DaemonForums  

Go Back   DaemonForums > OpenBSD > OpenBSD Security

OpenBSD Security Functionally paranoid!

Reply
 
Thread Tools Display Modes
  #1   (View Single Post)  
Old 10th September 2015
Peter_APIIT Peter_APIIT is offline
Shell Scout
 
Join Date: Jun 2008
Posts: 118
Default OpenVPN No Route To Host

Dear All,

I had tried to configure my gateway using openvpn connection but there is no route to host when ping the dns server.

Quote:
Internet:
Destination Gateway Flags Refs Use Mtu Prio Iface
0/1 10.9.1.121 UGS 0 64 - 8 tun1
default 60.53.43.254 UGS 5 128650 - 8 pppoe0
10.9.0.1/32 10.9.1.121 UGS 0 0 - 8 tun1
10.9.1.121 10.9.1.122 UH 3 0 - 4 tun1
10.9.1.122 10.9.1.122 UHl 0 0 - 1 lo0
60.53.42.149 60.53.42.149 UHl 0 0 - 1 lo0
60.53.43.254 60.53.42.149 UH 1 0 - 4 pppoe0
loopback localhost UGRS 0 0 32768 8 lo0
localhost localhost UHl 3 7035 32768 1 lo0
128/1 10.9.1.121 UGS 0 200 - 8 tun1
172.16.1/24 link#1 C 0 0 - 4 vr0
172.16.1.1 00:0d:88:17:bf:49 HLl 2 47384 - 1 lo0
172.16.1.255 link#1 HLb 0 0 - 1 vr0
178.162.193.233/32 60.53.43.254 UGS 0 0 - 8 pppoe0
BASE-ADDRESS.MCAST localhost URS 0 0 32768 8 lo0
May I know what wrong with it?
Should i edit the packet filter firewall?

By the way, this is my current pf configuration.
Quote:
################################################## #################################
match on pppoe0 scrub (reassemble tcp,random-id,no-df,max-mss 1440,min-ttl 64)
match out on pppoe0 inet from !(egress:network) to any nat-to (pppoe:0)

antispoof log for {$ext_if,$int_if}

block drop log

pass out on {pppoe0,$ext_if,$int_if} inet proto tcp modulate state
pass out on {pppoe0,$ext_if,$int_if} inet proto udp keep state
pass out on {pppoe0,$ext_if,$int_if} inet proto icmp all icmp-type echoreq keep state

# No Proxy #############

#Allow internal lan enter gateway
pass in log on $int_if inet proto tcp from any to any port $tcp modulate state (max 40,source-track rule,max-s
rc-nodes 40,max-src-states 40,max-src-conn 30,max-src-conn-rate 20/20)

pass in log on $int_if proto udp from any to any port $udp keep state (max 40, source-track rule,max-src-nodes
40,max-src-states 40,max-src-conn 30,max-src-conn-rate 20/20)

Please enlighten on this.
Reply With Quote
  #2   (View Single Post)  
Old 10th September 2015
Oko's Avatar
Oko Oko is offline
Rc.conf Instructor
 
Join Date: May 2008
Location: Kosovo, Serbia
Posts: 1,102
Default

I noticed that you have block drop log line in pf.conf. Client has to be able to pass out traffic on tun interface as well as being able to pass out udp port1194. Server has to accept connection on 1194. Server also has to allow traffic on its tun interface. You can treat tun interface as regular interface and tide up more restrictive rules.

Last edited by Oko; 14th September 2015 at 02:56 AM.
Reply With Quote
  #3   (View Single Post)  
Old 13th September 2015
Peter_APIIT Peter_APIIT is offline
Shell Scout
 
Join Date: Jun 2008
Posts: 118
Default

I had pass out for tun0 and doing NAT for the tun0 interface as well. What is pass out dup port1194?
I had configure the OpenVPN server and client on the same OpenBSD router.

Does this configuration make sense?
The purpose of I setup my own OpeVPN server is to avoid slow openvpn speed by free vpn provider and to avoid subscribe expensive openvpn plan.

Please enlighten on this.
Reply With Quote
  #4   (View Single Post)  
Old 14th September 2015
Oko's Avatar
Oko Oko is offline
Rc.conf Instructor
 
Join Date: May 2008
Location: Kosovo, Serbia
Posts: 1,102
Default

Quote:
Originally Posted by Peter_APIIT View Post
I had pass out for tun0 and doing NAT for the tun0 interface as well. What is pass out dup port1194?
I had configure the OpenVPN server and client on the same OpenBSD router.

Does this configuration make sense?
The purpose of I setup my own OpeVPN server is to avoid slow openvpn speed by free vpn provider and to avoid subscribe expensive openvpn plan.

Please enlighten on this.
I meant to say udp 1194. What do you mean by doing NAT for tun0? You should have only one line in pf before you debug which reads

Code:
pass on tun0
Also
Code:
# more /etc/hostname.tun0
up link0
!/usr/local/sbin/openvpn --daemon --config /etc/openvpn/server-apollo.conf
Finally here is server-apollo.conf configuration file

Code:
local xxx.xxx.xxx.xxx # replace xxx with the IP address on which you are listening
proto udp
dev tun

ca /etc/openvpn/ca.crt
cert /etc/openvpn/apollo.crt
key /etc/openvpn/private/apollo.key  # This file should be kept secret

dh dh2048.pem
server 10.9.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.6.0 255.255.255.0" # This is very important line 192.168.6.0/24 is my LAN network
client-to-client # My clients can talk to each other
keepalive 10 120
tls-auth /etc/openvpn/private/ta.key 0 
cipher AES-256-CBC
comp-lzo
max-clients 20
user _openvpn
group _openvpn
persist-key
persist-tun
status openvpn-status.log
verb 3
There is one extra line if you want Windows as a client. By the way the above runs on OpenBSD 5.7 amd64

Last edited by Oko; 14th September 2015 at 03:11 AM.
Reply With Quote
  #5   (View Single Post)  
Old 14th September 2015
Peter_APIIT Peter_APIIT is offline
Shell Scout
 
Join Date: Jun 2008
Posts: 118
Default

Thanks for the brief explanation. By the way, You still did not answer my question yet.

Questions:
I want to setup OpenVPN server on my OpenBSD router. I don't want use the free service because it is very slow and i don't have much budget to subscribe the VPN plan.

Can OpenVPN Server and client runs on same machine (Gateway) on OpenBSD? Means all outgoing internet connection will using vpn tunnel.

All my internal LAN not require to install OpenVPN. Thanks.
Reply With Quote
  #6   (View Single Post)  
Old 14th September 2015
jggimi's Avatar
jggimi jggimi is offline
More noise than signal
 
Join Date: May 2008
Location: USA
Posts: 6,377
Default

Quote:
Originally Posted by Peter_APIIT View Post
Can OpenVPN Server and client runs on same machine (Gateway) on OpenBSD? Means all outgoing internet connection will using vpn tunnel.
This indicates you do not understand what a VPN is, nor how one functions.

A VPN is established between two or more endpoints.

The graphic in https://en.wikipedia.org/wiki/Virtual_private_network will help, even if the text is beyond your comprehension.
Reply With Quote
  #7   (View Single Post)  
Old 14th September 2015
Oko's Avatar
Oko Oko is offline
Rc.conf Instructor
 
Join Date: May 2008
Location: Kosovo, Serbia
Posts: 1,102
Default

Quote:
Originally Posted by jggimi View Post
This indicates you do not understand what a VPN is, nor how one functions.
+1
Reply With Quote
  #8   (View Single Post)  
Old 16th September 2015
Peter_APIIT Peter_APIIT is offline
Shell Scout
 
Join Date: Jun 2008
Posts: 118
Smile

Quote:
Originally Posted by jggimi View Post
A VPN is established between two or more endpoints.
First, thanks jggmi for pointing the reference material.

Questions:
1. Can OpenVPN servers runs gateway and client connects from internal LAN or it must be WAN(end points)?

2. I'm need understanding of how connection is send after vpn connection had established to vpn server.

Client ------------> VPN Server (Packet Authentication HMAC finished)

Does all the internet connection needs to go through the VPN server or client directly interacts with internet?

Client -------> VPN Server --------> Internet

Thanks.

Last edited by Peter_APIIT; 16th September 2015 at 05:28 AM.
Reply With Quote
  #9   (View Single Post)  
Old 16th September 2015
jggimi's Avatar
jggimi jggimi is offline
More noise than signal
 
Join Date: May 2008
Location: USA
Posts: 6,377
Default

I'll try to keep this simple.

Imagine you are standing in a room that has a dozen computers in it. Imagine you are holding a single networking cable in your hands. That cable has two ends:



Let us imagine that you connect each end of this cable into two of the computers. The two computers are able to send signals back and forth, over this single cable. None of the other ten computers in the room has access to the signals travelling over the cable. The two computers are able to use this cable to communicate privately. They use this cable as a private network.

Imagine now, that you unplug the cable from those two computers, and carry it to a third computer. Now, imagine that you plug both ends of that cable into Ethernet ports on that single, third computer. Note that the third computer can't really use that cable for anything but talking to itself. It can't talk to any other computers in the room with it.

---

That imaginary room is the Internet. That imaginary cable is a VPN.

---

You keep asking how to plug both ends of a single cable into one computer, or into two computers in your home, then use that to communicate with other computers privately on the Internet. You don't. You can't.

-------------------------
Edited to add:

If you hire a third party VPN service, it's the same as hiring a local ISP from a security/privacy standpoint. Your communications exiting and entering the remote endpoint can still be monitored. And, depending on how encryption keys for the VPN are managed, the privacy of communication "tunnelled" within the VPN -- the virtual cable -- may be exposed. Lastly, the cable is only virtual. Encrypted traffic is still traffic. Metadata such as ip addresses, protocol, and port may disclose the VPN and its endpoints, and "side channel" metadata such as packet length and timing may disclose the type of communications being conducted.

Third party VPN service provider security/privacy was discussed with you previously, beginning here.

Last edited by jggimi; 16th September 2015 at 07:25 PM. Reason: clarity, security discussion added.
Reply With Quote
Old 16th September 2015
jggimi's Avatar
jggimi jggimi is offline
More noise than signal
 
Join Date: May 2008
Location: USA
Posts: 6,377
Default

I revised the post above, in case you missed it.
Reply With Quote
Old 18th September 2015
Peter_APIIT Peter_APIIT is offline
Shell Scout
 
Join Date: Jun 2008
Posts: 118
Default

The concept of Internet and Intranet using room as boundary is well explain. Moreover, connection information leaks such as IP address, metadata such as packet length and timing.

Moreover, a reliable/trustable ISP provider and .... is to depend on.

Problem solved. Thread closed.
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Route to enc0 WeakSauceIII OpenBSD Security 11 1st June 2015 07:40 PM
No Route to Host rtwingfield FreeBSD Installation and Upgrading 9 25th May 2015 03:05 AM
route on openbsd hpabsdbeginner1 OpenBSD General 2 15th April 2014 07:17 PM
Openvpn pf/nat/route-to issue lasstoff OpenBSD Security 3 16th January 2012 12:28 PM
ping: sendto: No route to host joostvgh OpenBSD General 2 29th April 2010 12:34 PM


All times are GMT. The time now is 06:27 AM.


Powered by vBulletin® Version 3.8.4
Copyright ©2000 - 2018, Jelsoft Enterprises Ltd.
Content copyright © 2007-2010, the authors
Daemon image copyright ©1988, Marshall Kirk McKusick