December 2025
M	T	W	T	F	S	S
1	2	3	4	5	6	7
8	9	10	11	12	13	14
15	16	17	18	19	20	21
22	23	24	25	26	27	28
29	30	31

Archive for the ‘OpenVPN’ Category

OpenVPN somehow failed when tethering on the Android mobile hotspot from a new phone

Posted by jpluimers on 2023/04/07

A while after I got a new smartphone, I noticed that when my MacBook was connected over Wi-Fi to the mobile hotspot of my Android phone, the Tunnelblick connections over OpenVPN to my family members would not work. A telnet from the Android phone to the OpenVPN TCP port 1194 woud succeed, but not from the MacBook. Connecting from the phone using JuiceSSH to the OpenSSH endpoints at those family members would work too, so I was a bit flabbergasted.

In the end this seems to be a set of coincidences that fails in this particular setup, but I am not totally aware why.

The solution was to both re-configure the APN (Access Point Name) the smartphone uses to connect to the internet from ipv4/ipv6 to ipv4, and to reboot the phone.

For Dutch provider KPN Mobile, the APN is named internet and apparently changed default to ipv4/ipv6 without properly supporting ipv4. Note the configuration parameters are all lowercase, although they should be written IPv4 and IPv6.

Here are a few posts that got me on the right track (all via [Wayback/Archive] openvpn fails over android hotspot – Google Search):

[Wayback/Archive] wireless networking – VPN Issues While Using Phone’s Hotspot – Super User (thanks [Wayback/Archive] Nicolas Roux)

Solved me, I had to change APN setting from IPv6 to IPv4.
[Wayback/Archive] OpenVPN problemen | KPN Community

Probleem gevonden…. APN van KPN staat op ipv4/ipv6

Ik krijg dus alleen een ipv6 ip nummer, dat verbindt geen ipv4 vpn server.

APN van KPN veranderd in ipv4 en hij doet het weer
[Wayback/Archive] OpenVPN via mobiel internet van KPN ( 4G / 5G ) – Dit is wat Stijn ziet

Dit is eenvoud op te lossen door je Android in te stellen op IPv4 only. Standaard staat dit op IPv4/IPv6 en kiest je telefoon automatisch IPv6.

Note that sometimes the MTU can cause similar failures:

[Wayback/Archive] [Solved] OpenVPN works over mobile tethering, but not on home router – MTU Problem – OpenVPN Support Forum

For posterity, would like to post that the error was on account of incorrect MTU size setting on the TCP packet in the router. The size was set to 1452 bytes instead of 1492 bytes. Because of that the SSL/TLS packet was fragmented and the server ACK was not received. On changing the MTU size, everything works perfectly!

Note too: some links to check for OpenVPN responding are below.

Various sites with (often different) APNs that KPN mobile supports:

[Wayback/Archive] Can’t connect to VPN throught 4G mobile internet | KPN Community
[Wayback/Archive] Uitleg over het gebruik van APN’s
[Wayback/Archive] KPN Mobile Netherlands APN Configuration Settings – APN Settings Search Engine
[Wayback/Archive] VPN via 4G/ipv4 | KPN Community (mentioning theadvancedinternet APN without mentioning the firewall you need)
[Wayback/Archive] Werkt je mobiele data niet? Check je APN instellingen. Dit moet je doen.

There are quite a few APNs, some with firewall and/or proxy and/or compression, some with external IP address (which means your smartphone really needs a firewall).

–jeroen

Posted in Android Devices, Hardware, Network-and-equipment, OpenVPN, Power User, VPN | Leave a Comment »

Since about 5 months now, there has been a new Chocolatey package maintainer for OpenVPN

Posted by jpluimers on 2022/08/26

Last winter, I discovered that the OpenVPN version on Chocolatey was really old: it had not been updated since 2019.

Most Chocolatey maintainers are volunteers and sometimes the burden can become too large. Back then the maintainer was [Wayback/Archive] Chocolatey Software | wget, but luckily [Wayback/Archive] Chocolatey Software | dgalbraith has stepped in and in March 2022 bumped the version from [Wayback/Archive] Chocolatey Software | OpenVPN 2.4.7 to [Wayback/Archive] Chocolatey Software | OpenVPN – Open Source SSL VPN Solution 2.5.4 and kept maintaining (currently there is [Wayback/Archive] Chocolatey Software | OpenVPN – Open Source SSL VPN Solution 2.5.7).

Read the rest of this entry »

Posted in *nix, *nix-tools, Chocolatey, Hardware, Network-and-equipment, OpenVPN, Power User, ssh/sshd, VPN, Windows | Leave a Comment »

It looks like a volunteer has been found to maintain the openvpn chocolatey

Posted by jpluimers on 2021/08/09

The chocolatey package for OpenVPN has not been updated for quite a while. It looks like it has to do with the current dependency to verify the OpenVPN signature.

The current [Wayback] Chocolatey Software | OpenVPN 2.4.7 version is both outdated on the major version number ([Wayback/Archive.is] Release OpenVPN v2.5.3 release · OpenVPN/openvpn) and minor version ([Wayback/Archive.is] Release OpenVPN v2.4.11 release · OpenVPN/openvpn). The version 2.4 Windows installers are now called “Legacy Windows Installers”.

[Wayback/Archive.is] OpenVPN is outdated · Issue #14 · wget/chocolatey-package-openvpn

[Wayback/Archive.is] Chocolatey Software | OpenVPN 2.4.7: wget commenting to be aware of 2.4.8 required changes

Luckily less than a day after the start of the [Wayback/Archive.is] RFM – openvpn · Issue #1024 · chocolatey-community/chocolatey-package-requests, a volunteer stepped forward.

Hopefully by now the package is being maintained again.

–jeroen

Posted in Network-and-equipment, OpenVPN, Power User, VPN | Leave a Comment »

Tools for TCP tunnels over HTTP/HTTPS

Posted by jpluimers on 2019/01/16

With the advent of WebSockets, it looks like TCP tunnels over HTTP/HTTPS are gaining more ground and I need to put some research time in them.

Some old to new links:

Source: elia/corkscrew: Corkscrew mirror repo. Corkscrew is a tool for tunneling SSH through HTTP proxies. (which requires CONNECT)
- it seems defunct as the domain is for sale: [WayBack] corkscrew
q3k/crowbar: Tunnel TCP over a plain HTTP session (does not require CONNECT: works with GET and POST requests)
jpillora/chisel: A fast TCP tunnel over HTTP

CONNECT requests are not supported by many HTTP proxies, especially in larger organisations, so chisel and crowbar have a much bigger chance there.

And of course there is SoftEtherVPN/SoftEtherVPN: A Free Cross-platform Multi-protocol VPN Software. * For support, troubleshooting and feature requests we have http://www.vpnusers.com/. For critical vulnerability please email us. (mail address is on the header.).

However, that is a VPN solution which is much broader than just a single TCP tunnel. You can so similar things with OpenVPN, but over HTTP/HTTPS, also requires CONNECT:

SoftEtherVPN seems to be more versatile though. I blogged about that before, but back then didn’t have needs for it yet. VPN over HTTPS: Ultimate Powerful VPN Connectivity – SoftEther VPN Project.

–jeroen

via: [WayBack] VPN through only http – Server Fault answer by [WayBack] neutrinus

Posted in Communications Development, Development, HTTP, https, Internet protocol suite, Network-and-equipment, OpenVPN, Power User, TCP, VPN, WebSockets, Windows-Http-Proxy | Leave a Comment »

ssl/ssh multiplexer

Posted by jpluimers on 2017/08/07

sslh accepts connections on specified ports, and forwards them further based on tests performed on the first data packet sent by the remote client.

Probes for HTTP, SSL, SSH, OpenVPN, tinc, XMPP are implemented, and any other protocol that can be tested using a regular expression, can be recognised. A typical use case is to allow serving several services on port 443 (e.g. to connect to ssh from inside a corporate firewall, which almost never block port 443) while still serving HTTPS on that port.

Hence sslh acts as a protocol demultiplexer, or a switchboard. Its name comes from its original function to serve SSH and HTTPS on the same port.

sslh supports IPv6, privilege dropping, transparent proxying, and more.

Interesting…

–jeroen

Source: ssl/ssh multiplexer [WayBack]
Github: yrutschle/sslh: Applicative Protocol Multiplexer (e.g. share SSH and HTTPS on the same port)
Via: Google hangouts

Posted in *nix, https, Linux, OpenSSL, OpenVPN, Power User, Security | Leave a Comment »

With so many vulnerabilities out there, here is how to find out of if a fixed…

Posted by jpluimers on 2017/06/23

For my blog archive as I already shared it on G+

[WayBack] With so many vulnerabilities out there, here is how to find out of if a fixed is applied to vulnerabilities on Debian/Ubuntu Linux using CVE. – Jeroen Wiert Pluimers – Google+

[WayBack] Debian/Ubuntu Linux: Find If Installed APT Package Includes a Fix/Patch Via CVE Number – nixCraft

Explains how to view the changelog of an installed package on a Debian or Ubuntu Linux server to find out if a fix/patch applied via CVE number.

Hans Wolters:
And find all packages that belong to one cve :-)

zgrep -i cve /usr/share/doc/*/changelog.Debian.gz|grep 1000364

–jeroen

Posted in OpenVPN, Power User, Security | Leave a Comment »

Some links for MikroTik tips and scripts

Posted by jpluimers on 2017/04/25

MikroTik has great hardware, but getting things to work can be a bit ehm intimidating.

So here are some links that were useful getting my CCR1009 and CRS226 configurations to do what I wanted.

Saving your configuration (two possibilities: binary backup file which only works on the same physical model device, or text based configuration export script that you can import back to any model).
- When you import a configuration, those settings are added to your current configuration.
- If your configuration gets more complex, it pays to split the textual exports into logical blocks so you can import each of them individually.
- You can even put the downloaded exports into a version control system like Git or SVN.
- The exported configurations are stored in the file system. You cannot manually rename these files, but there is a scripting trick to perform the rename.
- You can download the exported configurations from the UIs in webfig, winbox or through sftp after configuring certificate logon.
Choosing ports for WAN and LAN
- On the CCR1009, the first 4 ports can be used for switching (see also other ref), so it makes sense using those for LAN and others for WAN as it can increase speed: CCR 1009 switch chip menu – MikroTik RouterOS
  - Just look at the block diagrams of the various CCR1009-8G-1S models (currently CCR1009-8G-1S-PC, CCR1009-8G-1S-1S+, CCR1009-8G-1S-1S+PC) as they all have the first four ports connected to an Atheros 8327 Gigabit Switch chip.
  - All ports of the CRS226 models (CRS226-24G-2S+RM and CRS226-24G-2S+IN) are connected through the combined QCA8519-AC2C switching and CPU chip).
  - Note that the switching chips won’t allow for Torch. But you can find the MAC addresses per physical switch ports in the unicast FDBs: Switch -> Unicast FDB shows you every mac and the physical port it is connected to.
Never ever use the domain named .local for your local domain if you have Apple devices in your network:
- .local is a reserved dns domain by the apple os and should not be used if you expect apple devices to work as expected.
Many people like Winbox because they prefer visual configuration. Others like the web or terminal interface better (the terminal is especially useful for scripts)
- Windows Winbox: MikroTik Routers and Wireless: Downloads
- Mac OS X Winbox: “Winbox” by MikroTik with Wine in order to make it usable on Mac – Joshaven.com
Manual:First time startup – MikroTik Wiki (default password for admin is empty; WinBox and web-interface are available on WAN *and* LAN interfaces!)
- Mikrotik Howto block Winbox Discovery + Limit Winbox Access | Syed Jahanzaib Personal Blog to Share Knowledge !
One of the first things I did was binding some ports to use LAN and others to use WAN. The LAN ports are in a bridge: Configure one port for WAN and others for LAN – MikroTik RouterOS
Manual:IP/DHCP Server – MikroTik Wiki and Manual:IP/Pools – MikroTik Wiki
- I had a lot of DHCP entries on my LAN before switching to the MikroTik for which some I wanted to add statically. Couldn’t find out how to do that in the IP pool, but it appeared there is a different way to do it:
  - Assign fixed / static IP address via Mikrotik DHCP server
  - Notes:
    1. the MAC address cab be either (:) separated or minus (-) separated. And yes: there is a RegEx for that.
    2. usually you don’t pass the client-id (it’s here just as an example that you could use it, but most DHCP clients do NOT use a client-ID, as they only use the MAC address)
  - /ip dhcp-server lease add address=192.168.100.10 mac-address=70:F1:A1:D1:49:49 client-id="client10"
Manual:IP/DNS – MikroTik Wiki
- If you use the MikroTik as a caching DNS server, then you need to enable “/ip dns set allow-remote-requests=yes”, but also immediately disable DNS TCP and UDP on all your WAN ports. See:
  - Client DNS issue (reddit)
  - Firewall filter rules for DNS – MikroTik RouterOS
  - /ip firewall filter add chain=input protocol=tcp dst-port=53 action=drop in-interface=!bridge_lan add chain=input protocol=udp dst-port=53 action=drop in-interface=!bridge_lan
  - If you run your internal DNS servers for the outside world, modify the rules to forward non non-LAN ports; see https://www.youtube.com/watch?v=X-wkLYKYaj8: How to redirect DNS to own DNS server using mikrotik routerboard
  - You can add statis DNS entries to your caching server; see https://www.youtube.com/watch?v=zDEx7TxCm1s: Mikrotik Training- Static DNS Entries (With Closed Captioning)
nslookup on the Mikrotik itself is called put[: resolv ...] syntax: nslookup on Mikrotik – MikroTik RouterOS
- Examples (first uses the internal DNS, second one one of the Google DNS servers):
  - put [:resolve shell.xs4all.nl]
  - put [:resolve shell.xs4all.nl 8.8.8.8]
  - put [:resolve 194.109.21.9]
tolaris.com · Synchronising DHCP and DNS on Mikrotik routers (script available on Github: Tolaris/mikrotik-dns-dhcp).
- via MikroTik – Automatically creating DNS record for each DHCP lease/client – GeekTank
- alternatives:
  - Mikrotik DHCP to DNS hostnames | BLOG.MESOUUG.COM
  - Setting static DNS record for each DHCP lease – MikroTik Wiki
Hardening (since my Guest WiFi is outside of the Mikrotik LAN and WAN realm, I’ve left some things open, for instance MAC service is available, but on a limit set of interfaces):
- Router Hardening — Manito Networks
- Not sure if disabling Neighbour discovery is a good thing, as it will disable this from the console as well
  /ip neighbor print;
  - Mikrotik Howto block Winbox Discovery + Limit Winbox Access | Syed Jahanzaib Personal Blog to Share Knowledge !
- Blacklist Filter update script – MikroTik RouterOS
  - As the above is much better maintained it is preferred over Spamhaus + Dshield Malicious Ip Blacklist For RouterOS Now Availalable GRATIS! – MikroTik RouterOS
Manual:Upgrading RouterOS – MikroTik Wiki
- http://web.archive.org/web/*/http://www.mikrotik.com/download/CHANGELOG_6
Manual:IP/Route – MikroTik Wiki (if you think routing is a massive topic, read about firewall rules).
Not sure this is a good idea, but you can get a DDNS address in the sn.mynetname.net domain and VPN to it (for instance using PPTP): Quick Set Home AP — How to use vpn provided? – MikroTik RouterOS
You need to setup both the clock (date/time) and SNTP in one step:
- Setup SNTP (Winbox) aka NTP (shell): /system ntp client set enabled=yes server-dns-names=0.pool.ntp.org,1.pool.ntp.org,2.pool.ntp.org,3.pool.ntp.org
  After a few seconds the Winbox will update the SNTP Client dialog and a few seconds later, the Clock dialog will also update itself.
Manual:IP/Firewall/NAT – MikroTik Wiki
- dstnat: Forwarding a port to an internal IP – MikroTik Wiki and https://www.youtube.com/watch?v=8sGL58AhQCQ:
  Mikrotik Training- Port Forwarding (With Closed Captioning)
- srcnat: getting NAT to work
- Hairpin NAT – MikroTik Wiki
- netmap vs srcnat/dstnat: IP Firewall rules, need help with optimization – MikroTik RouterOS
I like these ones as they use Winbox:
- Mikrotik – Setup – Powered by Kayako Help Desk Software
- Manual:Initial Configuration – MikroTik Wiki
Sharing Ideas … Mikrotik with Kannel/playSMS
- via: Mikrotik Related | Syed Jahanzaib Personal Blog to Share Knowledge !
- Mikrotik Firewall / Short Notes + Scripts
Connect CCR1009 with CSR226 over a longer distance than 3 meter – MikroTik RouterOS
Graphing: ensure you only limit this to IP-addresses that you want graphs to be visible on (0.0.0.0/0 makes it visible to ALL): Manual:Tools/Graphing – MikroTik Wiki
DNS – MikroTik RouterOS: I would like to have my router to stop all the DNS coming from my clients and not reaching my ISP provider.
Email sending can now also use the DNS-name of the SMTP server: Why does the email server configuration only allow IP-addresses? – MikroTik RouterOS
Dynamic DNS Update Script for No-IP DNS for Router OS V.6.7 – MikroTik RouterOS
Script for Ransomware Tracker by abuse.ch. Tracking Ransomware Infrastructure around the globe. Source: How I fight ransomware (crypto viruses) with Mikrotik – MikroTik RouterOS
/ip firewall mangle add chain=prerouting action=change-ttl new-ttl=increment:1
very simple solution for a traceroute to Hide ip address – MikroTik RouterOS
Using staged address list to perform Bruteforce login prevention – MikroTik Wiki

Very advanced stuff:

Packet flow (maybe the toughest part to wrap your head around):

Manual:Packet Flow – MikroTik Wiki (with diagrams on RouterOS 6.x and 3.x can flow).
Manual:Packet Flow v6 – MikroTik Wiki (with updated RouterOS 6.x diagram).
New Packet flow diagram – Page 2 – MikroTik RouterOS (Visio / PDF version of an even newer diagram)

Scripts:

Load balancing:

Syntax highlighting:

Syntax highlighting and completions for Sublime Text – MikroTik RouterOS
- See also: mikrotik/editors/Sublime3 at master · martinclaro/mikrotik and mikrotik/editors/Sublime2 at master · martinclaro/mikrotik and Kentzo/MikrotikScript: Syntax highlighting and completions for the Mikrotik Scripting language for the Sublime Text editor
external editor syntax highlighting – MikroTik RouterOS (Notepad++, Textpad, VIM, EditPlus – look for the word Download and the .zip, .rar and .gz extensions)
- See also: mikrotik/syntax at master · olejor/mikrotik
Atom: language-routeros-script and ofstudio/atom-language-routeros-script: MikroTik RouterOS script language support in Atom
TextMate2: tiktuk / RouterOS.tmbundle — Bitbucket
GEdit: webpagetech/gedit-routeros: Mikrotik RouterOS code syntax highlighting for .rsc Files
Notepad++: jtroybailey/RouterOS-Notepad—Syntax-Highlighting: Syntax highlighting for routeros exports in notepad++

Pictures

CCR1009-8G-1S-1S+ General info & Questions – MikroTik RouterOS

Very well written blog:

Manito Network’s Mikrotik solutions blog. In-depth articles on Mikrotik routing, security, best practices, VPN, and more.

Source: Mikrotik — Manito Networks

Solutions for RouterOS-based Mikrotik networks. Includes security and best practices, VPN, routing, switching, and more.

Source: Mikrotik-1 — Manito Networks

–jeroen

Posted in DNS, Internet, IPSec, MikroTik, Network-and-equipment, OpenVPN, Power User, PPTP, routers, VPN | Leave a Comment »

OpenVPN – How to connect to Access Server from a Mac – basically says use Tunnelblick

Posted by jpluimers on 2016/03/18

Nice summary for just saying “Use Tunnelblick”

This howto article explains how to obtain and setup a Mac openvpn client to connect to the OpenVPN Access Server.

Source: How to connect to Access Server from a Mac

–jeroen

Posted in Apple, Mac, Mac OS X / OS X / MacOS, Mac OS X 10.5 Leopard, Mac OS X 10.6 Snow Leopard, Mac OS X 10.7 Lion, MacBook, MacBook Retina, MacBook-Air, MacBook-Pro, MacMini, OpenVPN, OS X 10.11 El Capitan, OS X 10.8 Mountain Lion, OS X 10.9 Mavericks, Power User | Leave a Comment »

OpenVPN connect to the same LAN (bridged mode) (via: The VPN Menu — Endian UTM Appliance v2.4 documentation)

Posted by jpluimers on 2012/08/03

Another research item:

Need to provide access through OpenVPN to the same LAN as where the OpenVPN server runs on.

This is unusual, and requires a bridged OpenVPN solution.

Jürgen Schmidt wrote a nice article on this in 2008.

Endian community edition seems to support this out of the box:

Server configuration

In this panel you can enable the OpenVPN server and define in which zone it should run.

OpenVPN server enabled

Click this to make sure the OpenVPN server is started.

Bridged

If you want to run the OpenVPN server in one of the existing zones check this box. ..

note:

If the OpenVPN server is not bridged you must set the firewall rules in the VPN firewall to make sure clients can access any zone - unless you do not want them to.

VPN subnet

This option is only available if you disable bridged mode, which allows you to run the OpenVPN server in its own subnet that can be specified here.

Bridge to

If bridged mode has been selected here you can choose to which zone the OpenVPN server should be bridged.

Dynamic IP pool start address

The first possible IP address in the network of the selected zone that should be used for the OpenVPN clients.

Dynamic IP pool end address

The last possible IP address in the network of the selected zone that should be used for the OpenVPN clients.

–jeroen

via: The VPN Menu — Endian UTM Appliance v2.4 documentation.

Posted in *nix, Endian, Linux, OpenVPN, Power User | Leave a Comment »

ENDIAN Firewall – Connected client can access EFW but no other hosts: enable promiscuous mode on VMware ESXi

Posted by jpluimers on 2010/10/12

While solving a problem with Windows 7 machines not being able to ping the machines on the GREEN LAN of an Endian when connecting through OpenVPN, but XP machines could, I did a few upgrades, then went on to solve the problem.

Upgraded from ESX 3.5 to ESXi 4.1 (I needed this anyway because of Pass Through USB support)
Upgraded the community edition appliance from Endian 2.2 to Endian 2.4 (which has more configuration options, and better ways for reporting and logging)

Then I went on solving the issue, which I suspected was a kind of routing problem. Read the rest of this entry »

Posted in Endian, ESXi4, ESXi5, ESXi5.1, Firewall, Infrastructure, OpenVPN, Power User, VMware, VMware ESXi | 8 Comments »

	Lars Fosdal on Security alarm provider Woonve…
	Thomas Mueller on Question got closed in May 202…
	Thaddy de Koning on Formulier voor bewindvoerders…
	Thaddy de Koning on Formulier voor bewindvoerders…
	Thaddy de Koning on Formulier voor bewindvoerders…

The Wiert Corner – irregular stream of stuff

Jeroen W. Pluimers on .NET, C#, Delphi, databases, and personal interests

Subscribe

Archives

Recent Comments

Recent Posts

Blog Stats

Meta title

Tag Cloud Title

Top Clicks

Top Posts

My badges

Twitter Updates

My Flickr Stream

Pages

All categories

Email Subscription

Archive for the ‘OpenVPN’ Category

OpenVPN somehow failed when tethering on the Android mobile hotspot from a new phone

Since about 5 months now, there has been a new Chocolatey package maintainer for OpenVPN

It looks like a volunteer has been found to maintain the openvpn chocolatey

Tools for TCP tunnels over HTTP/HTTPS

ssl/ssh multiplexer

With so many vulnerabilities out there, here is how to find out of if a fixed…

Some links for MikroTik tips and scripts

OpenVPN – How to connect to Access Server from a Mac – basically says use Tunnelblick

OpenVPN connect to the same LAN (bridged mode) (via: The VPN Menu — Endian UTM Appliance v2.4 documentation)

ENDIAN Firewall – Connected client can access EFW but no other hosts: enable promiscuous mode on VMware ESXi

Jeroen W. Pluimers on .NET, C#, Delphi, databases, and personal interests

Subscribe

Archives

Recent Comments

Recent Posts

Blog Stats

Meta title

Tag Cloud Title

Top Clicks

Top Posts

My badges

My Flickr Stream

Pages

All categories

Email Subscription

Archive for the ‘OpenVPN’ Category

Rate this:

Share this:

Rate this:

Share this:

Rate this:

Share this:

Rate this:

Share this:

Rate this:

Share this:

Rate this:

Share this:

Rate this:

Share this:

Rate this:

Share this:

Rate this:

Share this:

Rate this:

Share this: