uncovery's questions

I am using Android to connect to my WireGuard server through the public IP address of the host network. The LAN is using addresses 192.168.0.1-255. I would like the client to connect through the VPN only to addresses with in the LAN and directly access the others. The config is as follows:

[Interface]
PrivateKey = xxx=
Address = 198.18.7.4/32
DNS = 192.168.0.1

[Peer]
PublicKey = xxx=
AllowedIPs = 192.168.0.1/24
Endpoint = my.public.IP:51820

But I am getting a "Bad Address" for whatever I tried to use except for /32. Not being familiar with Subnet Address scheme, I tried to use the table and calculator here which seems to tell me that /24 is the correct subnet. On Windows this seems to work fine.

Any Idea what can be wrong here? Is the AllowedIPs wrong? Or is there an issue with Android that is not in my control?

Thanks!

QNAP's QTS version 5 has now Wireguard as a protocol in QVPN. There is however - as opposed to to OpenVPN - no option to download an easy-to setup config file to quickly connect a client to your NAS.

It seems that users need to create their own Wireguard config file to get this running. As I do not know the syntax of these files, what do I need to do to switch from OpenVPN to Wireguard?

I have a custom DNS server in my network that I want all clients to use (it has ad-filters etc, similar to PiHole).

I have set my router (LinkSys Velop) to use this DNS server. However, on the DNS server's admin page, I see only the Router doing DNS queries, not the clients. I would assume that the router (sooner or later) tells the clients to use the specific DNS server. Despite restarting the clients (and doing various other network reset actions such as ipconfig /flushdns etc, they do not seem to access the DNS server directly however: only the router does.

So far, the only way I could get the clients access the DNS server directly was by entering the DNS Server manually at the client network config.

So questions:

• Is this expected behavior?
• Is the DNS setting in a (or only my?) router simply making the router continue to "act" as a DNS server and re-direct the request to the set IP address, then sending the result back?
• What do I have to do so that clients set a specific IP address as a DNS server? Do I have to setup my own DHCP server?
• Do the usual (e.g. ISC DHCP as in CentOS?) linux DHCP servers tell the client which DNS server to use or do they as well just forward the requests instead?

thanks!

I used this guide here to setup wireguard on a CentOS machine.

I have my private key, my public key, the firewall and my wg0.conf:

[Interface]
Address = 192.168.5.1/24
SaveConfig = true
ListenPort = 31194
PrivateKey = <from the private key file>
EndPoint = mydynamic_dns_name.com:31194

[Peer]
PublicKey = <the public key generated on my client>
AllowedIPs = 192.168.5.2/32

When I run wg it shows this config as well. When I try to create a QR code with this config using the command

grep -v '^#' /etc/wireguard/wg0.conf | qrencode -t ansiutf8

I get the following error:

Unable to import Tunnel: Unknown attribute in interface.

I tried to setup a client manually on Android, using this here:

[Interface]
Address = 192.168.5.2/24
PrivateKey = <generated by the cellpgone>

[Peer]
AllowedIPs = 0.0.0.0/24
Endpoint = mydynamic_dns_name.com:31194
PublicKey = <public key from my server>

When I try to connect, it says that it's connected instantly but transfers no data over the connection. When I check my external IP it's still that of the cell provider.

I have my router setup to forward the port to the centos in my local network.

I don't know how to proceed from here or to debug this.

I have a example that should always result in https://example.com, even when the user is entering www.example.com, https or not. Ideally, the automated letsencrypt config https config file should work.

• I have tried to remove the A-record for www and use a CNAME instead to point to example.com or @. This does not seem to have any effect and users still end up on www. I have no idea why.

This is my current config:

<VirtualHost [IPV6]:80 IPV4:80>
    ServerAdmin [email protected]
    DocumentRoot /home/example/public_html
    ServerName example.com
    ServerAlias www.example.com
    ErrorLog logs/example.error.log
    CustomLog logs/example.acccess.log common
    <Directory /home/example/public_html>
        Options FollowSymLinks
        AllowOverride All
    </Directory>
    RewriteEngine on 
    RewriteCond %{SERVER_NAME} =example.com [OR] 
    RewriteCond %{SERVER_NAME} =www.example.com 
    RewriteRule ^ https://example.com%{REQUEST_URI} [END,NE,R=permanent] 
</VirtualHost>

<VirtualHost [IPV6]:443 IPV4:443>
    ServerAdmin [email protected]
    DocumentRoot /home/example/public_html
    ServerName example.com
    ServerAlias www.example.com
    ErrorLog logs/example.error.log
    CustomLog logs/example.acccess.log common
    <Directory /home/example/public_html>
        Options FollowSymLinks
        AllowOverride All
    </Directory>
Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateFile /etc/letsencrypt/live/example.com/cert.pem
SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
SSLCertificateChainFile /etc/letsencrypt/live/example.com/chain.pem
</VirtualHost>

Then however, https://www.example.com throws a bad certificate, even if I add this to the :443 config:

    RewriteCond %{SERVER_NAME} =www.example.com 
    RewriteRule ^ https://example.com%{REQUEST_URI} [END,NE,R=permanent] 

How can I redirect http AND https requests to www.example.com to https://example.com?

while testing my DKIM/SPF config by using the port25.com email service, I am getting the following reply for my SPF record:

permerror (DNS void lookup limit exceeded)

However, my spf record does not have any "include":

v=spf1 mx a ip4:IP1 ip4:IP2 ip6:IP3 ~all

any idea what is going on?

When I am using https://dkimvalidator.com/results, I get a pass on the SPF.

I have checked the docs at https://mxtoolbox.com/problem/spf/spf-void-lookups and found this here:

"The void lookup limit was introduced in RFC 7208 and refers to DNS lookups which either return an empty response (NOERROR with no answers) or an NXDOMAIN response."

It's not doing ant DNS lookups, or is it?

I am using certbot/letsencrypt from the EPEL repository with apache on CentOS 7 without any issues on "normal" domain names. The certbot tool recognizes server name aliases from the virtualhost config files just fine. Renewal also works fine.

For example, a line in a virtualhost config such as:

ServerName uncovery.net
ServerAlias www.uncovery.net

results in certbot offering me to install/maintain the domain names

1: uncovery.net
2: www.uncovery.net

However, this line in my virtualhost config:

ServerName uncovery.net
ServerAlias *.uncovery.net

only shows

1: uncovery.net

when running certbot.

So I tried the following:

# certbot -d *.uncovery.net
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache
Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org
Obtaining a new certificate
Performing the following challenges:
Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA. You may need to use an authenticator plugin that can do challenges over DNS.

I tried apache/webroot/standalone authenticators, all fail. The debug log states that

ConfigurationError: *.uncovery.net contains an invalid character. Valid characters are A-Z, a-z, 0-9, ., and -.

So questions:

1) How can I make the command line interface of certbot recognize the *.wildcard?

2) If that does not work, how do I manually configure the certificate?

Here is my certbot version:

Package certbot-1.0.0-1.el7.noarch already installed and latest version
Package python2-certbot-apache-1.0.0-1.el7.noarch already installed and latest version

I am trying to install ImageMagick-devel on my CentOS 8.0.1905, but I get the following error:

# yum install ImageMagick-devel
Last metadata expiration check: 2:58:25 ago on Mon 18 Nov 2019 06:58:06 PM EST.
Error:
 Problem: conflicting requests
  - nothing provides jasper-devel needed by ImageMagick-devel-6.9.10.64-1.el8.x86_64
  - nothing provides OpenEXR-devel needed by ImageMagick-devel-6.9.10.64-1.el8.x86_64
  - nothing provides ghostscript-devel needed by ImageMagick-devel-6.9.10.64-1.el8.x86_64
  - nothing provides lcms2-devel needed by ImageMagick-devel-6.9.10.64-1.el8.x86_64

any idea how to resolve this?

So I recently ran into this problem and want to describe the issue and the solution here:

I have several virtualhosts on a httpd server and started to install letsencrypt SSL certificates on it via the certbot-auto tool.

This was working fine initially until some domains would throw errors in the browser that the certificate belongs to another domain and is not secure. The SSL setup for the domain was identical with those of other, working SSL setups. All of them are on the same IP address, the config was created by the certbot-auto tool. The domain shown in the browser as being the wrong domain that the ssl certificate points to was one of the other domains on the system.

I am trying to install the latest version of btsyc on a CentOS 6.5 headless server. I cannot reach the WebUI.

I configured the webui on port 65000 via a config file and start btsync with the config file as an argument. This is confirmed by the command line reply when I start the service:

Webui is listening on 0.0.0.0:65000

The service itself is configured to run on port 8888. When I run lsof -Pnl +M -i4, I get the following output:

btsync 25687 500 9u IPv4 536416051 0t0 TCP *:8888 (LISTEN)

btsync 25687 500 10u IPv4 536416052 0t0 UDP *:8888

btsync 25687 500 13u IPv4 536416060 0t0 UDP *:3838

Nothing else seems to be listening on 65000. I tried netstat -tulpn as well and the results are the same. I added a rule to iptables and Iptables -L returns (among others):

ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:65000

Here are all the firewall rules. But anyhow, I tried to run btsync after having stopped the iptables service completely, and it was the same result.

The logfile sows the following:

[20160521 17:24:25.687] Configuration from file "/home/includes/btsync/btsync.conf" has been applied
[20160521 17:24:25.690] ZIP: Can't locate [version] in zip, error -100.
[20160521 17:24:25.692] PLC[0x000000000225a8c0] binding on 0.0.0.0:8888
[20160521 17:24:25.692] Socket[0x000000000225a8c0][9] bound listening socket 9 to IP 0.0.0.0:8888
[20160521 17:24:25.692] UDP: bound listening socket 10 to IP 0.0.0.0:8888
[20160521 17:24:25.694] test sha1: ****************
[20160521 17:24:25.694] test sha2: ****************
[20160521 17:24:25.694] test aes: ****************
[20160521 17:24:25.694] Loading config file version 2.3.7, current version 2.3.7
[20160521 17:24:25.694] My PeerID: 107408D3698D9BCA3EF7D****************
[20160521 17:24:25.695] LC: LoadLicenses: there is no pro license
[20160521 17:24:25.695] loaded history: 0 events
[20160521 17:24:25.697] setup socket 13 for local peer discovery for 127.0.0.1: success
[20160521 17:24:25.697] Debug log mask has been set to FFFFFFFF
[20160521 17:24:25.697] Features mask has been set to 0
[20160521 17:24:56.835] OpenSSL: Loaded X509 trusted CA from "/etc/pki/tls/certs/ca-bundle.crt"

I tried to run webui on a different port, the result is the same. I also tried to bind the webui on my server's IP address instead of 0.0.0.0, same result. Any ideas?

[Update] So I started this whole process again with a default config and on port 8888 and now it worked. As a recommendation for people in the future who have such an issue, try to use this command here:

curl -k http://xxx.xxx.x.xxx:8888/gui -v 

to see if the server is running from the server's command line. It should show a quite long bunch of HTML if the server is running properly. If that works, try to amend the config file from there on

My CentOS server has several IP addresses. There are different virtualhosts configured per IP address on apache. When I send an email via PHP/sendmail, I want that sendmail uses the hostname that is matched to the IP configured in the /etc/hosts file.

Is that possible?

I am running monitorix on CentOS using my apache server (as opposed to the built-in server) wit the following addition to the virtualhost:

Alias /monitorix /usr/share/monitorix
<Directory /usr/share/monitorix>
    Options -Indexes +FollowSymLinks
    Order allow,deny
    Allow from all
    AllowOverride All
</Directory>
<Directory /usr/share/monitorix/cgi>
    AddHandler cgi-script .cgi
    SetHandler perl-script
    PerlResponseHandler ModPerl::Registry
    PerlOptions +ParseHeaders
    Options +ExecCGI +FollowSymLinks
    Allow from all
    AllowOverride All
</Directory>

Further, the following config for monitorix itself:

base_dir = /usr/share/monitorix/
base_lib = /usr/lib/monitorix/
base_url = /monitorix
base_cgi = /monitorix/cgi

when I open the URL http://domain.com/monitorix, I get the HTML interface properly displaying Monitorix version v3.4.0. so the httpd config seems to work fine.

when I click on the [OK] button, I get this error:

FATAL: Monitorix is unable to continue!

File 'monitorix.conf.path' was not found.

Please make sure that 'base_dir' option is correctly configured and this CGI (monitorix.cgi) is located in the 'base_dir'/cgi/ directory.

And don't forget to restart Monitorix for the changes to take effect!

my http logfile shows this:

[Fri Mar 28 10:26:01 2014] [error] FATAL: File 'monitorix.conf.path' was not found! at /usr/share/monitorix/cgi/monitorix.cgi line 210.\n

which tells me that CGI works fine too. The paths in the httpd confirg seem also to be ok and match the paths in the monitorix config seem also to be correct.

But somehow the path is not OK. I tried the base_dir with and without trailing slashes, but that did not help.

the file /usr/share/monitorix/cgi/monitorix.cgi before line 210 tries to

open(IN, "< monitorix.conf.path");
my $config_path = <IN>;
chomp($config_path);
close(IN);

the file /usr/share/monitorix/cgi/monitorix.conf.path exists, too.

I do not know PERL very well, anyone can tell me what is wrong here?