Re: [qubes-users] Qubes: Unable to connect to VPN

2019-06-12 Thread Chris Laprise

On 6/12/19 10:14 AM, 'Crypto Carabao Group' via qubes-users wrote:
We've also been trying for days to get a VPN to  resolve on a brand new 
R4.0 install, to either one of 2 different VPN providers, using the 
iptables and cli scripts:

https://www.qubes-os.org/doc/vpn/#set-up-a-proxyvm-as-a-vpn-gateway-using-iptables-and-cli-scripts
I've also set it up before on a 3.x cubes and it worked using the above.
So far, what's pretty certain is that these instructions were carried 
over automatically, but actually don't work for the R4.0 version.


BTW, there is no "/usr/lib/qubes/qubes-vpn-setup" in the Fedora 29 or 
Debian 9  templates. So, wherever that came from, it's not in the new 
installer version we got.


There is no mention of a 'qubes-vpn-setup' in the vpn doc you linked to. 
That script is a part of my Qubes-vpn-support project on github. You 
might want to use that instead since the setup process is much simpler:


https://github.com/tasket/Qubes-vpn-support


Neither is there a path: /etc/openvpn/update-resolv-conf in the VMs 
based on Fedora 29. (Haven't tried Debian 9 for that yet.)
That probably came from a particular VPN provider, and would have to be 
installed in the template anyway to persist, right?


There is no mention of 'update-resolv-conf' in the vpn doc, either.

One of the most frequent causes of failed vpn setups is when the user 
decides to mix or combine different instructions because 'more is 
better' or because they saw different people discussing the merits of 
different approaches. This does NOT work; you have to pick one and 
follow it.




It seems that the update-resolve-conf is a default script that ships 
with some distros, such as Mint (attached), and works on our other 
machine, and does the function that the "|qubes-vpn-handler.sh|" does in 
the Qubes VPN instructions, but it doesn't work on Qubes in our case for 
the same VPN provider either.
Seems to require a lot of modification and merge the two maybe, which 
will take us another several days to figure out, if ever.


Updating resolv.conf is not required at all to get DNS working for 
downstream appVMs. The instructions avoid doing this to help keep the 
VPN VM in a locked-down state, so it doesn't inadvertently try to access 
the tunnel for its internal programs (i.e. only downstream VMs get to 
access the tunnel).


What IS necessary is populating the DNAT rules in the firewall. Check 
the PR-QBS chain to see if your DNS server IPs were added: iptables -L 
-v -t nat PR-QBS


--

Chris Laprise, tas...@posteo.net
https://github.com/tasket
https://twitter.com/ttaskett
PGP: BEE2 20C5 356E 764A 73EB  4AB3 1DC4 D106 F07F 1886

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/30080605-e0c5-4610-4279-1007b1e3b56f%40posteo.net.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] Qubes: Unable to connect to VPN

2019-02-14 Thread Otto Kratik
Just reviving a thread of mine from a few months ago with a related follow-up 
question.

When trying to connect to a VPN using openvpn from a Debian-9 AppVM within 
Qubes, I could connect but instantly lost DNS resolution which rendered the 
connection unusable.

Installing he package 'resolvconf' and adding the following lines to the .ovpn 
script supplied by the VPN provider:

script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf


...solved the issue and I was able to achieve full connectivity through the VPN.


Now, when trying to *disconnect* from that VPN using Ctrl-C from command line 
(or any other method) I am able to end the connection, but the DNS assignment 
does not appear to automatically reverse/undo and revert to the default
DNS servers provided by sys-net within Qubes, namely 10.139.1.1/2. And as a 
result I once again cannot connect to any websites due to lack of functioning 
DNS lookup.

Having done a bit of research I've tried using commands like:

sudo ifconfig tun0 down
sudo ip link delete tun0


..but in both cases I get a response that 'tun0 does not exist' or something 
similar.

Is there any extra step needed to completely drop the VPN connection and revert 
to using normal sys-net connectivity, without requiring a restart of the AppVM 
itself?

If I manually examine /etc/resolv.conf within the AppVM it still shows the 
default sys-net DNS entries as expected, so there must be some additional
command needed to fully end the connection and revert to normal.

What am I missing?

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/19fac423-d6ef-4ae1-9ace-b8721552e44f%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] Qubes: Unable to connect to VPN

2018-11-20 Thread 22rip
Thanks...I am away from my Qubes but will try! Thanks!

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/84169442-5ee0-4f7b-9148-905ca3e0f1ed%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] Qubes: Unable to connect to VPN

2018-11-20 Thread Otto Kratik
On Tuesday, November 20, 2018 at 3:56:22 PM UTC-5, 22...@tutamail.com wrote:
> Interesting Otto...can you elaborate on the files you changed? I had this 
> working at one time but then broke...I never managed to get it working.
> 
> What files did you change? The config files?
> 
> Any specifics for a newbie would be appreciated and likely appreciated by 
> others.
> 
> Thanks,
> 22Rip


In my case I had to change the config file supplied by the VPN provider itself, 
which ends with the extension ".ovpn"

In that file, just before the certificate info section which starts with:



-BEGIN CERTIFICATE-


..I had to add the lines:

script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf


That change, in combination with the package 'resolvconf' being installed in 
the template that the AppVM is based on (Debian 9, which did not have it 
installed by default), caused the VPN connection to work properly with 
functioning DNS lookup.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/bdba428f-3533-4cee-8a3d-67f1f137c0f1%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] Qubes: Unable to connect to VPN

2018-11-20 Thread 22rip
Interesting Otto...can you elaborate on the files you changed? I had this 
working at one time but then broke...I never managed to get it working.

What files did you change? The config files?

Any specifics for a newbie would be appreciated and likely appreciated by 
others.

Thanks,
22Rip

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/0f04d11c-827b-4ebe-b678-90f4218d60f1%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] Qubes: Unable to connect to VPN

2018-11-20 Thread Otto Kratik
Further update: I decided to try a completely different VPN provider's config 
file, and to my surprise that one worked fine using the old simple method of 
calling openvpn from the AppVM.

Examining both files and looking for the difference between the two, it appears 
the broken one did not ever invoke resolvconf include the following lines:

script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf


Adding those lines to the non-functioning file and running it resulted in 
success.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/930b5080-4ba8-428f-bcf6-0eeaa1411c4b%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] Qubes: Unable to connect to VPN

2018-11-20 Thread Otto Kratik
On Monday, November 19, 2018 at 3:55:19 PM UTC-5, Chris Laprise wrote:
> Qubes 4 networking is re-written and functions somewhat differently than 
> Qubes 3.x.


So it seems. After spending several days trying to get a VPN connection up and 
working via every possible method conceivable, I have been met with complete 
and utter failure and have finally given up.

The results are always the same. Whether I connect manually with Openvpn, use 
qubes-vpn-support, qubes-tunnel, try from an AppVM, NetVM, ProxyVM, edit 
/etc/resolv.conf or any number of other files or scripts, it makes no 
difference. The VPN output reports successful connection (Initialization 
sequence completed) and I can ping any numerical IP address I specify without 
issue. But DNS resolution does not work, and nothing I try fixes it.

Booting up Qubes 3.2, the same VPN connection works flawlessly and DNS is 
trouble-free. So I've decided to solve my problem in the simplest (and only) 
way available: by going back to Qubes 3.2.

I appreciate all your attempts to help me with this. Thank you.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/81b7d62b-f4ca-45b1-9745-1030ebbd6530%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] Qubes: Unable to connect to VPN

2018-11-19 Thread Chris Laprise

On 11/19/2018 03:01 PM, Otto Kratik wrote:

On Monday, November 19, 2018 at 12:27:40 PM UTC-5, Chris Laprise wrote:

It could be as simple as editing your /etc/resolv.conf so it contains
your VPN provider's DNS server (or other DNS server that you prefer)
instead of the Qubes internal routing addresses.


I'll give this a try, thanks. What mystifies me though is that I still have 
Qubes 3.2 installed on an older laptop and can confirm that on that version, 
none of these extra config steps are needed. I can activate and deactivate the 
VPN connection at will on the fly from an AppVM terminal, and it works 
flawlessly every time. Run openvpn and my IP address changes to the provider as 
expected. Hit ctrl-c to terminate the connection, and it goes back to my 
regular ISP-provided address as expected. Ideally I'd actually like to have 
this ability it switch it on and off as many times as desired during any given 
session, but maybe that's no longer possible in Qubes 4.


Qubes 4 networking is re-written and functions somewhat differently than 
Qubes 3.x.




Also, I tried the instructions here:

https://github.com/tasket/Qubes-vpn-support/

..and they did not work. Everything seems to go okay, but after 
copying/installing/linking everything as directed and then shutting down and restarting 
the ProxyVM, it pops up the message "Ready to start link", and then just 
repeatedly does that every 10 seconds or so. The link never actually goes up. Problem 
isn't with the provider's .ovpn config file, since it works fine on Qubes 3.2 as well as 
another mainstream Linux distro, with no issues at all.

Not sure if it's significant, but the service "vpn-handler-openvpn" does not 
appear in the dropdown list of available services in the ProxyVM's settings screen, even 
though the template on which it is based (Debian 9) most definitely has Openvpn installed 
on it. I typed that service name in manually and it accepted it, but it also accepts any 
garbage text entered as well, so no idea whether it's actually functioning properly or 
not.


All that's required for that step is that you type "vpn-handler-openvpn" 
correctly then click '+' and OK. You can go back to the list to make 
sure it is there and checked.


Usually when "Ready to start" appears and there is no connection it 
means there is an auth problem. The username or password may have been 
mistyped, for instance. You can run 'sudo /usr/lib/qubes/qubes-vpn-setup 
--config' to re-enter it.


To see what is happening check the log with 'sudo 
/usr/lib/qubes/qubes-vpn-setup --config'.




I was also admittedly a bit confused about whether I needed to separately 
install the qubes-tunnel package first, but the instructions didn't seem to 
explicitly require it so I did not. Other than that, I followed them to the 
letter but cannot get the link up.


qubes-tunnel is an alternate (re-named) version of Qubes-vpn-support; 
use one or the other.



--

Chris Laprise, tas...@posteo.net
https://github.com/tasket
https://twitter.com/ttaskett
PGP: BEE2 20C5 356E 764A 73EB  4AB3 1DC4 D106 F07F 1886

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/ba7c7865-7b83-6f24-8484-41518dd5f19a%40posteo.net.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] Qubes: Unable to connect to VPN

2018-11-19 Thread Otto Kratik
On Monday, November 19, 2018 at 12:27:40 PM UTC-5, Chris Laprise wrote:
> It could be as simple as editing your /etc/resolv.conf so it contains 
> your VPN provider's DNS server (or other DNS server that you prefer) 
> instead of the Qubes internal routing addresses.

I'll give this a try, thanks. What mystifies me though is that I still have 
Qubes 3.2 installed on an older laptop and can confirm that on that version, 
none of these extra config steps are needed. I can activate and deactivate the 
VPN connection at will on the fly from an AppVM terminal, and it works 
flawlessly every time. Run openvpn and my IP address changes to the provider as 
expected. Hit ctrl-c to terminate the connection, and it goes back to my 
regular ISP-provided address as expected. Ideally I'd actually like to have 
this ability it switch it on and off as many times as desired during any given 
session, but maybe that's no longer possible in Qubes 4.

Also, I tried the instructions here:

https://github.com/tasket/Qubes-vpn-support/

..and they did not work. Everything seems to go okay, but after 
copying/installing/linking everything as directed and then shutting down and 
restarting the ProxyVM, it pops up the message "Ready to start link", and then 
just repeatedly does that every 10 seconds or so. The link never actually goes 
up. Problem isn't with the provider's .ovpn config file, since it works fine on 
Qubes 3.2 as well as another mainstream Linux distro, with no issues at all.

Not sure if it's significant, but the service "vpn-handler-openvpn" does not 
appear in the dropdown list of available services in the ProxyVM's settings 
screen, even though the template on which it is based (Debian 9) most 
definitely has Openvpn installed on it. I typed that service name in manually 
and it accepted it, but it also accepts any garbage text entered as well, so no 
idea whether it's actually functioning properly or not.

I was also admittedly a bit confused about whether I needed to separately 
install the qubes-tunnel package first, but the instructions didn't seem to 
explicitly require it so I did not. Other than that, I followed them to the 
letter but cannot get the link up.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/77f93612-be60-4dbb-b8f5-f78e7af34e59%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] Qubes: Unable to connect to VPN

2018-11-19 Thread Chris Laprise

On 11/19/2018 12:27 PM, Chris Laprise wrote:

It could be as simple as editing your /etc/resolv.conf so it contains 
your VPN provider's DNS server (or other DNS server that you prefer) 
instead of the Qubes internal routing addresses.


Replace this:
nameserver 10.139.1.1
nameserver 10.139.1.2

With this:
nameserver 


Forgot to mention when you manually edit resolv.conf it should be 
_after_ the openvpn connection is started. Changing it before might 
prevent openvpn from starting the connection.


--

Chris Laprise, tas...@posteo.net
https://github.com/tasket
https://twitter.com/ttaskett
PGP: BEE2 20C5 356E 764A 73EB  4AB3 1DC4 D106 F07F 1886

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/9683b1ba-43db-5317-1760-38cc735a2636%40posteo.net.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] Qubes: Unable to connect to VPN

2018-11-19 Thread Chris Laprise

On 11/19/2018 09:05 AM, Otto Kratik wrote:

On Monday, November 19, 2018 at 1:09:33 AM UTC-5, Chris Laprise wrote:

The Qubes VPN doc has two methods for correct openvpn configuration:

https://www.qubes-os.org/doc/vpn/

A better method is located here:

https://github.com/tasket/Qubes-vpn-support/

The difference is more failsafe checks and much smoother setup & operation.


Thanks for your reply. I'm entirely willing to consider using these better, 
more secure and effective methods in the long run. My first objective however 
is to determine why the simple method I used in Qubes 3.2 (running Openvpn from 
AppVM) does not successfully work the same way in Qubes 4.0.



I would also try pinging known IP addresses (after connecting) to see if
you can get a response. If you can, then the problem is likely with the
DNS routing and dnat in the firewall.


I've just tested this. After connecting to the VPN from within the AppVM, I can 
successfully ping known IP addresses from the terminal. However attempts to 
connect to websites in the browser fail and time out.

What is my next step? How do I check or fix DNS routing and dnat in the 
firewall?


It could be as simple as editing your /etc/resolv.conf so it contains 
your VPN provider's DNS server (or other DNS server that you prefer) 
instead of the Qubes internal routing addresses.


Replace this:
nameserver 10.139.1.1
nameserver 10.139.1.2

With this:
nameserver 

Hopefully that's all you'll need.

There are different ways to make this permanent. The best is probably to 
install the "resolvconf" package (if not already there) and then tell 
openvpn to use its update-resolv-conf script when you run it like this:


sudo openvpn --config link.conf --script-security 2 --up 
/etc/openvpn/update-resolv-conf --down /etc/openvpn/update-resolv-conf


If your VPN provider sends DNS info via DHCP at connection time (most 
do) the script will automatically send it to resolvconf.


If you want to use a different DNS server you can manually set 
resolv.conf at connection time with your own script.


--

Chris Laprise, tas...@posteo.net
https://github.com/tasket
https://twitter.com/ttaskett
PGP: BEE2 20C5 356E 764A 73EB  4AB3 1DC4 D106 F07F 1886

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/69a52ada-ea39-8a56-38f2-0d8af8e54f49%40posteo.net.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] Qubes: Unable to connect to VPN

2018-11-19 Thread Otto Kratik
On Monday, November 19, 2018 at 1:09:33 AM UTC-5, Chris Laprise wrote:
> The Qubes VPN doc has two methods for correct openvpn configuration:
> 
> https://www.qubes-os.org/doc/vpn/
> 
> A better method is located here:
> 
> https://github.com/tasket/Qubes-vpn-support/
> 
> The difference is more failsafe checks and much smoother setup & operation.

Thanks for your reply. I'm entirely willing to consider using these better, 
more secure and effective methods in the long run. My first objective however 
is to determine why the simple method I used in Qubes 3.2 (running Openvpn from 
AppVM) does not successfully work the same way in Qubes 4.0.


> I would also try pinging known IP addresses (after connecting) to see if
> you can get a response. If you can, then the problem is likely with the
> DNS routing and dnat in the firewall. 

I've just tested this. After connecting to the VPN from within the AppVM, I can 
successfully ping known IP addresses from the terminal. However attempts to 
connect to websites in the browser fail and time out.

What is my next step? How do I check or fix DNS routing and dnat in the 
firewall?

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/c80be580-203d-4228-b18b-9a980113d8ec%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] Qubes: Unable to connect to VPN

2018-11-18 Thread Chris Laprise

On 11/19/2018 01:09 AM, Chris Laprise wrote:

On 11/18/2018 07:36 PM, Otto Kratik wrote:
I realize it's possible to create a dedicated ProxyVM and use 
NetworkConfig to route VPN traffic, but that's not what I'm asking about.


In Qubes 3.2 from any standard Debian AppVM connected to Sys-Net I am 
able to simply do from terminal:


sudo openvpn --config 

..and it connects, and from then on all traffic from that AppVM is 
correctly routed through the VPN, as evidenced by testing IP address 
from web browser etc.


That approach might not work for DNS, however. Your DNS packets may be 
leaking through to your regular ISP. There is also no failsafe to 
prevent data leakage if openvpn for some reason decides to terminate.





In Qubes 4, this does not seem to work. The same command from AppVM 
terminal works fine and reports successful connection to the VPN, but 
from that point all attempts to connect to any website or other remote 
host fail completely and just time out. As soon as I terminate the VPN 
by pressing ctrl-c from terminal, net connectivity resumes as normal.


What has changed in Qubes 4, and what do I need to do different to 
make it work?


The Qubes VPN doc has two methods for correct openvpn configuration:

https://www.qubes-os.org/doc/vpn/

A better method is located here:

https://github.com/tasket/Qubes-vpn-support/

The difference is more failsafe checks and much smoother setup & operation.


For your specific question re: running openvpn in AppVMs, you may need 
to set the openvpn --verb level to 3 and look at the status messages. 
That will show you what routing commands openvpn is issuing 
(unfortunately it can vary a lot for different VPN services).


I would also try pinging known IP addresses (after connecting) to see if 
you can get a response. If you can, then the problem is likely with the 
DNS routing and dnat in the firewall.


--

Chris Laprise, tas...@posteo.net
https://github.com/tasket
https://twitter.com/ttaskett
PGP: BEE2 20C5 356E 764A 73EB  4AB3 1DC4 D106 F07F 1886

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/5e6d82d6-3c06-61bf-36da-31da74b84c6b%40posteo.net.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] Qubes: Unable to connect to VPN

2018-11-18 Thread Chris Laprise

On 11/18/2018 07:36 PM, Otto Kratik wrote:

I realize it's possible to create a dedicated ProxyVM and use NetworkConfig to 
route VPN traffic, but that's not what I'm asking about.

In Qubes 3.2 from any standard Debian AppVM connected to Sys-Net I am able to 
simply do from terminal:

sudo openvpn --config 

..and it connects, and from then on all traffic from that AppVM is correctly 
routed through the VPN, as evidenced by testing IP address from web browser etc.


That approach might not work for DNS, however. Your DNS packets may be 
leaking through to your regular ISP. There is also no failsafe to 
prevent data leakage if openvpn for some reason decides to terminate.





In Qubes 4, this does not seem to work. The same command from AppVM terminal 
works fine and reports successful connection to the VPN, but from that point 
all attempts to connect to any website or other remote host fail completely and 
just time out. As soon as I terminate the VPN by pressing ctrl-c from terminal, 
net connectivity resumes as normal.

What has changed in Qubes 4, and what do I need to do different to make it work?


The Qubes VPN doc has two methods for correct openvpn configuration:

https://www.qubes-os.org/doc/vpn/

A better method is located here:

https://github.com/tasket/Qubes-vpn-support/

The difference is more failsafe checks and much smoother setup & operation.

--

Chris Laprise, tas...@posteo.net
https://github.com/tasket
https://twitter.com/ttaskett
PGP: BEE2 20C5 356E 764A 73EB  4AB3 1DC4 D106 F07F 1886

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/78e19f42-3600-4a68-018b-1753c143987e%40posteo.net.
For more options, visit https://groups.google.com/d/optout.