Newsgroup: it.comp.os.linux.sys
Titolo: OpenVPN

Ho una openvpn che è funzionante ma solo se disabilito shorewall. Credo
però che disabilitare sharewall non sia una buona idea anche se non so
cosa serva. Qualcuno ha idea di come bypassare shorewall?
 
Questo il mio journal -f con shorewall disabilitato:
 
apr 23 15:37:38 localhost.localdomain pkexec[4235]: sandro: Executing
command [USER=root] [TTY=unknown] [CWD=/] [COMMAND=/usr/sbin/vpn-start
openvpn zpn --management 127.0.0.1 2222 --management-query-passwords]
apr 23 15:37:38 localhost.localdomain openvpn[4252]: OpenVPN 2.3.9
x86_64-mageia-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built
on Dec 29 2015
apr 23 15:37:38 localhost.localdomain openvpn[4252]: library versions:
OpenSSL 1.0.2g  1 Mar 2016, LZO 2.09
apr 23 15:37:38 localhost.localdomain openvpn[4253]: MANAGEMENT: TCP
Socket listening on [AF_INET]
127.0.0.1:2222
 
apr 23 15:37:38 localhost.localdomain openvpn[4253]: Need password(s)
from management interface, waiting...
apr 23 15:37:38 localhost.localdomain openvpn[4253]: MANAGEMENT: Client
connected from [AF_INET]
127.0.0.1:2222
 
apr 23 15:37:51 localhost.localdomain openvpn[4253]: MANAGEMENT: CMD
'username "Auth" "******"'
apr 23 15:37:51 localhost.localdomain openvpn[4253]: MANAGEMENT: CMD
'password [...]'
apr 23 15:37:51 localhost.localdomain openvpn[4253]: WARNING: file
'/home/sandro/Desktop/user.key' is group or others accessible
apr 23 15:37:51 localhost.localdomain openvpn[4253]: Socket Buffers:
R=[87380->87380] S=[16384->16384]
apr 23 15:37:52 localhost.localdomain openvpn[4253]: NOTE: UID/GID
downgrade will be delayed because of --client, --pull, or --up-delay
apr 23 15:37:52 localhost.localdomain openvpn[4253]: Attempting to
establish TCP connection with [AF_INET]
164.132.103.184:443
 [nonblock]
apr 23 15:37:53 localhost.localdomain openvpn[4253]: TCP connection
established with [AF_INET]
164.132.103.184:443
 
apr 23 15:37:53 localhost.localdomain openvpn[4253]: TCPv4_CLIENT link
local: [undef]
apr 23 15:37:53 localhost.localdomain openvpn[4253]: TCPv4_CLIENT link
remote: [AF_INET]
164.132.103.184:443
 
apr 23 15:37:53 localhost.localdomain openvpn[4253]: TLS: Initial packet
from [AF_INET]
164.132.103.184:443
, sid=4b9ff262 8bf09b4e
apr 23 15:37:53 localhost.localdomain openvpn[4253]: WARNING: this
configuration may cache passwords in memory -- use the auth-nocache
option to prevent this
apr 23 15:37:56 localhost.localdomain openvpn[4253]: MANAGEMENT: Client
disconnected
apr 23 15:37:56 localhost.localdomain openvpn[4253]: VERIFY OK: depth=1,
C=RU, ST=MOSCOW, L=MOSCOW, O=ZPN, OU=ZPN, CN=
zpn.im
, name=ZPN,
emailAddress=
in...@zpn.im
 
apr 23 15:37:56 localhost.localdomain openvpn[4253]: VERIFY OK:
nsCertType=SERVER
apr 23 15:37:56 localhost.localdomain openvpn[4253]: VERIFY OK: depth=0,
C=RU, ST=MOSCOW, L=MOSCOW, O=ZPN, OU=ZPN, CN=zpnserver, name=ZPN,
emailAddress=
in...@zpn.im
 
apr 23 15:37:57 localhost.localdomain openvpn[4253]: Data Channel
Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
apr 23 15:37:57 localhost.localdomain openvpn[4253]: Data Channel
Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
apr 23 15:37:57 localhost.localdomain openvpn[4253]: Data Channel
Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
apr 23 15:37:57 localhost.localdomain openvpn[4253]: Data Channel
Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
apr 23 15:37:57 localhost.localdomain openvpn[4253]: Control Channel:
TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
apr 23 15:37:57 localhost.localdomain openvpn[4253]: [zpnserver] Peer
Connection Initiated with [AF_INET]
164.132.103.184:443
 
apr 23 15:37:59 localhost.localdomain openvpn[4253]: SENT CONTROL
[zpnserver]: 'PUSH_REQUEST' (status=1)
apr 23 15:38:02 localhost.localdomain openvpn[4253]: PUSH: Received
control message: 'PUSH_REPLY,ping 10,ping-restart 120,ifconfig
10.95.131.121 10.95.131.122,dhcp-option DNS 10.95.0.1,route-gateway
10.95.131.122,redirect-gateway def1'
apr 23 15:38:02 localhost.localdomain openvpn[4253]: OPTIONS IMPORT:
timers and/or timeouts modified
apr 23 15:38:02 localhost.localdomain openvpn[4253]: OPTIONS IMPORT:
--ifconfig/up options modified
apr 23 15:38:02 localhost.localdomain openvpn[4253]: OPTIONS IMPORT:
route options modified
apr 23 15:38:02 localhost.localdomain openvpn[4253]: OPTIONS IMPORT:
route-related options modified
apr 23 15:38:02 localhost.localdomain openvpn[4253]: OPTIONS IMPORT:
--ip-win32 and/or --dhcp-option options modified
apr 23 15:38:02 localhost.localdomain openvpn[4253]: ROUTE_GATEWAY
192.168.0.1/255.255.255.0
 IFACE=enp2s0 HWADDR=bc:5f:f4:7c:0f:01
apr 23 15:38:02 localhost.localdomain openvpn[4253]: TUN/TAP device tun0
opened
apr 23 15:38:02 localhost.localdomain openvpn[4253]: TUN/TAP TX queue
length set to 100
apr 23 15:38:02 localhost.localdomain openvpn[4253]: do_ifconfig,
tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
apr 23 15:38:02 localhost.localdomain openvpn[4253]: /usr/sbin/ifconfig
tun0 10.95.131.121 pointopoint 10.95.131.122 mtu 1500
 
***********************
apr 23 15:38:02 localhost.localdomain openvpn[4253]: /usr/sbin/route add
-net 164.132.103.184 netmask 255.255.255.255 gw 192.168.0.1
***********************
 
apr 23 15:38:02 localhost.localdomain systemd-networkd[782]: tun0
     : gained carrier
 
************************
apr 23 15:38:02 localhost.localdomain openvpn[4253]: ERROR: Linux route
add command failed: external program exited with error status: 7
************************
 
apr 23 15:38:02 localhost.localdomain openvpn[4253]: /usr/sbin/route add
-net 0.0.0.0 netmask 128.0.0.0 gw 10.95.131.122
apr 23 15:38:02 localhost.localdomain openvpn[4253]: /usr/sbin/route add
-net 128.0.0.0 netmask 128.0.0.0 gw 10.95.131.122
apr 23 15:38:02 localhost.localdomain openvpn[4253]: GID set to openvpn
apr 23 15:38:02 localhost.localdomain openvpn[4253]: UID set to openvpn
apr 23 15:38:02 localhost.localdomain openvpn[4253]: Initialization
Sequence Completed
apr 23 15:38:02 localhost.localdomain systemd-sysctl[4282]: Overwriting
earlier assignment of kernel/sysrq in file
'/etc/sysctl.d/51-alt-sysrq.conf'.
 
mentre con shorewall abilitato ottengo questo:
 
...
apr 22 09:47:54 localhost.localdomain openvpn[3909]: ROUTE_GATEWAY
192.168.0.1/255.255.255.0
 IFACE=enp2s0 HWADDR=bc:5f:f4:7c:0f:01
apr 22 09:47:54 localhost.localdomain openvpn[3909]: TUN/TAP device tun0
opened
apr 22 09:47:54 localhost.localdomain openvpn[3909]: TUN/TAP TX queue
length set to 100
apr 22 09:47:54 localhost.localdomain openvpn[3909]: do_ifconfig,
tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
apr 22 09:47:54 localhost.localdomain openvpn[3909]: /usr/sbin/ifconfig
tun0 10.95.229.5 pointopoint 10.95.229.6 mtu 1500
***
apr 22 09:47:54 localhost.localdomain openvpn[3909]: /usr/sbin/route add
-net 164.132.103.184 netmask 255.255.255.255 gw 192.168.0.1
***
apr 22 09:47:54 localhost.localdomain systemd-networkd[780]: tun0
     : gained carrier
***
apr 22 09:47:54 localhost.localdomain openvpn[3909]: ERROR: Linux route
add command failed: external program exited with error status: 7
***
apr 22 09:47:54 localhost.localdomain openvpn[3909]: /usr/sbin/route add
-net 0.0.0.0 netmask 128.0.0.0 gw 10.95.229.6
apr 22 09:47:54 localhost.localdomain openvpn[3909]: /usr/sbin/route add
-net 128.0.0.0 netmask 128.0.0.0 gw 10.95.229.6
apr 22 09:47:54 localhost.localdomain openvpn[3909]: GID set to openvpn
apr 22 09:47:54 localhost.localdomain openvpn[3909]: UID set to openvpn
apr 22 09:47:54 localhost.localdomain openvpn[3909]: Initialization
Sequence Completed
apr 22 09:47:54 localhost.localdomain systemd-sysctl[4077]: Overwriting
earlier assignment of kernel/sysrq in file
'/etc/sysctl.d/51-alt-sysrq.conf'.
***
apr 22 09:48:00 localhost.localdomain kernel:
Shorewall:OUTPUT:REJECT:IN= OUT=tun0 SRC=10.95.229.5 DST=50.116.40.226
LEN=62 TOS=0x00 PREC=0x00 TTL=64 ID=57924 DF PROTO=UDP SPT=60226 DPT=53
LEN=42
***
e poi una lunga serie di linee simili all'ultima dove compare sempre tun0.
-- 
Sandro kensan 
www.kensan.it
 & 
www.qiqi.it
 geek site
Saluto gli agenti della NSA - Hello NSA - 
www.nsa.gov
 

Tendenzialmente devi dire a shorewall che ti permetta la connessione 
sulle porte di openvpn.
Non è chiaro se sei client o server (credo client), in ogni caso sul 
sito di shorewall c'è la documentazione del caso.
 
Steve


 sito di shorewall c'è la documentazione del caso.
 
Grazie Steve, mi informerò perché sono proprio ignorante in materia.
Comunque sì, sono un client. La porta openvpn di cui parli dovrebbe
essere (a intuito) la 443 che è quella del mio file di configurazione:
/etc/sysconfig/network-scripts/vpn.d/openvpn/zpn.conf
giusto?
 
dev tun
proto tcp
remote 
username.zpn.im
 443
cipher AES-128-CBC
auth SHA1
resolv-retry infinite
nobind
persist-tun
persist-key
client
verb 3
ns-cert-type server
auth-user-pass
<ca>
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
-----END PRIVATE KEY-----
</key>


 sito di shorewall c'è la documentazione del caso.
 
Nella mia infinita ignoranza pare (pare) che abbia risolto il problema.
Si tratta di una questione di firewall. Su Mageia c'è un wizard che
permette di settare il firewall, ho semplicemente ecluso il firewall e
l'accesso a internet dal openvpn era ok, poi ho rimesso il firewall e mi
ha detto di proteggere alcune connessioni tra cui la mia eth0 e la Tun0,
quindi ho notato che il firewall non mi blocca più la mia vpn.
 
Problema risolto? spero di si, spero che al riavvio sia ancora tutto ok.


> Problema risolto? spero di si, spero che al riavvio sia ancora tutto ok.
 
Brrr che approccio alla windows!!!
 
Giulia
 
 

 Brrr che approccio alla windows!!!
 
Sono d'accordo con te che non è un bel approccio ma io di queste cose
non ne capisco e quindi mi tocca fare così oppure farmi una cultura in
merito che richiede molto tempo.
 
Il problema del pc è che ha bisogno di molta "manutenzione" e di linux è
che ne ha bisogno di moltissima e la voglia e il tempo è quel che è.


 Problema risolto? spero di si, spero che al riavvio sia ancora tutto ok.
 
Che dispiacere. Mi ero connesso benissimo a Internet con IP francese,
poi ho fatto un upgrade gratuito del mio piano (che è gratuito) da 1 GB
a 10 GB, ho cambiato l'IP con cui esco da francese a italiano, ho messo
nel file di conf di openvpn il mio login e la password e non funziona
più. Ho rimesso le cose come prima e ancora non mi funziona, mi da
mediante journal:
 
Unsupported device type 65534 for "tun0"
 
...
apr 26 21:27:46 localhost.localdomain openvpn[16767]: ROUTE_GATEWAY
192.168.0.1/255.255.255.0
 IFACE=enp2s0 HWADDR=bc:5f:f4:7c:0f:01
apr 26 21:27:46 localhost.localdomain openvpn[16767]: TUN/TAP device
tun0 opened
apr 26 21:27:46 localhost.localdomain openvpn[16767]: TUN/TAP TX queue
length set to 100
apr 26 21:27:46 localhost.localdomain openvpn[16767]: do_ifconfig,
tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
apr 26 21:27:46 localhost.localdomain openvpn[16767]: /usr/sbin/ifconfig
tun0 10.95.216.1 pointopoint 10.95.216.2 mtu 1500
apr 26 21:27:46 localhost.localdomain openvpn[16767]: /usr/sbin/route
add -net 164.132.199.75 netmask 255.255.255.255 gw 192.168.0.1
apr 26 21:27:46 localhost.localdomain systemd-networkd[780]: tun0
     : gained carrier
apr 26 21:27:46 localhost.localdomain openvpn[16767]: ERROR: Linux route
add command failed: external program exited with error status: 7
apr 26 21:27:46 localhost.localdomain openvpn[16767]: /usr/sbin/route
add -net 0.0.0.0 netmask 128.0.0.0 gw 10.95.216.2
apr 26 21:27:46 localhost.localdomain openvpn[16767]: /usr/sbin/route
add -net 128.0.0.0 netmask 128.0.0.0 gw 10.95.216.2
apr 26 21:27:46 localhost.localdomain openvpn[16767]: GID set to openvpn
apr 26 21:27:46 localhost.localdomain openvpn[16767]: UID set to openvpn
apr 26 21:27:46 localhost.localdomain openvpn[16767]: Initialization
Sequence Completed
 
******
 
apr 26 21:27:47 localhost.localdomain dhclient[16893]:
 
****************************************
Unsupported device type 65534 for "tun0"
****************************************
 
apr 26 21:27:47 localhost.localdomain dhclient[16893]:
 
apr 26 21:27:47 localhost.localdomain dhclient[16893]: If you think you
have received this message due to a bug rather
 
apr 26 21:27:47 localhost.localdomain dhclient[16893]: than a
configuration issue please read the section on submitting
 
apr 26 21:27:47 localhost.localdomain dhclient[16893]: bugs on either
our web page at 
www.isc.org
 or in the README file
 
apr 26 21:27:47 localhost.localdomain dhclient[16893]: before submitting
a bug.  These pages explain the proper
 
apr 26 21:27:47 localhost.localdomain dhclient[16893]: process and the
information we find helpful for debugging..
 
apr 26 21:27:47 localhost.localdomain dhclient[16893]:
 
apr 26 21:27:47 localhost.localdomain dhclient[16893]: exiting.
 
apr 26 21:27:47 localhost.localdomain systemd-sysctl[16922]: Overwriting
earlier assignment of kernel/sysrq in file
'/etc/sysctl.d/51-alt-sysrq.conf'.
 
