Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Sign In Register

Quick Links


Categories

In this Discussion

› › OpenVPN automated installer - Page 8
New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

OpenVPN automated installer

1…456810

Comments

  • NyrNyr Community Contributor, Veteran

    @mikeyur said:
    Nyr What client do you use on OS X? I'm using Viscosity and having issues with my latest install on a fresh Debian VM. I can connect perfectly, no errors in logs, but I don't get any internet access.

    Not sure if it's the client, the client config, or something server side. Kinda leaning toward routes not being pushed on client, but I've been tweaking all the settings and can't figure it out.

    I'm using Viscosity too.

    Run netstat -nr while connected to check if the routes are there.

    If so, the issue is most likely server-side. Can you ping the server from the client?

  • mike0000mike0000 Member

    @Nyr said:
    If so, the issue is most likely server-side. Can you ping the server from the client?

    Internet:
Destination        Gateway            Flags        Refs      Use   Netif Expire
0/1                10.8.0.1           UGSc            3        0    tun0
default            192.168.0.1        UGSc          548        0     en0

    I can ping the gateway (10.8.0.1) & main server IP without any issues, just nothing else.

  • teuteux13teuteux13 Member

    dear all ,

    thank a lor for your help i got to use openvpn over shadowsocks.

    Now i have internet working but i have a some error mesage before connected and after.

    During the connection i have this error

    tls_error bio read tls_read_plaintext error:error 1408f10b:SSL routines:SSL3_get_record:wrong version number.

    then after a while connected to the VPN over shadowsocks i have the message

    Authenticate/Decrypt packet error:packet HMAC authentication failed

    then after when i go to a website i have the hundred of message like this

    Authenticate/Decrypt packet error: bad packet ID (may be a replay):[#226]-see the man page entry for no-replay and replay-window.

    Fo your information without the shadowsock input in the client file i don't get any message error like above.

    Any suggestion?

  • NanoG6NanoG6 Member

    mikeyur said: What client do you use on OS X? I'm using Viscosity and having issues with my latest install on a fresh Debian VM. I can connect perfectly, no errors in logs, but I don't get any internet access.

    Not sure if it's the client, the client config, or something server side. Kinda leaning toward routes not being pushed on client, but I've been tweaking all the settings and can't figure it out.

    I was also using viscosity and have same problem. Still don't know why.
    Using Tunnelblick now and it just works

  • NyrNyr Community Contributor, Veteran

    NanoG6 said: I was also using viscosity and have same problem. Still don't know why. Using Tunnelblick now and it just works

    That's weird. Maybe worth posting in the Viscosity forums so the author can take a look.

  • netomxnetomx Moderator, Veteran

    @teuteux13 said:
    dear all ,

    thank a lor for your help i got to use openvpn over shadowsocks.

    Now i have internet working but i have a some error mesage before connected and after.

    During the connection i have this error

    tls_error bio read tls_read_plaintext error:error 1408f10b:SSL routines:SSL3_get_record:wrong version number.

    then after a while connected to the VPN over shadowsocks i have the message

    Authenticate/Decrypt packet error:packet HMAC authentication failed

    then after when i go to a website i have the hundred of message like this

    Authenticate/Decrypt packet error: bad packet ID (may be a replay):[#226]-see the man page entry for no-replay and replay-window.

    Fo your information without the shadowsock input in the client file i don't get any message error like above.

    Any suggestion?

    Checl the dates on,your vos and pc.

    Check the certs if their are the same

  • mike0000mike0000 Member
    edited October 2015

    @Nyr So I fixed it by enabling NAT for the 10.8.0.0/24 via IPTables. Everything was connecting properly, routes were fine, just not getting out to the net once it hit the VPS.

  • NyrNyr Community Contributor, Veteran

    mikeyur said: So I fixed it by enabling NAT for the 10.8.0.0/24 via IPTables. Everything was connecting properly, routes were fine, just not getting out to the net once it hit the VPS.

    Weird, the rules should had been enabled during setup.

  • miklosmiklos Member

    Select one client [1-2]: 2
    Using configuration from /etc/openvpn/easy-rsa/openssl-1.0.cnf
    Revoking Certificate 04.
    Data Base Updated
    Using configuration from /etc/openvpn/easy-rsa/openssl-1.0.cnf
    mv: cannot stat ‘/etc/openvpn/easy-rsa/pki/crl.pem.b5XC75CUWJ’: No such file or directory

    An updated CRL has been created.
    CRL file: /etc/openvpn/easy-rsa/pki/crl.pem

    1936

    Certificate for client kupi revoked

    In user remove "mv: cannot stat ‘/etc/openvpn/easy-rsa/pki/crl.pem.b5XC75CUWJ’: No such file or directory"

  • NyrNyr Community Contributor, Veteran

    @miklos easy-rsa issue, nothing to do with my script. It still works anyway.

  • miklosmiklos Member

    @Nyr said:
    miklos easy-rsa issue, nothing to do with my script. It still works anyway.

    oh Thanks!

  • GM2015GM2015 Member
    edited November 2015

    ** never mind, solved **
    *** windows changed its mind and started to work ***

    Got an issue on a fresh windows 2008 r2 and kidechire debian 8 install.

    Windows gets tls errors.

    Log: http://pastebin.com/raw.php?i=g4XJYKTj

    I'll see if I find something useful on google with:
    windows server 2008 openvpn SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

    Nyr said: issue

  • vivekagrvivekagr Member

    Will a server with 128MB ram suffice to run OpenVPN?

  • 2bb32bb3 Member

    vivekagr said: Will a server with 128MB ram suffice to run OpenVPN?

    Yes (if you don't have too many clients connecting at the same time of course!) but make sure that you can use tun/tap and nat (if KVM/XEN no problem but if openvz, must be enabled on the node)

  • n0myn0my Member

    @Nyr Can you make one for ShadowSocks too?

  • NyrNyr Community Contributor, Veteran

    @vivekagr said:
    Will a server with 128MB ram suffice to run OpenVPN?

    Even 32 MB are enough for a single user and OpenVZ :)

  • NyrNyr Community Contributor, Veteran

    @n0my said:
    Nyr Can you make one for ShadowSocks too?

    There are ShadowSocks servers so easy to install that I don't think it's really needed...

    Thanked by 2n0my GM2015
  • cupidcupid Member, Host Rep

    2 minutes max simple installation of openvpn AS: http://my.cheapdomainnamesdot.com/knowledgebase.php?action=displayarticle&id=59

  • john564john564 Member

    @n0my said:
    Nyr Can you make one for ShadowSocks too?

    wget https://raw.githubusercontent.com/teddysun/shadowsocks_install/master/shadowsocks.sh --no-check-certificate && chmod +x shadowsocks.sh && ./shadowsocks.sh

    Thanked by 3chinmoy n0my FlamesRunner
  • NyrNyr Community Contributor, Veteran

    cupid said: 2 minutes max simple installation of openvpn AS

    Okay, so? Nothing to do with my script and a commercial product.

    Thanked by 2Quinten doughmanes
  • 2bb32bb3 Member

    Curious why you didn't choose to have the openvpn process go to nobody/nogroup once started? Wouldn't that be more secure?

  • NyrNyr Community Contributor, Veteran

    @2bb3 said:
    Curious why you didn't choose to have the openvpn process go to nobody/nogroup once started? Wouldn't that be more secure?

    Yes, but it does have certain important limitations (which honestly I don't completely remember out of memory).

  • 2bb32bb3 Member

    Nyr said: out of memory

    I think it's problematic if you use fixed ip for your clients (to be able to forward port to them) but in your default config it should work out of the box (and people needing other features might still be able to comment those two lignes in their config file as they'll have to tweek their config anyway).

    Anyway, thanks for that great script & your nice contributions :)

  • john564john564 Member
    edited December 2015

    @2bb3

    In Centos its 'group nobody'

    In Debian its 'group nogroup'

    the problem is, if you get this mixed up, if you specify a non-existing user or group then the server won't start, and you get no clue why. I've been there.

  • thagoatthagoat Member

    I love it. I use this script on all my servers.

    Thanked by 1Nyr
  • 2bb32bb3 Member

    john564 said: the problem is, if you get this mixed up, if you specify a non-existing user or group then the server won't start, and you get no clue why. I've been there.

    You're right, but the script has to know what you use as it will need to know if it does an apt-get or use yum.. could do the same for the config, isn't it?

  • NyrNyr Community Contributor, Veteran

    @2bb3 said:

    Yeah, that's not a problem.

  • miklosmiklos Member
    edited December 2015

    @Nyr i just not see before btw i upgrade to CentOs 7.2 and when im in vpn i cant connect to imap pop3 and smtp its normal btw? with webmail works only with thunderbird not

  • NyrNyr Community Contributor, Veteran

    @miklos said:

    Nothing to do with the script.

    Thanked by 1miklos
  • GM2015GM2015 Member
    edited December 2015

    Noob question Nyr, but if I were to connect all my servers to a central openvpn server then in theory they could transfer files over 10.0.0.0/8 on the encypted tunnel openvpn creates?

    i mean as long as they stay on the same /24.. I dont have 300 servers.

    Nyr said: Nothing to do with the script.

Sign In or Register to comment.