Home / user-67175

user569825's questions

Martin Hope
user569825
Asked: 2018-12-21 14:20:23 +0800 CST
  • 0

When I run sudo openvpn foo.conf I do not yet have a default gateway defined.

Once the connection is established, I run sudo ip route add default via X.X.X.X, where X.X.X.X is the local IP of the newly created tun interface.

That works perfectly fine.

Avoiding the manual step, I would like OpenVPN do this for me. So I add route default to the configuration.

This fails with: NOTE: unable to redirect default gateway -- Cannot read current default gateway from system

Why does it want a current default gateway when I would replace it anyway? How can I have OpenVPN add the default gateway correctly (without using external scripts)?

openvpn
Martin Hope
user569825
Asked: 2015-03-14 09:12:39 +0800 CST
  • 0

pfSense in version 2.2 switched from Racoon to strongSwan.

Since that change, users can no longer connect to the VPN from Android clients (Type IPSec Xauth PSK).

The current configuration on Android is as follows:

|_. Name                       | _[irrelevant]_  |
|_. Type                       | IPSec Auth PSK  |
|_. Server address             | $THE_PFSENSE_IP |
|_. IPSec identifier           | the.identifier  |
|_. IPSec pre-shared key       | 3yZuE7kLFGqOj79hRAqM3vQpPWC7DRlY6ep8hfoVtkZWVqNd8C3W |
|_. DNS search domains         | _[(not used}]_  |
|_. DNS servers                | _[(not used}]_  |
|_. Forwarding routes          | _$LOCAL_IP/32_  |

The current configuration on pfSense is as follows:

  • IPSec > Tunnels = Enable IPSec

Phase 1: Mobile Client

General information

|_. Disabled              | _[unset]_        |
|_. Key Exchange version  | _V1_             |
|_. Internet Protocol     | _IPv4_           |
|_. Interface             | WAN              |
|_. Description           | _[irrelevant]_   |

Phase 1 proposal (Authentication)

|_. Authentication method | _Mutual PSK + Xauth_ |
|_. Negotiation mode      | _Aggressive_         |
|_. My identifier         | _My IP address       |
|_. Peer identifier       | _Distinguished name_ _the.identifier_ |
|_. Pre-Shared Key        | 3yZuE7kLFGqOj79hRAqM3vQpPWC7DRlY6ep8hfoVtkZWVqNd8C3W |

Phase 1 proposal (Algorithms)

|_. Encryption algorithm  | _AES_ _256 bits_ |
|_. Hash algorithm        | _SHA1_           |
|_. DH key group          | _2 (1024 bit)_   |
|_. Lifetime              | _28800_ seconds  |

Advanced Options

|_. Disable Rekey         | _[unset]_        |
|_. Responder Only        | _[unset]_        |
|_. NAT Traversal         | _Auto_           |
|_. Dead Peer Detection   | _[enabled]_ _10_ seconds, _5_ retries |

Phase 2: Mobile Client

|_. Disabled              | _[unset]_        |
|_. Mode                  | _Tunnel IPv4_    |
|_. Local Network         | *Type:* _Address_ *Address:* _$LOCAL_IP_ *NAT:* _[none/empty]_ |
|_. Description           | _[irrelevant]_   |

Phase 2 proposal (SA/Key Exchange)

|_. Protocol              | _ESP_               |
|_. Encryption algorithms | _AES_ _auto_ *only* |
|_. Hash algorithms       | _SHA1_ *only*       |
|_. PFS key group         | _off_               |
|_. Lifetime              | _3600_ _seconds_    |

Advanced Options

|_. Automatically ping host | _[empty]_         |

Log Output on pfSense

IPSec Log (startup)

 
Mar 23 02:10:43  ipsec_starter[88815]: Starting weakSwan 5.2.1 IPsec [starter]...
Mar 23 02:10:43  ipsec_starter[88815]: no netkey IPsec stack detected
Mar 23 02:10:43  ipsec_starter[88815]: no KLIPS IPsec stack detected
Mar 23 02:10:43  ipsec_starter[88815]: no known IPsec stack detected, ignoring!
Mar 23 02:10:43  charon: 00[DMN] Starting IKE charon daemon (strongSwan 5.2.1, FreeBSD 10.1-RELEASE-p6, i386)
Mar 23 02:10:44  charon: 00[KNL] unable to set UDP_ENCAP: Invalid argument
Mar 23 02:10:44  charon: 00[NET] enabling UDP decapsulation for IPv6 on port 4500 failed
Mar 23 02:10:44  charon: 00[CFG] ipseckey plugin is disabled
Mar 23 02:10:44  charon: 00[CFG] loading ca certificates from '/var/etc/ipsec/ipsec.d/cacerts'
Mar 23 02:10:44  charon: 00[CFG] loaded ca certificate "$CERT1_INFO" from '/var/etc/ipsec/ipsec.d/cacerts/a85fc367.0.crt'
Mar 23 02:10:44  charon: 00[CFG] loaded ca certificate "$CERT2_INFO" from '/var/etc/ipsec/ipsec.d/cacerts/5eb84096.0.crt'
Mar 23 02:10:44  charon: 00[CFG] loaded ca certificate "$CERT3_INFO" from '/var/etc/ipsec/ipsec.d/cacerts/16eb0859.0.crt'
Mar 23 02:10:44  charon: 00[CFG] loaded ca certificate "$CERT4_INFO" from '/var/etc/ipsec/ipsec.d/cacerts/e06d03ef.0.crt'
Mar 23 02:10:44  charon: 00[CFG] loaded ca certificate "$CERT5_INFO" from '/var/etc/ipsec/ipsec.d/cacerts/01c1b386.0.crt'
Mar 23 02:10:44  charon: 00[CFG] loading aa certificates from '/var/etc/ipsec/ipsec.d/aacerts'
Mar 23 02:10:44  charon: 00[CFG] loading ocsp signer certificates from '/var/etc/ipsec/ipsec.d/ocspcerts'
Mar 23 02:10:44  charon: 00[CFG] loading attribute certificates from '/var/etc/ipsec/ipsec.d/acerts'
Mar 23 02:10:44  charon: 00[CFG] loading crls from '/var/etc/ipsec/ipsec.d/crls'
Mar 23 02:10:44  charon: 00[CFG] loading secrets from '/var/etc/ipsec/ipsec.secrets'
Mar 23 02:10:44  charon: 00[CFG] loaded IKE secret for $PFSENSE_IP the.identifier
Mar 23 02:10:44  charon: 00[CFG] loaded IKE secret for %any the.identifier
Mar 23 02:10:44  charon: 00[CFG] opening triplet file /var/etc/ipsec/ipsec.d/triplets.dat failed: No such file or directory
Mar 23 02:10:44  charon: 00[CFG] loaded 0 RADIUS server configurations
Mar 23 02:10:44  charon: 00[LIB] loaded plugins: charon unbound aes des blowfish rc2 sha1 sha2 md4 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey ipseckey pem openssl fips-prf gmp xcbc cmac hmac curl attr kernel-pfkey kernel-pfroute resolve socket-default stroke smp updown eap-identity eap-sim eap-aka eap-aka-3gpp2 eap-md5 eap-mschapv2 eap-dynamic eap-radius eap-tls eap-ttls eap-peap xauth-generic xauth-eap whitelist addrblock unity
Mar 23 02:10:44  charon: 00[LIB] unable to load 6 plugin features (5 due to unmet dependencies)
Mar 23 02:10:44  charon: 00[JOB] spawning 16 worker threads
Mar 23 02:10:44  ipsec_starter[89411]: charon (89559) started after 600 ms
Mar 23 02:10:44  charon: 06[CFG] received stroke: add connection 'con1'
Mar 23 02:10:44  charon: 06[CFG] adding virtual IP address pool 192.168.97.0/24
Mar 23 02:10:44  charon: 06[CFG] added configuration 'con1'
Mar 23 02:11:02  charon: 06[CFG] rereading secrets
Mar 23 02:11:02  charon: 06[CFG] loading secrets from '/var/etc/ipsec/ipsec.secrets'
Mar 23 02:11:02  charon: 06[CFG] loaded IKE secret for $PFSENSE_IP the.identifier
Mar 23 02:11:02  charon: 06[CFG] loaded IKE secret for %any the.identifier
Mar 23 02:11:02  charon: 06[CFG] rereading ca certificates from '/var/etc/ipsec/ipsec.d/cacerts'
Mar 23 02:11:02  charon: 06[CFG] loaded ca certificate "$CERT1_INFO" from '/var/etc/ipsec/ipsec.d/cacerts/a85fc367.0.crt'
Mar 23 02:11:02  charon: 06[CFG] loaded ca certificate "$CERT2_INFO" from '/var/etc/ipsec/ipsec.d/cacerts/5eb84096.0.crt'
Mar 23 02:11:02  charon: 06[CFG] loaded ca certificate "$CERT3_INFO" from '/var/etc/ipsec/ipsec.d/cacerts/16eb0859.0.crt'
Mar 23 02:11:02  charon: 06[CFG] loaded ca certificate "$CERT4_INFO" from '/var/etc/ipsec/ipsec.d/cacerts/e06d03ef.0.crt'
Mar 23 02:11:02  charon: 06[CFG] loaded ca certificate "$CERT5_INFO" from '/var/etc/ipsec/ipsec.d/cacerts/01c1b386.0.crt'
Mar 23 02:11:02  charon: 06[CFG] rereading ocsp signer certificates from '/var/etc/ipsec/ipsec.d/ocspcerts'
Mar 23 02:11:02  charon: 06[CFG] rereading aa certificates from '/var/etc/ipsec/ipsec.d/aacerts'
Mar 23 02:11:02  charon: 06[CFG] rereading attribute certificates from '/var/etc/ipsec/ipsec.d/acerts'
Mar 23 02:11:02  charon: 06[CFG] rereading crls from '/var/etc/ipsec/ipsec.d/crls'

IPSec Log (connection)

Mar 23 02:13:50  charon: 14[ENC] parsed AGGRESSIVE request 0 [ SA KE No ID V V V V V V V V ]
Mar 23 02:13:50  charon: 14[IKE]  received FRAGMENTATION vendor ID
Mar 23 02:13:50  charon: 14[IKE] received FRAGMENTATION vendor ID
Mar 23 02:13:50  charon: 14[IKE]  received NAT-T (RFC 3947) vendor ID
Mar 23 02:13:50  charon: 14[IKE] received NAT-T (RFC 3947) vendor ID
Mar 23 02:13:50  charon: 14[IKE]  received draft-ietf-ipsec-nat-t-ike-02 vendor ID
Mar 23 02:13:50  charon: 14[IKE] received draft-ietf-ipsec-nat-t-ike-02 vendor ID
Mar 23 02:13:50  charon: 14[IKE]  received draft-ietf-ipsec-nat-t-ike-02\n vendor ID
Mar 23 02:13:50  charon: 14[IKE] received draft-ietf-ipsec-nat-t-ike-02\n vendor ID
Mar 23 02:13:50  charon: 14[IKE]  received draft-ietf-ipsec-nat-t-ike-00 vendor ID
Mar 23 02:13:50  charon: 14[IKE] received draft-ietf-ipsec-nat-t-ike-00 vendor ID
Mar 23 02:13:50  charon: 14[IKE]  received XAuth vendor ID
Mar 23 02:13:50  charon: 14[IKE] received XAuth vendor ID
Mar 23 02:13:50  charon: 14[IKE]  received Cisco Unity vendor ID
Mar 23 02:13:50  charon: 14[IKE] received Cisco Unity vendor ID
Mar 23 02:13:50  charon: 14[IKE]  received DPD vendor ID
Mar 23 02:13:50  charon: 14[IKE] received DPD vendor ID
Mar 23 02:13:50  charon: 14[IKE]  $REMOTE_IP is initiating a Aggressive Mode IKE_SA
Mar 23 02:13:50  charon: 14[IKE] $REMOTE_IP is initiating a Aggressive Mode IKE_SA
Mar 23 02:13:50  charon: 14[CFG] looking for XAuthInitPSK peer configs matching $PFSENSE_IP...$REMOTE_IP[the.identifier]
Mar 23 02:13:50  charon: 14[CFG] selected peer config "con1"
Mar 23 02:13:50  charon: 14[ENC] generating AGGRESSIVE response 0 [ SA KE No ID NAT-D NAT-D HASH V V V V V ]
Mar 23 02:13:50  charon: 14[NET] sending packet: from $PFSENSE_IP[500] to $REMOTE_IP[500] (432 bytes)
Mar 23 02:13:52  charon: 14[NET] received packet: from $REMOTE_IP[500] to $PFSENSE_IP[500] (646 bytes)
Mar 23 02:13:52  charon: 14[IKE]  received retransmit of request with ID 0, retransmitting response
Mar 23 02:13:52  charon: 14[IKE] received retransmit of request with ID 0, retransmitting response
Mar 23 02:13:52  charon: 14[NET] sending packet: from $PFSENSE_IP[500] to $REMOTE_IP[500] (432 bytes)
Mar 23 02:13:54  charon: 14[IKE]  sending retransmit 1 of response message ID 0, seq 1
Mar 23 02:13:54  charon: 14[IKE] sending retransmit 1 of response message ID 0, seq 1
Mar 23 02:13:54  charon: 14[NET] sending packet: from $PFSENSE_IP[500] to $REMOTE_IP[500] (432 bytes)
Mar 23 02:13:55  charon: 14[NET] received packet: from $REMOTE_IP[500] to $PFSENSE_IP[500] (646 bytes)
Mar 23 02:13:55  charon: 14[IKE]  received retransmit of request with ID 0, retransmitting response
Mar 23 02:13:55  charon: 14[IKE] received retransmit of request with ID 0, retransmitting response
Mar 23 02:13:55  charon: 14[NET] sending packet: from $PFSENSE_IP[500] to $REMOTE_IP[500] (432 bytes)
Mar 23 02:13:59  charon: 14[NET] received packet: from $REMOTE_IP[500] to $PFSENSE_IP[500] (646 bytes)
Mar 23 02:13:59  charon: 14[IKE]  received retransmit of request with ID 0, retransmitting response
Mar 23 02:13:59  charon: 14[IKE] received retransmit of request with ID 0, retransmitting response
Mar 23 02:13:59  charon: 14[NET] sending packet: from $PFSENSE_IP[500] to $REMOTE_IP[500] (432 bytes)
Mar 23 02:14:01  charon: 14[IKE]  sending retransmit 2 of response message ID 0, seq 1
Mar 23 02:14:01  charon: 14[IKE] sending retransmit 2 of response message ID 0, seq 1
Mar 23 02:14:01  charon: 14[NET] sending packet: from $PFSENSE_IP[500] to $REMOTE_IP[500] (432 bytes)
Mar 23 02:14:01  charon: 14[NET] received packet: from $REMOTE_IP[500] to $PFSENSE_IP[500] (646 bytes)
Mar 23 02:14:01  charon: 14[IKE]  received retransmit of request with ID 0, retransmitting response
Mar 23 02:14:01  charon: 14[IKE] received retransmit of request with ID 0, retransmitting response
Mar 23 02:14:01  charon: 14[NET] sending packet: from $PFSENSE_IP[500] to $REMOTE_IP[500] (432 bytes)
Mar 23 02:14:05  charon: 16[NET] received packet: from $REMOTE_IP[500] to $PFSENSE_IP[500] (646 bytes)
Mar 23 02:14:05  charon: 16[IKE]  received retransmit of request with ID 0, retransmitting response
Mar 23 02:14:05  charon: 16[IKE] received retransmit of request with ID 0, retransmitting response
Mar 23 02:14:05  charon: 16[NET] sending packet: from $PFSENSE_IP[500] to $REMOTE_IP[500] (432 bytes)
Mar 23 02:14:07  charon: 16[NET] received packet: from $REMOTE_IP[500] to $PFSENSE_IP[500] (646 bytes)
Mar 23 02:14:07  charon: 16[IKE]  received retransmit of request with ID 0, retransmitting response
Mar 23 02:14:07  charon: 16[IKE] received retransmit of request with ID 0, retransmitting response
Mar 23 02:14:07  charon: 16[NET] sending packet: from $PFSENSE_IP[500] to $REMOTE_IP[500] (432 bytes)
Mar 23 02:14:11  charon: 16[NET] received packet: from $REMOTE_IP[500] to $PFSENSE_IP[500] (646 bytes)
Mar 23 02:14:11  charon: 16[IKE]  received retransmit of request with ID 0, retransmitting response
Mar 23 02:14:11  charon: 16[IKE] received retransmit of request with ID 0, retransmitting response
Mar 23 02:14:11  charon: 16[NET] sending packet: from $PFSENSE_IP[500] to $REMOTE_IP[500] (432 bytes)
Mar 23 02:14:13  charon: 16[NET] received packet: from $REMOTE_IP[500] to $PFSENSE_IP[500] (646 bytes)
Mar 23 02:14:13  charon: 16[IKE]  received retransmit of request with ID 0, retransmitting response
Mar 23 02:14:13  charon: 16[IKE] received retransmit of request with ID 0, retransmitting response
Mar 23 02:14:13  charon: 16[NET] sending packet: from $PFSENSE_IP[500] to $REMOTE_IP[500] (432 bytes)
Mar 23 02:14:14  charon: 16[IKE]  sending retransmit 3 of response message ID 0, seq 1
Mar 23 02:14:14  charon: 16[IKE] sending retransmit 3 of response message ID 0, seq 1
Mar 23 02:14:14  charon: 16[NET] sending packet: from $PFSENSE_IP[500] to $REMOTE_IP[500] (432 bytes)
Mar 23 02:14:16  charon: 16[NET] received packet: from $REMOTE_IP[500] to $PFSENSE_IP[500] (646 bytes)
Mar 23 02:14:16  charon: 16[IKE]  received retransmit of request with ID 0, retransmitting response
Mar 23 02:14:16  charon: 16[IKE] received retransmit of request with ID 0, retransmitting response
Mar 23 02:14:16  charon: 16[NET] sending packet: from $PFSENSE_IP[500] to $REMOTE_IP[500] (432 bytes)
Mar 23 02:14:20  charon: 16[JOB] deleting half open IKE_SA after timeout

What could be the reasons for the connection to fail and how may they be resolved?

vpn
Martin Hope
user569825
Asked: 2015-03-12 09:28:58 +0800 CST
  • 1

In Exim I have one file per domain where the filename itself is used to determine the domain for the aliases.

For example, I'd have a file named example.org with contents like this:

foo:      somelocaluser

This causes mail to [email protected] to be delivered to somelocaluser.

In Postfix the common setup is to use the file named virtual and repeat the domain for every local part over and over again:

[email protected]: somelocaluser
[email protected]: somelocaluser

How can I achieve my Exim-style setup in Postfix and thus avoid the repetiton?

postfix
Martin Hope
user569825
Asked: 2014-07-02 13:30:39 +0800 CST
  • 0

I set up pfSense to connect to a remote network (192.168.122.0/24) that only accepts tap connections.

The connection is being initiated successfully.

pfSense (192.168.1.1/24) itself can connect to remote hosts:

pfsense# traceroute -n 192.168.122.1
traceroute to 192.168.122.1 (192.168.122.1), 64 hops max, 40 byte packets
 1  192.168.122.1  116.968 ms  54.357 ms  52.655 ms

Hosts on the pfSenses' LAN network (e.g. 192.168.1.8/24) fail to connect:

lan-machine# traceroute -n 192.168.122.1
traceroute to 192.168.122.1 (192.168.122.1), 30 hops max, 60 byte packets
 1  192.168.1.1  0.283 ms  0.303 ms  0.379 ms

UPDATE: Running a ping from LAN to a host fails, but tcpdump on pfSense shows that the packets are correctly forwarded:

lan-machine# ping 192.168.122.1
pfsense# tcpdump -vvi ovpnc4
tcpdump: listening on ovpnc4, link-type EN10MB (Ethernet), capture size 96 bytes
11:54:06.975866 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto ICMP (1), length 84)
    192.168.1.8 > 192.168.122.1: ICMP echo request, id 23622, seq 106, length 64

What is necessary in order to have the interface route correctly?

(Note that LAN net needs to stay 192.168.1.0/24)

openvpn
Martin Hope
user569825
Asked: 2011-08-17 00:55:22 +0800 CST
  • 9

I want to 301 redirect all example.org to www.example.org. The following example is doing just that, but it's got a lot of noise to it and is thus hard to maintain and error prone:

<VirtualHost 192.0.2.123:80>
        ServerName      example.org
        RedirectPermanent       /               http://www.example.org
</VirtualHost>
<VirtualHost 192.0.2.123:80>
        ServerName      www.example.org
        DocumentRoot    /usr/local/www/example
</VirtualHost>

Do you happen to know if there's some shorter version for the whole thing above?

Something like this pseudo-config:

<VirtualHost 192.0.2.123:80>
        ServerName      www.example.org
        ServerAlias     example.org
#       Redirect-Every-ServerAlias-To-ServerName
        DocumentRoot    /usr/local/www/example
</VirtualHost>

So that way I would just need to provide every subdomain that should be redirected under ServerAlias ?

apache-2.2 httpd.conf mod-rewrite mod-alias
Martin Hope
user569825
Asked: 2011-01-29 01:39:10 +0800 CST
  • 0

Is there a way to automatically display a notification page (some styled "we will be back soon") in case a webserver fails?

How would that work, considering the domain would have to "suddenly" display the content of a different IP address?

Also, considering that the above would not propagate to all DNS instantly anyways, which solutions are there?

tomcat domain-name-system apache-2.2 monitoring 503-error