nb1600 with the first's lan2 set to 172.16.3.1 and the second's lan2 set to 172.16.2.1 with a submask (both) of 255.255.255.0 in theory they shouldnt see each other.

problem is that they do and this is not wanted. how can i avoid this or limit it? might have to do with the post i said before so.....

The option

client-to-client

is normally used to allow clients to talk to each other. Which you have listed in your config you posted a few posts back.

Have not had chance to read you other posts yet.

The option

client-to-client

is normally used to allow clients to talk to each other. Which you have listed in your config you posted a few posts back.

Have not had chance to read you other posts yet.

ill try to disable that server side and see if i (a admin) can access all of them and the clients cant access each other. thank u.

yup, it was that in the server config "client-to-client" but i just want some to have that ability and not all. the problem is that when i enable that server side, it is enabled for all. the tech support should have access to all but the clients should nto have access to anything. how can i configure this?

If they are at your location, the server side of the vpn - they would have access to all remote connections coming in. Its just the clients to your server can not talk to other clients.

If they are at your location, the server side of the vpn - they would have access to all remote connections coming in. Its just the clients to your server can not talk to other clients.

the thing is that all clients that connect to the openvpn server are just that: clients. i need to seperate them into 2 groups: admins which have access to all and the others which only have access to their subnet (172.16.3.x should not access 172.16.2.x) right now afaik i am only making admin type of accounts. client-to-client enables talking to each other, like i commented it.

how can i limit this??

What???

The computers at the office site are not clients. So your saying people need to connect via vpn -- from where? And connect to all the vpn sites, but you don't want vpn sites to be able to talk to vpn sites?

We have been going at this for almost 8 pages now, for what a couple of weeks - and you have yet to actually give details of WHAT you want. It has been like pulling teeth to get any info.

I post up what I think your talking about, and you say yeah!! Thats its, then 2 post laters - no thats not it, we want X. Then I explain how I understand X, and you say yup thats it. Then you say no its not really X it's Y.

I am not sure if its just language issue or just that you don't really know what you want.

What???

The computers at the office site are not clients. So your saying people need to connect via vpn -- from where? And connect to all the vpn sites, but you don't want vpn sites to be able to talk to vpn sites?

if i connect to the openvpn server at my office, that makes me a client right? i have to connect to that server in order to access the rest....

We have been going at this for almost 8 pages now, for what a couple of weeks - and you have yet to actually give details of WHAT you want. It has been like pulling teeth to get any info.

basically remote support being able to access a common network (which would be a vpn tunnel)

I post up what I think your talking about, and you say yeah!! Thats its, then 2 post laters - no thats not it, we want X. Then I explain how I understand X, and you say yup thats it. Then you say no its not really X it's Y.

i consider it more like pi......yeah its 3.14159 but thats not the value 100%.......... its complicated

I am not sure if its just language issue or just that you don't really know what you want.

im completely sure what i want but it must be a language issue that i cannot express correctly.....

more drawings:

untitlxcvbed.png

network 1 should be able to access 2 3 and 4. the others should not access anyone else except 1

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Wow, Microsoft IS cooking lately... This only shows that they COULD improve, they just chose not to for whatever reasons. That obsession with AI was destroying them from the inside out.
    • BATorrent 4.1.0 by Razvan Serea BATorrent is a lightweight, open-source BitTorrent client built with modern C++ and Qt 6, offering a clean, fast, and privacy-focused alternative to traditional torrent apps. It supports magnet links, .torrent files, resume data, sequential downloading, per-file priorities, and even imports from qBittorrent. Power users benefit from integrated RSS auto-download with regex filtering, duplicate detection, and automatic tracker lists from Stremio. Streaming is seamless thanks to auto-detected players like VLC and IINA. BATorrent includes robust VPN tools—interface binding, auto-detection for WireGuard-based services like Mullvad and NordLynx, kill switch, proxy support, and IP filtering. A full WebUI enables remote control, while integrations with Plex, Jellyfin, and Emby automate library updates. With themes, speed scheduling, system-tray alerts, and cross-platform support for Windows, Linux, and macOS, BATorrent delivers a polished, high-performance torrenting experience. BATorrent features: Core .torrent file and magnet link support Resume data — picks up where you left off after restart Import torrents from qBittorrent Create .torrent files from any file or folder Sequential download mode Per-file priority control (skip, low, normal, high) Seed ratio limits with auto-pause DHT, PEX, UPnP, NAT-PMP RSS Auto-Download Subscribe to RSS feeds — automatically download new torrents as they appear Regex filters — match only what you want (e.g. 1080p|720p, S01E\d+) Per-feed settings — custom save path, check interval (5–1440 min), enable/disable Auto-download — matched items are downloaded automatically in the background Supports magnet links, .torrent URLs, and tags Tray notifications when items are auto-downloaded Duplicate detection — never downloads the same item twice Stremio Stremio Addon System pre-installed — works out of the box Auto tracker list from ngosang/trackerslist Streaming Play while downloading — stream video files before the download is complete Supports mp4, mkv, avi, mov, wmv, flv, webm, m4v, ts Auto-detects installed players (VLC, IINA, system default) VPN & Privacy Interface binding — lock torrent traffic to a specific network interface (e.g. tun0) Auto VPN detection — identifies VPN interfaces (tun, tap, WireGuard, Mullvad, NordLynx, ProtonVPN) Kill switch — automatically pauses all torrents if the VPN interface drops Auto-resume — resumes only the torrents paused by the kill switch when VPN reconnects Proxy support — SOCKS5 and HTTP proxy with optional authentication IP filtering — load P2P blocklists to block unwanted IP ranges Protocol encryption (enabled / forced / disabled) WebUI Remote management — control torrents from any browser at http://localhost:8080 REST API with JSON responses Add torrents via magnet link or .torrent upload Pause, resume, remove torrents remotely View peers and files per torrent Dark theme matching the desktop app HTTP Basic Auth with SHA-256 password hashing Configurable port and remote access (localhost vs 0.0.0.0) Interface 3 themes: Dark, Light, Midnight (bat/vampire aesthetic) Real-time speed graph Detailed panel with tabs: General, Peers, Files, Trackers Filter bar: search by name, filter by state (Active, Downloading, Seeding, Paused, Finished) Drag & drop .torrent files and magnet links Drag & drop reorder in torrent list System tray with notifications (download complete, kill switch events, RSS auto-downloads) Splash screen with bat animation Bilingual: English and Portuguese (BR), auto-detected from system locale Bandwidth Scheduler Alternative speed limits — set different download/upload limits on a schedule Time range — configure active hours (e.g. 01:00 to 07:00), supports overnight ranges Per-day control — choose which days of the week the schedule applies Automatically switches between normal and alternative speeds Media Server Integration Plex — automatically trigger library scan when a download completes Jellyfin / Emby — same automatic library refresh via API Configure server URL and authentication token/key in Settings System Cross-platform: Windows, Linux, macOS Auto-shutdown — automatically shut down PC when all downloads complete (60s cancellable countdown) Auto-update system (AppImage on Linux, installer on Windows, DMG on macOS) CLI arguments: pass .torrent files or magnet: URIs directly Keyboard shortcuts: Space to toggle pause, Ctrl+A to select all, Ctrl+O to open BATorrent 4.1.0 release notes: A community-driven release: everything here came straight from your reports and requests. It closes the remaining gaps with qBittorrent and fixes the Windows settings/tray/splash issues several of you hit. Fixed Settings now actually save. A whole class of preferences — speed limits (and the alternative limits), max active downloads, seed ratio, listen port, max connections, DHT/uTP/encryption, VPN interface, kill switch and proxy — weren't being persisted and reset to defaults on every launch. They now round-trip correctly. (Thanks to everyone who reported "the upload limit always goes back to 0".) Splash and tray toggles stick on Windows. Turning off the startup animation (or "close to tray") no longer reverts — the Windows registry stored these booleans as integers and the UI was misreading them. Close-to-tray hint. The first time the window hides to the tray you get a one-time notification, so the app doesn't look like it vanished (Windows 11 tucks new tray icons into the overflow). macOS Dock icon size. The icon filled its canvas edge-to-edge and rendered larger than neighbouring apps; it now uses the standard safe-area padding. Native file picker language. The "Torrent file / All files" filter in the open dialog follows the app language instead of being hard-coded. Added — qBittorrent parity Alternative speed limits toggle — a turtle button in the toolbar flips your throttled limits on/off instantly, independent of the scheduler. Follow system theme — switch light/dark automatically with the OS (Settings → Appearance). Pre-allocate disk space — reserve the full file size up front to reduce fragmentation (Settings → Downloads). Recheck data on add — optionally force a hash check when adding a torrent, so existing or partial files on disk are detected. Port status indicator — a 🔴 dot in the status bar shows whether your listen port looks reachable (UPnP/NAT-PMP + listen state; fully local, no external check). Add torrent from URL — File → Add torrent from URL (Ctrl+U) fetches a remote .torrent and routes it through the normal add dialog. Export .torrent — right-click a torrent → Export .torrent to save its metadata file. Already there (in case you missed it) Watch folder — auto-add .torrent files dropped into a monitored directory (Settings → Files). This release just surfaces it. Incomplete files already carry a .!bt suffix until they finish. Under the hood Regression tests for the settings-persistence and Windows boolean bugs. A new Qt Quick Test harness covering the startup splash and the design-system widgets. Download: BATorrent 4.1.0 | 37.5 MB (Open Source) Download: BATorrent Portable | 51.7 MB Links: BATorrent Website | Screenshot | Changelog Get alerted to all of our Software updates on Twitter at @NeowinSoftware
    • Disabling open on hover, great! That was so stupid! They need to do a fix, where if a network share is disconnected, it doesn't hang when opening "This PC" for 20 seconds.
    • Microsoft releases major feature updates for stock Windows 11 apps by Taras Buria In addition to releasing new Windows 11 preview builds, Microsoft announced that inbox Windows apps now have dedicated release notes in the official documentation. At long last, users have access to all the release notes for each app, with changes listed in chronological order. Microsoft used to announce feature updates for stock apps with each build. Now, with Windows Insider release notes hosted on the Microsoft Learn website, each app has a dedicated space for its changelog, which is very useful for those who want to track new features and improvements. Alongside that, Microsoft dropped massive feature updates for six stock apps: Clock, Media Player, Calculator, Voice Recorder, Photos, and Paint. Each app packs quite a lot of changes and new capabilities, so here are the release notes. Here are quick notes so that you can jump to the app you are interested in the most: Calculator Camera Clock Media Player Paint Photos Sound Recorder Here is what is new for the Calculator in version 11.2605.9.0: More accurate square-root results — Fixed rare cases where a calculation that should equal zero (like sqrt(2.25) - 1.5) returned a tiny leftover value instead. Readable text in High Contrast themes — Settings text now shows the correct colors in the High Contrast Aquatic and Desert themes. Fixed layout for right-to-left languages — For languages like Arabic and Hebrew, the graph, number pad, equation fields, and scroll buttons now appear correctly oriented. Reliable launch after upgrading — Fixed an issue where upgrading from much older versions could leave outdated settings that stopped the app from opening. Here is what is new for the Camera app (version 2026.2605.7.0): Zoom slider works on more cameras — The zoom slider now works on the latest cameras, respects your system zoom settings, and updates instantly when you change those settings. Full range of zoom levels — Fixed an issue where the zoom slider only showed three steps on some devices that zoom in finer increments. Front camera works on more devices — Resolved a problem that blocked the front-facing camera on certain wide-angle devices. More video resolution choices — You can now pick video resolutions that were previously hidden; the app shows a heads-up warning instead of removing them. QR links you can still use — When a scanned QR code points to something with no matching app, the link is now copied to your clipboard (with a notification) while still offering a Store search. Smarter default settings — When you haven't set a preference, the app now follows your system settings by default. The Clock app has a massive changelog with the following improvements in version 11.2605.9.0: Timers keep counting after they hit zero — When a timer runs out, it now keeps counting up (for example, -00:27:31) so you can see how far past the time you've gone. You can turn off the daily goal — Focus Sessions now include an "Off" option so you can skip setting a daily goal entirely. New 15-minute snooze option — Alarms now offer a 15-minute snooze interval. Run up to 3 countdowns at once — The Countdown Widget now supports three simultaneous countdowns, up from two. Timer Widget notifications now appear — Fixed an issue where the "timer finished" notification didn't show when the timer was started from the widget. Less clutter in Focus Sessions — Tasks you've already completed no longer show up in the Focus Session task list. More accurate focus progress — Fixed a rounding issue that could show your daily focus progress as a minute short (for example, 49 minutes instead of 50). Smoother World Clock comparisons — The World Clock compare page now loads dates as you scroll, so it feels more responsive. Up-to-date World Clock locations — Refreshed country and city names to match their current names. Correct sun and moon icons during midnight sun — Fixed an icon that wrongly showed a moon during all-day daylight in polar regions. Fixed back-button behavior in clock comparisons — Pressing back once now takes you back as expected, instead of jumping the date to 1926. Corrected the Newfoundland time zone — Newfoundland now uses the right time zone (St. John's). Disabled alarms stay looking disabled — Editing a turned-off alarm no longer makes it appear turned on. Cleaner timer cards — The expand button is now turned off on timer cards that have no time set, preventing actions that wouldn't do anything. Clearer theme setting — Updated the wording to "Choose your preferred app theme." Smoother Settings links — The "About" links in Settings no longer trigger an unexpected "switch apps" prompt. Fixed spacing in Spotify settings — Corrected uneven spacing in the Spotify settings card. Better focus visibility in High Contrast — The focus highlight in World Clock is now clearly visible in the High Contrast Aquatic and Desert themes. No more double announcements — Screen readers no longer read the timer value twice. Countdown names read correctly — Screen readers now properly announce the name of each countdown. Keyboard focus stays put — Focus no longer disappears after you press the Timer Reset button. Clearer alarm toggle for screen readers — Tidied up how the alarm on/off switch is announced. The Media Player app received plenty of changes as well (version 11.2605.14.0): Custom captions — You can now personalize how closed captions appear, with caption styling tied to your Windows caption settings, plus a quick link to open those settings directly. "Indexing" banner in the play queue — When your media library is still being scanned, a banner now explains why some items may not appear yet. Fixed the look of selected items — Corrected a layout glitch with selected items in lists. Fewer playback failures — Improved how the app recognizes supported file types, so more files play without issues. Playlists need a name — You can no longer accidentally save a playlist with a blank name. Cleaner look for empty playlists — Improved how a playlist appears when it has no items yet. More stable play queue edits — Fixed a crash that could happen when changing the play queue while the app was switching between sessions. Clearer "missing codec" message — Improved the dialog that appears when a file needs a codec you don't have, with clearer guidance on what to do. A big update is also available for Paint in version 11.2605.61.0: Adjustable eraser transparency — You can now control how transparent the eraser is. Cleaner stamp brush strokes — Fixed visible color shifts and artifacts when using stamp-style brushes. JPEG photos save in place — Opening a rotated JPEG and pressing Save now overwrites the original instead of unexpectedly prompting "Save As." No more crash on bad image files — Opening a damaged or invalid image, from within the app, by double click, or commandline, now shows a clear error message instead of closing the app. Classic selection behavior restored — The selection outline now hides while you move, resize, or rotate a selection, just like in classic Paint. Tidier AI image panel — Fixed missing spacing at the bottom of the AI image generation panel for a cleaner layout. Visible button hover in light theme — Toolbar split buttons now show a clear hover highlight in the light theme. Snappier toolbar — Streamlined how the ribbon lays out, giving a small speed boost at startup. Fewer background crashes — Fixed a crash that could happen while background tasks were finishing up. Stable app shutdown — Prevented rare crashes when closing the app. Fixed layer removal glitch — Deleting the active layer no longer leaves the layers list in an inconsistent state. Here is what is new in the Photos app (version 2026.11060.2004.0): AI watermarking — AI-generated or edited images can now carry a visible Copilot watermark. You choose Never, Always, or Ask Every Time in Settings, with a confirmation when saving. The watermarking is off by default in settings. Better viewing of small images and pixel art — Tiny images (like 16×16 pixel art) now zoom in far more to fill the screen and stay crisp instead of looking blurry. Select scanned text with the keyboard — When text is detected in an image, you can now navigate and select it using the arrow keys, Shift+Arrow, Home/End, and Ctrl+A, with a clear focus highlight. Fixed a crash in text recognition — Resolved a crash that could close Photos while detecting text in images; the app now recovers gracefully. Easier keyboard navigation — Tabbing through the navigation bar no longer stops on hidden controls, so it takes a single Tab to move past it instead of three. And finally, here is the Sound Recorder (version 11.2605.1.0): Waveform shows with Bluetooth mics — The live waveform now displays correctly when you record using a Bluetooth audio device. No more stray scrollbar — A non-working horizontal scrollbar no longer appears at the bottom of the waveform unless you've zoomed in. Mark button ready right away — The Mark button no longer looks grayed out until you hover over it after opening the app. Markers hidden for WAV files — Markers are now turned off for WAV recordings, since that format can't store them — so they're no longer lost silently. Smoother deleting — Quickly pressing Delete and Enter to remove several recordings in a row no longer triggers a "file doesn't exist" error. Fixed a memory issue — Resolved a memory leak that occurred each time a recording started. You can find all these changelogs in the official documentation here.
  • Recent Achievements

    • Very Popular
      AndrewSteel earned a badge
      Very Popular
    • Veteran
      Taliseian went up a rank
      Veteran
    • One Month Later
      Clizby earned a badge
      One Month Later
    • One Month Later
      Timaximus earned a badge
      One Month Later
    • Week One Done
      Timaximus earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      516
    2. 2
      PsYcHoKiLLa
      170
    3. 3
      +Edouard
      162
    4. 4
      Steven P.
      84
    5. 5
      ATLien_0
      78
  • Tell a friend

    Love Neowin? Tell a friend!