Openvpn on Michael’s Domain

OpenVPN server on pfsense and client on Ubuntu 16.04

Fri, 02 Nov 2018 00:00:00 +0000

I have been setting up an OpenVPN server on my Netgate SG-3100 router . I hope this makes syncronizing backups to a physically separate location easier. There are many walkthroughs to set up an OpenVPN server on a pfsense router and that works nicely. However, I am using Ubuntu 16.04 at work and setting up the client requires a bit more than doing the same on MacOS or Windows. On Ubuntu, it is mandatory to update DNS information manually after establishing the VPN tunnel if you have opted for the setting to route all internet traffic originating from the client through the VPN server. If you do no update the DNA resolver information on the Ubuntu client, you can access the the VPN-internal network (in my case 10.0.0.0/24), but you cannot use hostnames. E.g. ping www.google.com will fail, but ping 172.217.21.164 will succeed. Similarly, your browser will not find any URLs. And browsing with IP-addresses (“http://172.217.21.164”) is not very practical.The default configuration on Ubuntu does not allow for this update of the DNS resolver to happen automatically for security reasons. There is a script included in the Ubuntu package of openvpn that updates this information (/etc/openvpn/update-resolv-conf). But in order for this to work one needs to

How to start openvpn or ssh server under Ubuntu 16.04 and 18.04

Sat, 03 Sep 2016 00:00:00 +0000

OpenVPNsudo systemctl start openvpn@clientThe “client” is derived from the configuration file name (/etc/openvpn/client.conf). If your configuration file is server.conf, the command needs to besudo systemctl start openvpn@serverWhen you want the service to start up automatically during system boot, you issue:sudo systemctl enable openvpn@serverTemplated versus non-templated servicesOpenVPN is a so-called “templated” service (it needs a configuration file when being invoked). In contrast to this, the ssh server is a non-templated service. Hence the command is simpler:sudo systemctl start sshd

Managing OpenVPN with Network Manger

Thu, 05 Nov 2015 00:00:00 +0000

I just switched back from MacOSX to Ubuntu for work. Mostly for financial reasons. We need more computers at work and a really good PC laptop is just half as expensive as a MacbookPro or iMac. Today I wanted to connect from home to the University’s VPN network and I had a look at the instructions provided by the university.As usually, documentation was virtually absent and what was available was wrong. And exclusively in Finnish ( http://www.helsinki.fi/helpdesk/ohjeet/tietoliikenne_ja_etakaytto/yhteydet_yliopiston_ulkopuolelta/vpn_ubuntu-asennus.html) . From the image (Hardy Heron) it is clear that this page has not been updated for about at least 6 years (Hardy Heron was realased in the beginning of 2008).So what do you do if you downloaded and extracted the hy-vpn-config.tar.gz file from https://ohjelmistojakelu.helsinki.fi?First you need to install a plugin for the Network Manager: sudo apt-get install network-manager-openvpn network-manager-openvon-gnome. Then you go to the Network Manager via the icon in the menu bar on the top right of your Desktop. Below all the available wireless networks, there is an entry “VPN Connections”. Follow “VPN Connections” -> “Configure VPN” -> “Add” -> “Import a saved VPN configuration” -> “Create”. Then select the “openvpn.conf” from the downloaded and extracted files. After that, fill in the rest of the dialog box: User name, Password. For the CA Certificate, select the “HY-vpn-CA.pem” file from the downloaded files (you should have put it first somewhere safe, e.g. to “/etc/openvpn”).One problem that people are complaining about is the fact that the import does not honor the “redirect-gateway def1” directive and as a consequence you won’t be able to connect anywhere (I guess this is due to the Network Manager using dnsmasq and dnsmasq is apparently not smart enough to realize that it should send the queries somewhere else now). That’s why people are complaining that Network Manager doesn’t work to route all traffic via the VPN network. The box that you need to uncheck for this to work is well hidden: It’s in the connection editor dialog under the IPv4 Settings tab -> Routes (at the bottom right) -> “Use this connection only for resources on its network”. Why on earth do they have to call it in a way that nobody understands its meaning? Why not to call it “Do not route all traffic through this VPN connection”? I also had to check the box that said “Ignore automatically obtained routes”, although I don’t know why…As usual, setting up the OpenVPN sucks and the important tunneling back of VPN traffic needed to be added manually on the OpenVPN server:iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADEI did it by making an additional file called openvpn2 in the /etc/network/if-up.d/ directory with the following content:#!/bin/shiptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADEOf course you can still start and stop the VPN via the command line. However, since systemd, the password entry is not straightforward. When you execute sudo systemctl start openvpn.service you need to execute (e.g. in another terminal) sudo systemd-tty-ask-password-agent and enter your password there. That’s clearly a kludge until they get a decent password agent…

x11vnc as a nxserver replacement

Thu, 29 Nov 2012 00:00:00 +0000

Now that nomachine ’s great nxclient is defunct on MacOS X and its new nxplayer is still in beta (and completely nonfunctional on my setup), I needed another solution to connect to my work desktop from home. I tried many things, but then settled for x11vnc . My work desktop is running Ubuntu Precise Pangolin (12.04) and I connect from a MacOS X 10.8 (Mountain Lion). I only had to install x11vnc and openssh-server on my work desktop and add an x11vnc.conf file to /etc/init with the following content:x11vnc -forever -rfbauth /etc/x11vnc.pass -bg -o /var/log/x11vnc.log -scale 1280x800 -display :0 -auth /var/run/lightdm/root/:0I have to create the password file:x11vnc -storepasswd password /etc/x11vnc.passThen I just have to get into my work desktop by some means or another. At the moment I jump there via the UNIX computers of the university, because direct ssh access is not possible because of a firewall. So I ssh into the UNIX mainframe and from there I ssh into my work computer. Once I am in, I establish a reverse ssh tunnel to my Macbook Pro at home:ssh -R 19999:localhost:5900 IP_address_of_homecomputerOn my Macbook at home I had to enable Sharing - Remote login first. Then I just use the inbuilt Screen sharing of the OS “Connect to server” and then I type “vnc://localhost:19999” and voila I can see my work desktop’s login screen.Alternatively I could use my openvpn server that I have installed on my Macbook and use an openvpn client on my work desktop to establish a connection to my Macbook. Then I could directly log in and avoid the hops via the university UNIX machines to set up the reverse ssh tunnel.Another, although very slow method to access the GUI of my work desktop is X11 forwarding via ssh. All I need is a working ssh connection to the server, X11 forwarding enabled in the ssh server configuration file and an X11 server on the local machine (e.g. XQuarz on MacOSX):ssh -X username@remote-server.comxclock &

How to enable VPN clients to access LAN computers that are not running VPN software

Tue, 08 Aug 2006 00:00:00 +0000

I installed an OpenVPN service on our server. The default setup worked right out of the box. However, I wanted to use a VPN client to perform offsite backups of the computers in our LAN (using the backuppc software). First I installed OpenVPN clients on all of the LAN computers to be backed up, but OpenVPN on MacOS X seems to be a bit unreliable. Therefore I wanted to setup the VPN server to forward requests to our LAN network. The following changes were necessary: