Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Sign In Register

Quick Links


Categories

In this Discussion

› › OpenVPN automated installer - Page 4
New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

OpenVPN automated installer

12467…10

Comments

  • kendidkendid Veteran

    I had a script I've been using for years -- manually modifying each item per server... Thought I'd give this one a spin, wow, this is really nicely put together! Thanks!

    Thanked by 1Nyr
  • DorkfilesDorkfiles Member

    @Nyr said:
    Why so? Or is it just personal preference? I ask since is not the first time that I get requests like that, or to increase key length or something like that.

    Really just personal and the 128 CBC can be decrypted over time.

    I'd also like to suggest high speed mode possibly for those who use your script for basic masq, where you send the encoding to lowest possible and auth to save cpu/transport on both ends also disable compression with this option.

    Meh

    I may as well just fork you on github :)

  • NyrNyr Community Contributor, Veteran

    Dorkfiles said: 128 CBC can be decrypted over time

    That's... thetorically possible, but very optimistic.

    If a change on the cipher has to be made, it should be to AES 128 CBC, but then users would complain too and request AES 256 CBC, which is even slower.

    Fact is, performance is a bigger problem at this time than users fighting very capable nation states or something like that. That's why OpenVPN is still using Blowfish by default and I think it's a sensible decision to respect it for the time being. You already struggle to max a 100 mbps port with the actual defaults on many VPSes, I don't want to make it worse.

    Dorkfiles said: where you send the encoding to lowest possible and auth to save cpu/transport on both ends also disable compression

    I suppose you are talking about disabling encryption completely, which is possible, but this script was created as a road warrior installer so that functionality will not be added, feel free to fork if you want. Anyway, performance of the TUN adapter is going to hurt. OpenVPN is not the best option for very high speed links.

  • inthecloudbloginthecloudblog Member

    I'm getting the following ( I have a PPTP vpn also in the same vps)
    Tue Feb 24 17:45:29 2015 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
    Tue Feb 24 17:45:31 2015 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
    Tue Feb 24 17:45:36 2015 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
    Tue Feb 24 17:45:43 2015 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
    Tue Feb 24 17:46:00 2015 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)

  • NyrNyr Community Contributor, Veteran

    @inthecloudblog do you have a firewall or are on a very restrictive network?

    That log is showing a connectivity problem, nothing to do with the script.

  • nexmarknexmark Member

    Best script ever

    Thanked by 3inthecloudblog howardsl2 Amitz
  • inthecloudbloginthecloudblog Member

    I have fail2ban in the server. Might that have to do? thanks for the prompt reply!

  • NyrNyr Community Contributor, Veteran

    inthecloudblog said: I have fail2ban in the server. Might that have to do?

    Not likely, must be other thing. You could try switching to TCP on both the client and the server configurations, but that's not a good fix ;)

  • inthecloudbloginthecloudblog Member

    I've rented a bandwagon box and with the same setup works flawlessly.

    Thanks

  • xichasxichas Member

    Hi Nyr !!
    Great script!!! congrats!! But i´m having a problem I have a VPS debian7 32bits and installed your wounderful script, configured router Asus RTN18U as client and connection sucess, can ping 10.8.0.1, and connect vps via ssh an sftp, noticed that some programs on my PC such as utorrent can connect to peers over internet, skype, and teamviewer get connetion to the internet (logged on), but I intended do use openvpn to do secure web browsing and can´t browse any webpage. Read a lot of tutorials made over five reinstallations with a lot of experiences and tests with no sucess... I have to admit that I´m a noob on openvpn and linux. Can you give me some advices to resolve that issue???

    My best regards
    Xichas

  • NyrNyr Community Contributor, Veteran

    @xichas sorry, this seems like a client side problem. Check that you don't have a proxy configured in your web browser.

  • xichasxichas Member

    ok my friend

    I will try to check that, or test the client configuration directly in my pc. Thanks for your rapid response.

    Regards

  • geodirkgeodirk Member

    I tried this script on a Hudson Valley Host VPS (OpenVZ) running Debian 7. Seems to install ok and OpenVPN servers boots up without issues. But when I try to connect, I'm getting only this in the client's log:



    Tue Mar 10 10:00:24 2015 OpenVPN 2.3.4 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on May 2 2014

    Tue Mar 10 10:00:24 2015 library versions: OpenSSL 1.0.1g 7 Apr 2014, LZO 2.05

    Tue Mar 10 10:00:24 2015 Socket Buffers: R=[8192->8192] S=[8192->8192]

    Tue Mar 10 10:00:24 2015 UDPv4 link local: [undef]

    Tue Mar 10 10:00:24 2015 UDPv4 link remote: [AF_INET] xxx.xxx.xxx.130:443




    Firewall issue? I'm used to doing things in CentOS not Debian. Is there something that I'm missing that Debian 7 needs extra for the firewall beyond the script?

  • NyrNyr Community Contributor, Veteran

    @geodirk looks like the connection doesn't even start. Check that you aren't on a restrictive network. And that your server is listening on port 443 UDP if that's what you are using.

  • geodirkgeodirk Member

    @Nyr So I blew away the VPS and reinstalled Debian 7 and reran the script. After installation, I'm getting this in my firewall:

    # Generated by iptables-save v1.4.14 on Tue Mar 10 13:02:56 2015
*nat
:PREROUTING ACCEPT [33:3422]
:POSTROUTING ACCEPT [25:1780]
:OUTPUT ACCEPT [25:1780]
-A POSTROUTING -s 10.8.0.0/24 -j SNAT --to-source xxx.xxx.xxx.130
COMMIT
# Completed on Tue Mar 10 13:02:56 2015
# Generated by iptables-save v1.4.14 on Tue Mar 10 13:02:56 2015
*mangle
:PREROUTING ACCEPT [19033:19180834]
:INPUT ACCEPT [19033:19180834]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [15885:1424651]
:POSTROUTING ACCEPT [15885:1424651]
COMMIT
# Completed on Tue Mar 10 13:02:56 2015
# Generated by iptables-save v1.4.14 on Tue Mar 10 13:02:56 2015
*filter
:INPUT ACCEPT [19033:19180834]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [15885:1424651]
COMMIT
# Completed on Tue Mar 10 13:02:56 2015




    Doing a '#service openvpn status' returns:

    [ ok ] VPN 'server' is running.



    And my openvpn config is simply this:

    port 443
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.8.8"
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3




    Running #netstat --tcp --udp --listening --program

    Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 *:http                  *:*                     LISTEN      1918/apache2
tcp        0      0 *:ssh                   *:*                     LISTEN      1586/sshd
tcp        0      0 localhost.localdom:smtp *:*                     LISTEN      1814/sendmail: MTA:
tcp        0      0 localhost.lo:submission *:*                     LISTEN      1814/sendmail: MTA:
tcp6       0      0 [::]:ssh                [::]:*                  LISTEN      1586/sshd
udp        0      0 *:https                 *:*                                 3128/openvpn




    I don't believe that I'm on a restrictive network with Hudson Valley Host. But I'm getting the same client error message on the client as before...

  • geodirkgeodirk Member

    Looking at the netstat dump...shouldn't the openvpn be set to "LISTEN" like all the others? Maybe that is the problem?

  • NyrNyr Community Contributor, Veteran

    @geodirk check the 443 UDP port on the server from your client, most likely is not connectable.

  • NyrNyr Community Contributor, Veteran

    geodirk said: Looking at the netstat dump...shouldn't the openvpn be set to "LISTEN" like all the others? Maybe that is the problem?

    No, since it is UDP.

    Again, the problem is either a firewall or any other kind of connectivity problem between both networks.

    Thanked by 1geodirk
  • smicrozsmicroz Member
    edited March 2015

    thanks for sharing...

    For some reason I can connect to vpn, but I can't navigate... (centos - with selinux disabled and udp port is open in server and client)

    Any suggestion?

  • ChuckChuck Member
    edited April 2015

    @Nyr

    Can you make a IPsec/L2TP automated installer for OpenVZ?

    I found this for KVM and XEN.

    https://gist.github.com/hwdsl2/9030462

  • NyrNyr Community Contributor, Veteran
    edited April 2015

    Chuck said: Can you make a IPsec/L2TP automated installer for OpenVZ?

    Nah, plenty of problems plus many (most?) providers don't support it. Also it would only work on the node's architecture if I remember correctly, so no 32 bit support.

    I would rather write something for SoftEther instead, which AFAIK emulates it but don't really have the motivation right now. Maybe in the future.

  • ChuckChuck Member
    edited April 2015

    @Nyr said:
    I would rather write something for SoftEther instead, which AFAIK emulates it but don't really have the motivation right now. Maybe in the future.

    Sure, please do Softether NAT IPv4 using Local Bridge?

    If you can make a automated installer for it, you will save me 30 minutes every time I Rebuild my VPS.

  • NyrNyr Community Contributor, Veteran

    Chuck said: Sure, please do Softether NAT IPv4 using Local Bridge?

    Yeah, well, to do it properly like with the OpenVPN script takes a lot of time, it's not just some quick commands to install and then hardcode a configuration and hope for the best like other people do.

    Between writing, improving, reading documentation, testing and giving support to the users, I probably invested more than 50 hours on my OpenVPN script easily. I am happy because it has been useful to many people at the end, but as said, I don't currently have the motivation to do the same for SoftEther (since I don't use it).

    Thanked by 1raza19
  • MallerMaller Member
    edited April 2015

    @Chuck said:
    If you can make a automated installer for it, you will save me 30 minutes every time I Rebuild my VPS.

    I have a script that does just that. It's not perfect and really just something i use for my personal use.
    https://github.com/eunas/essentials

    Thanked by 5Chuck souen bersy ahmiq Coffee
  • DorkfilesDorkfiles Member

    @Nyr said:
    That's... thetorically possible, but very optimistic.

    Since the NSA (and GHCQ) can crack 1028-bit RSA encryption on public levels in 30 to 40 minutes, some VPN providers at least have beefed up their key encryption to 2048-bits, or even up to 4096-bits and beyond.

    Guess the tin foil hat never gets old just amplifys the scanner

    Thanked by 2moofasa Chuck
  • TheKillerTheKiller Member

    Great script, thank you Nyr.

    Thanked by 1Nyr
  • rokokrokok Member

    first try, working fine thanks :)

    Thanked by 1Nyr
  • NyrNyr Community Contributor, Veteran
    edited September 2015

    Just a quick bump to let you guys know I pushed a big upgrade and half of the script has been rewritten.

    It includes support for the new easy-rsa 3, unified and proper configuration files across distributions, some security upgrades like remote-cert-tls, support for firewalls, proper subnets and some other good stuff.

    All the changes had been extensively tested and I hope they are working everywhere as they should, but please report any bug you can find :)

    Thanked by 15Nekki GM2015 BlazeMuis berkay paily marl Infinity foxez elflord angrysnarl Amitz howardsl2 Pwner 4n0nx emg
  • GM2015GM2015 Member

    Thanks Nyr will see this tested on a vm if it works. I've become interested in vpns lately and this looks good for non-tech bitches.

    Thanked by 1Nyr
  • MuZoMuZo Member
    edited September 2015

    @Nyr is it possible to upgrade from a previous installation of your script?

Sign In or Register to comment.