Re: [Openvpn-users] ERROR: setrlimit() failed: Operation not permitted (errno=1)

2021-03-20 Thread tincanteksup
TYVM btw On 20/03/2021 16:20, Selva Nair wrote: Hi, If restricting capabilities, I think you will need to add CAP_SYS_RESOURCE to the bounding set in the systemd unit file. We should have probably made this not a FATAL error. Selva On Sat, Mar 20, 2021 at 12:00 PM tincanteksup wrote: It

Re: [Openvpn-users] ERROR: setrlimit() failed: Operation not permitted (errno=1)

2021-03-20 Thread tincanteksup
tincanteksup wrote: It should make no difference but I do not use --user/--group or --chroot ___ Openvpn-users mailing list Openvpn-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openvpn-users

Re: [Openvpn-users] ERROR: setrlimit() failed: Operation not permitted (errno=1)

2021-03-20 Thread tincanteksup
FTR: root@home:/etc/openvpn# /home/tct/openvpn/master/src/openvpn/openvpn --version OpenVPN 2.6_git [git:master/476990d41ad78ac4+] x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Mar 17 2021 library versions: OpenSSL 1.1.1f 31 Mar 2020, LZO 2.10 Originally

Re: [Openvpn-users] ERROR: setrlimit() failed: Operation not permitted (errno=1)

2021-03-20 Thread tincanteksup
Starting from cmd line works, so something about systemd ? ___ Openvpn-users mailing list Openvpn-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openvpn-users

Re: [Openvpn-users] ERROR: setrlimit() failed: Operation not permitted (errno=1)

2021-03-20 Thread tincanteksup
It should make no difference but I do not use --user/--group or --chroot ___ Openvpn-users mailing list Openvpn-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openvpn-users

[Openvpn-users] ERROR: setrlimit() failed: Operation not permitted (errno=1)

2021-03-20 Thread tincanteksup
Hi, --mlock does not seem to work for me.. Same server as below, started without --mlock works normally. Same Server using --mlock fails. Using latest git/master/openvpn: 2021-03-20 15:27:03 us=127228 OpenVPN 2.6_git [git:master/476990d41ad78ac4+] x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO]

Re: [Openvpn-users] Can command line take multi parameter options? openvpn --remote "ip port" fails

2021-03-18 Thread tincanteksup
Try: openvpn --remote "127.0.0.1" --port 10153 On 18/03/2021 23:47, 8187--- via Openvpn-users wrote: Hello, list, This is probably obvious to the rest of you, but I am not able to give openvpn multi parameter options on the command line: sudo openvpn --remote "127.0.0.1 10153" --route "162.

Re: [Openvpn-users] Triple Device/Server Configuration

2021-03-17 Thread tincanteksup
On 17/03/2021 05:31, tincanteksup wrote: On 17/03/2021 05:19, tincanteksup wrote: On 15/03/2021 04:05, Eric Schoeller wrote: Hello, I've been an OpenVPN user for about 15 years, but I am brand new to the mailing list. I am building a redundant monitoring system (naemon+merlin)

Re: [Openvpn-users] Triple Device/Server Configuration

2021-03-16 Thread tincanteksup
On 17/03/2021 05:19, tincanteksup wrote: On 15/03/2021 04:05, Eric Schoeller wrote: Hello, I've been an OpenVPN user for about 15 years, but I am brand new to the mailing list. I am building a redundant monitoring system (naemon+merlin) and I would like to establish a means to co

Re: [Openvpn-users] Triple Device/Server Configuration

2021-03-16 Thread tincanteksup
On 15/03/2021 04:05, Eric Schoeller wrote: Hello, I've been an OpenVPN user for about 15 years, but I am brand new to the mailing list. I am building a redundant monitoring system (naemon+merlin) and I would like to establish a means to connect three distributed monitoring machines over

[Openvpn-users] Easy-TLS Update

2021-03-12 Thread tincanteksup
Hi, on the slim chance that anybody here is interested in such things.. Today I confirmed that not only does Easy-TLS fully work in Windows but also, all the server side scripts function exactly as intended. This even includes "hardware-lockdown" for clients. * Note: I know it is not real hardw

Re: [Openvpn-users] mssfix set to zero

2021-03-11 Thread tincanteksup
On 11/03/2021 16:35, Marc SCHAEFER wrote: On Thu, Mar 11, 2021 at 03:25:25PM +, tincanteksup wrote: I was expecting that openvpn configure MSS at the IP level so that only the kernel manages that side of the packet creation. What would happen if the OpenVPN client is actually a router

Re: [Openvpn-users] mssfix set to zero

2021-03-11 Thread tincanteksup
Hi, On 11/03/2021 13:54, Gert Doering wrote: Hi, On Thu, Mar 11, 2021 at 11:12:27AM +, tincanteksup wrote: Win7 ovpn 2.5 SYN sent - MSS 1460 Linux 5.4.0-66-generic #74-Ubuntu ovpn git-master SYN received - MSS 1358 Still have to test --ncp-disable "SYN SENT" is "when th

Re: [Openvpn-users] mssfix set to zero

2021-03-11 Thread tincanteksup
On 11/03/2021 11:12, tincanteksup wrote: On 11/03/2021 03:05, tincanteksup wrote: On 11/03/2021 02:58, tincanteksup wrote: Hi, On 11/03/2021 01:41, Jan Just Keijser wrote: Hi, On 11/03/21 00:16, tincanteksup wrote: On 09/03/2021 15:48, Gert Doering wrote: Hi, On Tue, Mar 09, 2021

Re: [Openvpn-users] mssfix set to zero

2021-03-11 Thread tincanteksup
On 11/03/2021 03:05, tincanteksup wrote: On 11/03/2021 02:58, tincanteksup wrote: Hi, On 11/03/2021 01:41, Jan Just Keijser wrote: Hi, On 11/03/21 00:16, tincanteksup wrote: On 09/03/2021 15:48, Gert Doering wrote: Hi, On Tue, Mar 09, 2021 at 03:33:56PM +, tincanteksup wrote

Re: [Openvpn-users] mssfix set to zero

2021-03-10 Thread tincanteksup
On 11/03/2021 02:58, tincanteksup wrote: Hi, On 11/03/2021 01:41, Jan Just Keijser wrote: Hi, On 11/03/21 00:16, tincanteksup wrote: On 09/03/2021 15:48, Gert Doering wrote: Hi, On Tue, Mar 09, 2021 at 03:33:56PM +, tincanteksup wrote: what is the final effect of using `--mssfix 0

Re: [Openvpn-users] mssfix set to zero

2021-03-10 Thread tincanteksup
Hi, On 11/03/2021 01:41, Jan Just Keijser wrote: Hi, On 11/03/21 00:16, tincanteksup wrote: On 09/03/2021 15:48, Gert Doering wrote: Hi, On Tue, Mar 09, 2021 at 03:33:56PM +, tincanteksup wrote: what is the final effect of using `--mssfix 0` in a client config ? What I mean is, how

Re: [Openvpn-users] mssfix set to zero

2021-03-10 Thread tincanteksup
On 09/03/2021 15:48, Gert Doering wrote: Hi, On Tue, Mar 09, 2021 at 03:33:56PM +, tincanteksup wrote: what is the final effect of using `--mssfix 0` in a client config ? What I mean is, how would openvpn interpret this and what would it tell the TCP stack ? I don't need to know

Re: [Openvpn-users] Fragment

2021-03-09 Thread tincanteksup
Eh-up Chuck! On 09/03/2021 19:03, Gert Doering wrote: Hi, On Tue, Mar 09, 2021 at 07:55:11PM +0100, David Sommerseth wrote: What I suspect Gert meant was that you can add it in the client config on the clients - and each client config may have different --mssfix values. Actually I thought yo

Re: [Openvpn-users] Fragment

2021-03-09 Thread tincanteksup
Hi, On 05/03/2021 18:43, Gert Doering wrote: Hi, On Fri, Mar 05, 2021 at 06:20:54PM +, tincanteksup wrote: All other clients behave normally but they do not use --fragment or --mssfix. It should be, but I'm not sure if --fragment can be set on a per-client basis (yet)... --mssfi

Re: [Openvpn-users] mssfix set to zero

2021-03-09 Thread tincanteksup
Thanks Gert, interesting ways indeed ! On 09/03/2021 15:48, Gert Doering wrote: Hi, On Tue, Mar 09, 2021 at 03:33:56PM +, tincanteksup wrote: what is the final effect of using `--mssfix 0` in a client config ? What I mean is, how would openvpn interpret this and what would it tell the

[Openvpn-users] mssfix set to zero

2021-03-09 Thread tincanteksup
Hi, what is the final effect of using `--mssfix 0` in a client config ? What I mean is, how would openvpn interpret this and what would it tell the TCP stack ? I don't need to know about MSS, I just want to know what openvpn would do with a setting of 0. Also, would openvpn behave differently

Re: [Openvpn-users] Fragment

2021-03-05 Thread tincanteksup
On 05/03/2021 18:58, Gert Doering wrote: Hi, On Fri, Mar 05, 2021 at 06:52:39PM +, tincanteksup wrote: I do not require help with my network, I only want to know what the current situation is regarding --fragment. Is it no longer supported for Windows ? --fragment is totally OS

Re: [Openvpn-users] Fragment

2021-03-05 Thread tincanteksup
Hi, On 05/03/2021 18:43, Gert Doering wrote: Hi, On Fri, Mar 05, 2021 at 06:20:54PM +, tincanteksup wrote: All other clients behave normally but they do not use --fragment or --mssfix. It should be, but I'm not sure if --fragment can be set on a per-client basis (yet)... --mssfi

[Openvpn-users] Fragment

2021-03-05 Thread tincanteksup
Hi, I am trying to use --fragment and --mssfix to resolve a network problem. However, when I do I get this in the log: Client: FRAG_IN error flags=0xfa2a187b: FRAG_TEST not implemented Openvpn: 2.5.1 W32bit using TAP Adapter in --dev tun mode. Server: Bad compression stub decompression header

Re: [Openvpn-users] Windows ovpn server DHCP

2021-03-04 Thread tincanteksup
On 02/03/2021 19:21, tincanteksup wrote: On 02/03/2021 19:18, tincanteksup wrote: Ok, it seems i misunderstood the problem, so I'll start over. See this forum thread for full details: https://forums.openvpn.net/viewtopic.php?f=6&t=31945#p98073 But in summary: My first mistak

Re: [Openvpn-users] Windows ovpn server DHCP

2021-03-02 Thread tincanteksup
On 02/03/2021 19:18, tincanteksup wrote: Ok, it seems i misunderstood the problem, so I'll start over. See this forum thread for full details: https://forums.openvpn.net/viewtopic.php?f=6&t=31945#p98073 But in summary: My first mistake was not understanding the use of AF_INE

Re: [Openvpn-users] Windows ovpn server DHCP

2021-03-02 Thread tincanteksup
Ok, it seems i misunderstood the problem, so I'll start over. See this forum thread for full details: https://forums.openvpn.net/viewtopic.php?f=6&t=31945#p98073 But in summary: My first mistake was not understanding the use of AF_INET6. I now understand that AF_INET6 will/does work for IPv4 a

Re: [Openvpn-users] Windows ovpn server DHCP

2021-03-01 Thread tincanteksup
On 28/02/2021 21:13, Gert Doering wrote: Hi, On Sun, Feb 28, 2021 at 08:02:54PM +, tincanteksup wrote: Clearly, this is no longer the place to ask. thanks . Ask, always. Claim "this is a bug", only if you can back this by more than &qu

Re: [Openvpn-users] Windows ovpn server DHCP

2021-02-28 Thread tincanteksup
Clearly, this is no longer the place to ask. thanks . On 28/02/2021 19:45, Gert Doering wrote: Hi, On Sun, Feb 28, 2021 at 07:02:22PM +, tincanteksup wrote: The reason for working on this is: This server is obviously using IPv4 (D-GW: 192.168.0.254

Re: [Openvpn-users] Windows ovpn server DHCP

2021-02-28 Thread tincanteksup
The reason for working on this is: This server is obviously using IPv4 (D-GW: 192.168.0.254) and yet Openvpn decided: Could not determine IPv4/IPv6 protocol. Using AF_INET6 That looks like a *bug* to me. On 28/02/2021 17:09, tincanteksup wrote: Thanks Selva, as it turns out, I think this

Re: [Openvpn-users] Windows ovpn server DHCP

2021-02-28 Thread tincanteksup
asked the OP for his server config. Any other ideas Anyone ? Thanks. R On 28/02/2021 16:18, Selva Nair wrote: Hi, On Sun, Feb 28, 2021 at 9:51 AM tincanteksup wrote: Hi, Ref: https://forums.openvpn.net/viewtopic.php?f=6&t=31928 I recall that there is some `netsh` setting that can effect

[Openvpn-users] Windows ovpn server DHCP

2021-02-28 Thread tincanteksup
Hi, Ref: https://forums.openvpn.net/viewtopic.php?f=6&t=31928 I recall that there is some `netsh` setting that can effect DHCP working but I cannot remember what it is or where it was documented. I believe it is something to do with a `persistent` setting .. Does anybody know and can remind

Re: [Openvpn-users] TCP syn]

2021-02-25 Thread tincanteksup
On 25/02/2021 17:02, David Sommerseth wrote: On 25/02/2021 17:56, tincanteksup wrote: How about ... On 25/02/2021 01:03, tincanteksup wrote: Keeping up with the internet is hard: https://squeeze.isobar.com/2019/04/11/the-sad-story-of-tcp-fast-open/ I guess the bottom line is: Use UDP, if

Re: [Openvpn-users] TCP syn]

2021-02-25 Thread tincanteksup
dang! On 25/02/2021 16:56, tincanteksup wrote: How about ... On 25/02/2021 01:03, tincanteksup wrote: Keeping up with the internet is hard: https://squeeze.isobar.com/2019/04/11/the-sad-story-of-tcp-fast-open/ I guess the bottom line is: Use UDP, if you are worried about TCP SYN to your

Re: [Openvpn-users] TCP syn]

2021-02-25 Thread tincanteksup
How about ... On 25/02/2021 01:03, tincanteksup wrote: Keeping up with the internet is hard: https://squeeze.isobar.com/2019/04/11/the-sad-story-of-tcp-fast-open/ I guess the bottom line is: Use UDP, if you are worried about TCP SYN to your server. Instead of UDP.. Use --port-share and

Re: [Openvpn-users] TCP syn]

2021-02-24 Thread tincanteksup
Keeping up with the internet is hard: https://squeeze.isobar.com/2019/04/11/the-sad-story-of-tcp-fast-open/ I guess the bottom line is: Use UDP, if you are worried about TCP SYN to your server. ___ Openvpn-users mailing list Openvpn-users@lists.sour

Re: [Openvpn-users] TCP syn]

2021-02-24 Thread tincanteksup
On 24/02/2021 22:30, David Sommerseth wrote: TFO has a bigger advantage in short-lived TCP sessions (like web browsers) where you open several independent TCP connections to fetch data in parallel and then close them down.  Here TFO will have an edge. Agreed. Now you might argue about the

Re: [Openvpn-users] TCP syn]

2021-02-24 Thread tincanteksup
On 24/02/2021 21:28, tincanteksup wrote: On 24/02/2021 20:05, Marc SCHAEFER wrote: On Wed, Feb 24, 2021 at 07:27:09PM +, tincanteksup wrote: I wonder if IPv6 has any new features which can customise the initial Syn packet in any way ? Not to my knowledge. Why would you want to do

Re: [Openvpn-users] TCP syn]

2021-02-24 Thread tincanteksup
On 24/02/2021 20:05, Marc SCHAEFER wrote: On Wed, Feb 24, 2021 at 07:27:09PM +, tincanteksup wrote: which suggested to me that openvpn may have some vulnerability to TCP DDos. A Linux kernel can offer a few protections against DDoS, for example SYN cookies to avoid a memory exhaustion

Re: [Openvpn-users] TCP syn

2021-02-24 Thread tincanteksup
Yep .. got it now, thanks! On 24/02/2021 19:39, Gert Doering wrote: Hi, On Wed, Feb 24, 2021 at 06:01:19PM +, tincanteksup wrote: today I discovered that a server using TCP responds to an initial Syn packet with an ack packet, even with --tls-auth key configured. I presume this is

Re: [Openvpn-users] TCP syn

2021-02-24 Thread tincanteksup
24, 2021 at 06:01:19PM +, tincanteksup wrote: today I discovered that a server using TCP responds to an initial Syn packet with an ack packet, This is standard TCP protocol (SYN, SYN ACK, ACK). It is executed in the kernel. Only after the client ACK is received by the server will OpenVPN

[Openvpn-users] TCP syn

2021-02-24 Thread tincanteksup
Hi, today I discovered that a server using TCP responds to an initial Syn packet with an ack packet, even with --tls-auth key configured. I presume this is expected and cannot be avoided when using TCP due to initial IP requirements ? Thanks R

[Openvpn-users] Rare Windows 10 openvpn server problem

2021-02-21 Thread tincanteksup
Hi, I am posting this here as an object of curiosity. Summary: Windows 10 server freezes for several seconds when specific clients connect. The OP claims he can reproduce this on another W10 m/c. Error at that time: MULTI: Outgoing TUN queue full On a Linux server, the same behaviour cannot

Re: [Openvpn-users] [Openvpn-devel] [Openvpn-devel/users] Debugging Windows based server scripts

2021-02-18 Thread tincanteksup
On 18/02/2021 19:13, Selva Nair wrote: Hi, On Wed, Feb 17, 2021 at 5:38 PM tincanteksup wrote: Hi, due to not being allowed to have scripts "echo data" to the log file under Windows, debugging scripts is next to impossible. I presume there are no compile time options to en

[Openvpn-users] [Openvpn-devel/users] Debugging Windows based server scripts

2021-02-17 Thread tincanteksup
Hi, due to not being allowed to have scripts "echo data" to the log file under Windows, debugging scripts is next to impossible. I presume there are no compile time options to enable "echo" under Windows ? Could anybody provide me with a patch to enable "echo" just for the purpose of debuggi

Re: [Openvpn-users] Easy-TLS

2021-02-16 Thread tincanteksup
If you decide to take a look then the best place to start is with the inter-active menus. Simply download 'easytls' to your current Easy-RSA directory and you are ready to start. Usage is: ./easytls init-tls ./easytls build ./easytls inline ./easytls remove Also download the OpenVPN Server s

[Openvpn-users] Easy-TLS

2021-02-16 Thread tincanteksup
Hi, I have written Easy-TLS (based on Easy-RSA) to help with creating and managing TLS-keys and OpenVPN Inline files, including X509 certificates and keys. Easy-TLS also takes huge advantage of the power of TLS-Crypt-V2 keys which were introduced in OpenVPN v2.5 Easy-TLS also has inter-act

Re: [Openvpn-users] Transport Error: socket_protect error (UDP)

2020-12-29 Thread tincanteksup
Hi lev, that explains it on the level which I need and understand. This has actually come up before but in a different way: On a PC using `--redirect-gateway def1` the host route to the server is added in order that VPN packets are not routed back into the tunnel but sent directly to the serv

Re: [Openvpn-users] Transport Error: socket_protect error (UDP)

2020-12-29 Thread tincanteksup
protection ? Thanks. On 29/12/2020 13:30, Lev Stipakov wrote: The product seems to be OpenVPN Connect, which is a proprietary software by OpenVPN Inc and not a community project. I replied and suggested contacting OpenVPN Connect support. ma 28. jouluk. 2020 klo 17.43 tincanteksup (tincantek...

[Openvpn-users] Transport Error: socket_protect error (UDP)

2020-12-28 Thread tincanteksup
Hi, Ref: https://forums.openvpn.net/viewtopic.php?f=6&t=31190 Here is the log from the client side software: {{{ Transport error: socket_protect error }}} At first I thought this would be something from Windows but after digging a little deeper I found: https://github.com/OpenVPN/openvpn3/blo

Re: [Openvpn-users] Windows GUI user/pass time out

2020-12-24 Thread tincanteksup
nd password are available." as the timeout = zero thingy is a matter of implementation which could change in future. And, my name is out of place in here.. -- Selva On Thu, Dec 24, 2020 at 3:20 PM tincanteksup wrote: On 24/12/2020 19:43, Selva Nair wrote: Hi, On Thu, Dec 24, 2020 at

Re: [Openvpn-users] Windows GUI user/pass time out

2020-12-24 Thread tincanteksup
On 24/12/2020 19:43, Selva Nair wrote: Hi, On Thu, Dec 24, 2020 at 1:10 PM tincanteksup wrote: Hi, there is a forum thread: https://forums.openvpn.net/viewtopic.php?f=6&t=31529#p96550 Which wants to know if the "enter user/pass timeout" can be configured. The way it work

[Openvpn-users] Windows GUI user/pass time out

2020-12-24 Thread tincanteksup
Hi, there is a forum thread: https://forums.openvpn.net/viewtopic.php?f=6&t=31529#p96550 Which wants to know if the "enter user/pass timeout" can be configured. I do not know if there is one or if it can be configured. https://github.com/OpenVPN/openvpn-gui has no info on this. Can anybody he

Re: [Openvpn-users] ALL iOS traffic goes through tunnel?

2020-08-25 Thread tincanteksup
Hi, On 25/08/2020 17:19, Aarti Anand wrote: Hi OpenVPN users, I am curious if any of you has tried OpenVPN on an iOS device and have seen ALL the traffic go through the VPN tunnel? If you mean: "has anybody on this list ever tunnelled all their traffic?" then please see: h

Re: [Openvpn-users] Facetime bypassing the tunnel

2020-08-05 Thread tincanteksup
That is hard to find even by my severe standards.. On 05/08/2020 23:01, Selva Nair wrote: Hi, I think it's a known "feature" that some apple services including facetime bypasses the VPN tunnel. See the link below which is for the connect client, but the community version should behave the same

Re: [Openvpn-users] On Access policies

2020-07-30 Thread tincanteksup
Use your imagination .. Routing is a path to a goal .. there are many paths. On 31/07/2020 01:44, Joe Patterson wrote: That's only works as far as you trust your users not to violate policy (which, generally speaking, you shouldn't). There's nothing stopping them from adding "route" statements

Re: [Openvpn-users] OpenVPN frequent renegociation and sometimes downtime

2020-07-24 Thread tincanteksup
Hi Marc, not sure how you have your configs setup (maybe post further details) but .. Using --verb 4 may help with extra log details. Regards. On 24/07/2020 22:20, Marc SCHAEFER wrote: Hello, I have an OpenVPN server on a fixed IP address, using the CA mode. I have 3 clients, two on dynamic

Re: [Openvpn-users] peer-peer vpns and systemd

2020-07-19 Thread tincanteksup
What is the effect of setting --nobind in the systemd unit file and then --lport/--rport in the config ? Does --keepalive work in p2p mode ? On 19/07/2020 06:09, Richard Hector wrote: Hi all, I have 4 machines (actually VPSes) that have a full mesh of VPNs between them. I'm using a slightly

Re: [Openvpn-users] peer-peer vpns and systemd

2020-07-19 Thread tincanteksup
Try removing these settings: > user nobody > group nogroup > persist-key > persist-tun If you study your logs you will probably notice their effects. On 19/07/2020 06:09, Richard Hector wrote: Hi all, I have 4 machines (actually VPSes) that have a full mesh of VPNs between them. I'm using a

Re: [Openvpn-users] OpenVPN issues with Windows NLA

2020-07-03 Thread tincanteksup
Thanks .. this appears clarify my mis-understanding. On 03/07/2020 08:46, Marc SCHAEFER wrote: On Fri, Jul 03, 2020 at 01:20:09AM +0100, tincanteksup wrote: DNSSec would put an end to this sort of snooping .. lol As Gert said, no, it won't. What you may want is DNS over HTTPS or ove

Re: [Openvpn-users] OpenVPN issues with Windows NLA

2020-07-03 Thread tincanteksup
Thanks .. it would seem that I have been mis-informed about this for quite some time .. Today I learnt something ! On 03/07/2020 07:13, Gert Doering wrote: Hi, On Fri, Jul 03, 2020 at 01:20:09AM +0100, tincanteksup wrote: DNSSec would put an end to this sort of snooping .. lol Actually

Re: [Openvpn-users] OpenVPN issues with Windows NLA

2020-07-02 Thread tincanteksup
On 03/07/2020 00:12, Marco De Vitis wrote: Il 02/07/20 19:54, Selva Nair ha scritto:  1. The DNS of my LAN (i.e. my home router's IP) has been set as     default gateway for the OpenVPN interface. But I'll need to     remember changing it if I connect from elsewhere. That looks like a strang

Re: [Openvpn-users] OpenVPN issues with Windows NLA

2020-07-01 Thread tincanteksup
Hi, On 01/07/2020 19:03, Marco De Vitis wrote: Il 01/07/20 18:43, tincanteksup ha scritto: This is the reason as explained by Micro https://forums.openvpn.net/viewtopic.php?f=1&t=27321 Thanks, I already found many descriptions of the reason for this issue, it really looks the same i

Re: [Openvpn-users] OpenVPN issues with Windows NLA

2020-07-01 Thread tincanteksup
This is the reason as explained by Micro https://forums.openvpn.net/viewtopic.php?f=1&t=27321 On 01/07/2020 17:36, Selva Nair wrote: Hi On Wed, Jul 1, 2020 at 11:21 AM Marco De Vitis wrote: Hi, I use OpenVPN client 2.4.9 on Windows 10 (v2004), and I have issues with the Network Locat

Re: [Openvpn-users] disable "auth-nocache" by push?

2020-05-06 Thread tincanteksup
On 04/05/2020 14:37, tincanteksup wrote: Hi, On 04/05/2020 14:06, Jan Just Keijser wrote: Hi, On 04/05/20 14:49, Dajka Tamás wrote: Hi, Secondly, is it allowed/possible to set „reneg-sec” by a PUSH message? (reneg-sec is not set currently in the client.conf, has the default value

Re: [Openvpn-users] disable "auth-nocache" by push?

2020-05-04 Thread tincanteksup
Hi, On 04/05/2020 14:06, Jan Just Keijser wrote: Hi, On 04/05/20 14:49, Dajka Tamás wrote: Hi, is it possible to disable „auth-nocache” in the client by a PUSH message? I mean, if the „auth-nocache” is SET in the client.conf to „reenable” credentials caching. What’s the logic behind? When

Re: [Openvpn-users] Openvpn static key

2020-05-04 Thread tincanteksup
Hi, On 04/05/2020 01:00, Brandon Helsley via Openvpn-users wrote: I started with the configuration file and got to encryption and found the server and client configuration file examples but got stuck at static key and what exactly to do with server and client configuration files. If you ha

Re: [Openvpn-users] Possibility to soft-reject clients in connection-phase

2020-05-01 Thread tincanteksup
It is probably too late for you now but simply adding more 'remote ' lines in the client config would probably suffice for what you need. On 01/05/2020 12:38, Frömmel, Christian wrote: Hi, we are currently running three OpenVPN-Gateways for all the remote-workers in our company. As the n

Re: [Openvpn-users] Checking OpenVPN connectivity

2020-04-28 Thread tincanteksup
Hi, On 29/04/2020 02:26, Erich Titl wrote: Hi Am 29.04.2020 um 00:45 schrieb Leroy Tennison via Openvpn-users: The reason I ask is that an existing 1024 bit connection is being replaced by a 4096 bit one and I would prefer to know that the firewall configuration (over which I have no visib

Re: [Openvpn-users] crl-verify [SOLVED]

2020-04-16 Thread tincanteksup
me to the hex name", and even though, intellectually, I know that the chance of a collision between hex and dec names in that large a space would be infinitesimal, it still manages to really bother me that it *could* happen. On Thu, Apr 16, 2020 at 3:16 PM tincanteksup wrote: Hi, On 16/04/

Re: [Openvpn-users] crl-verify [SOLVED]

2020-04-16 Thread tincanteksup
Hi, On 16/04/2020 19:52, richard lucassen wrote: On Thu, 16 Apr 2020 12:02:17 +0200 richard lucassen wrote: Yeah right: cd /etc/openvpn/crl/tun0/ mv 0B 11 Now it works. The serial number must be decimal. Which is even more 'fun' with randomised serial numbers, eg: 94:68:4a:17:db:99:a7:36

[Openvpn-users] EasyTLS

2020-04-14 Thread tincanteksup
Greetings. EasyTLS is a utility to help manage: * EasyRSA x509 security credentials * OpenVPN specific TLS keys * Verified Inline files combining the data above Also included is a sample --tls-crypt-v2-verify script This script is designed to work with the default tls-crypt-v2 keys 'metadata'

Re: [Openvpn-users] First time set up using openvpn

2020-04-04 Thread tincanteksup
That's not a top-post but this is. And for throwing catb be at me take this: http://catb.org/~esr/faqs/smart-questions.html On 04/04/2020 03:47, The Doctor wrote: On Sat, Apr 04, 2020 at 01:59:43AM +0100, tincanteksup wrote: Hi Doctor, HMAC indicates that your --tls-auth setting

Re: [Openvpn-users] First time set up using openvpn

2020-04-03 Thread tincanteksup
Hi Doctor, HMAC indicates that your --tls-auth settings are incorrect. I point out the fault below. Shameless plug: https://github.com/TinCanTech/easy-tls/wiki FTR: "# This file is secret" could be better explained as "# This file is shared secret" HTH tct On 04/04/2020 00:30, The Docto

Re: [Openvpn-users] Openvpn 2.4.8 on Windows 10: TAP32 Adapter seems to be fubared

2020-04-02 Thread tincanteksup
On 02/04/2020 06:47, Samuli Seppänen wrote: Hi, I looked at Ralf's logs and they show that - for whatever reason - the tap-windows installer chose to install the Windows 7 version of tap-windows6 on those Windows 10 instances. The Digital signer in the device properties should show "Mic

Re: [Openvpn-users] Client-Disconnect Script Does Not Work Properly

2020-03-27 Thread tincanteksup
Use: push "explicit-exit-notify 3" On 27/03/2020 12:58, Vertigo Altair wrote: Hi, I want to store some info about past sessions and I run a client-disconnect script.However, when I make tests I realized my script does not run when I disconnect from VPN.When I login again, firstly client-disconn

Re: [Openvpn-users] Problems getting client-connect script to run

2020-01-01 Thread tincanteksup
On 28/12/19 09:09, Leroy Tennison via Openvpn-users wrote: Running OpenVPN 2.3.10 on Ubuntu 16.04 2.3.10 is dated May 2016 .. ___ Openvpn-users mailing list Openvpn-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/

Re: [Openvpn-users] Is it a static key instead of ephemeral key?

2019-11-14 Thread tincanteksup
To Thomas, take a look at easrsa-3, you may find it helpful also. https://github.com/OpenVPN/easy-rsa/releases more than rsa by the way .. ___ Openvpn-users mailing list Openvpn-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinf

Re: [Openvpn-users] Segmentation fault upon client connect

2019-07-22 Thread tincanteksup
Hi, I don't have a Tunnelblick client to test with but generally I do have a CentOS7 VM server and it works normally. I notice that you are probably building openvpn yourself so make sure you are building with ./configure --enable-systemd For further troubleshooting, using a higher --verb may b

Re: [Openvpn-users] [Openvpn-devel] [PATCH] Improve the documentation for --dhcp-option

2019-03-30 Thread tincanteksup
On 20/03/2019 14:57, tincanteksup wrote: Moving to users .. On 20/03/2019 14:52, tincanteksup wrote: On 20/03/2019 13:25, Selva Nair wrote: Hi, On Wed, Mar 20, 2019 at 4:02 AM Antonio Quartulli wrote: Hi, On 18/03/2019 22:30, tincanteksup wrote: Hi, this situation has been hanging

Re: [Openvpn-users] [Openvpn-devel] [PATCH] Improve the documentation for --dhcp-option

2019-03-20 Thread tincanteksup
Moving to users .. On 20/03/2019 14:52, tincanteksup wrote: On 20/03/2019 13:25, Selva Nair wrote: Hi, On Wed, Mar 20, 2019 at 4:02 AM Antonio Quartulli wrote: Hi, On 18/03/2019 22:30, tincanteksup wrote: Hi, this situation has been hanging around for so long is this brief note really

Re: [Openvpn-users] generate crl with easyrsa v2.2

2019-03-12 Thread tincanteksup
Hi, because you state that you have only three clients to maintain I would recommend you you update your EasyRSA to version 3: https://github.com/OpenVPN/easy-rsa/releases A lot of work has gone into this, including new recommended security settings and other functionality. There is no specific

Re: [Openvpn-users] OpenVPN client on CentOS7 does not care about dhcp-option DNS

2019-03-07 Thread tincanteksup
On 07/03/2019 14:52, Jan Just Keijser wrote: Hi, On 07/03/19 14:38, Lars Schotte wrote: Hi folks, I have encountered a problem with OpenVPN on CentOS 7 in client mode, where he obviously receives push options, but does not care about them later. Here is a small excerpt of the log (set to ver

Re: [Openvpn-users] Disable automatic startup of OpenVPN 2.4.6 on Windows

2019-01-23 Thread tincanteksup
Hi, the GUI "Launch on Windows startup" works for me, W7 Enterprise 32bit. (Disable it, reboot; no GUI : Enable it, reboot; GUI started) This is the reg key used to start it: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Perhaps you have a shortcut in startup folder as well ?

Re: [Openvpn-users] iphone7 with keynote

2018-09-25 Thread tincanteksup
Your question is vague .. If you are using your phone to connect over "rogers" to your work then you will probably need to talk to the admin of the server at work. If you are using your phone to connect over "rogers" to your home then you may also have to change the server settings there. There