Ricardo Marimon's questions

I'm trying to connect clients that belong to two different OpenVPN servers. These servers share a network on eth0:0. Both servers can ping each other.

The first thing that is not working is that I can't access Client A from OpenVPN server B. I wrongly assumed that by issuing ip route add 10.170.0.0/16 via 192.168.160.121 on OpenVPN server B it would be sufficient. But I now believe that I have to do something else on OpenVPN server A to get the return traffic working. I've spent two hours googling and can't for the life of me find a solution.

Eventually I need for Client B to reach Client A.

Any pointers?

This is a diagram of my network with the result from ip route show for each.

I have three servers that currently have ips 192.168.1.1, 192.168.1.2, and 192.168.1.3. They can see each other and talk to each other. I would like to create a second subnet, on top of the 192.168.1.x, which is 10.170.x.x.

I can assign ips to each of the three servers, 10.170.0.1, 10.170.0.2 and 10.170.0.3, with ip addr add 10.170.0.1 dev eth0. The problem I'm having is how to do the routing. I can't ping any server over the 10.170.x.x network. I believe that I need to create some peer-to-peer bridges but I have no clue on how to get started. Any ideas?

I have two servers, each running an openvpn service, the first one (uno) has the vpn range 10.170.0.0/16 tied to UDP 1194, and the second one (dos) has 10.180.0.0/16 tied to TCP 443. I would like to have clients on one server have access to clients in the other server. I have already incorporated the client-to-client option on both, and it works when both clients are in the same server. Not when both clients are on different servers.

Both servers are hosted in linode and have their public IP addresses. Additionally linode allows to create local addresses tied to virtual interface eth0:0 that connects both servers on a local switch. I'm trying to create a route between the two servers by adding:

On uno:

route add -net 10.180.0.0 netmask 255.255.0.0 gateway (the eth0:0 address of dos)

On dos:

route add -net 10.170.0.0 netmask 255.255.0.0 gateway (the eth0:0 address of uno)

I dont't have any firewalls enabled on either server. It would seem that I could ping 10.170.0.1 (the tun0 interface in uno) from dos. But no... oh no... it couldn't be this easy. Can anyone shed any lights as to why? and how to solve it? If I can't ping the two servers from each other, of course that that the clients can't see them either. Any ideas?

Our company manages over one hundred servers and we would like to "ask" these servers for basic usage info once or twice a day using http. The usage info can be easily found with a perl cgi script and we would like to have an http interface to ease the creation of scripts and testing them. It seems an overkill to have apache, or even nginx+fcgiwrap, to serve one or two requests per day. We were thinking of using openbsd-inetd (which is already installed in all the servers) to launch a web server that could easily pass the request to the perl cgi script. What are good alternatives to do this?

I have an openvpn setup that is working great. There are some 50 clients connected and everything is handy dandy. I need one of these clients to route all traffic trough the vpn. I setup a ccd for that particular client and added the push "redirect-gateway def1" to it. The routing table seems to be updated in the client. I can access all the hosts in the vpn but can't access anything else outside the vpn. When tracerouting from the client, everything goes to the vpn gateway, but after that not further. I believe the culprit is the iptables configuration in the server.

This is the setup

• I have an openvpn using the subnet 10.170.x.x with the vpn gateway at 10.170.0.1 (VPNGATEWAY)
• I have different subnet 10.171.x.x that gets its ip assigned via ccd records (this is the admin network and has 3 clients)
• The client that I want to have all its traffic trough the vpn is 10.171.0.1 (CLIENT)

From 10.171.0.1 (CLIENT) I can ping 10.170.0.1 (VPNGATEWAY). In fact I can ping all hosts in 10.170.x.x and 10.171.x.x. But can't ping 8.8.8.8.

This is the iptables conf

There are a bunch rules and I took out to make it simpler.

*filter
:INPUT DROP [1000:900000]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -s 127.0.0.1 -j ACCEPT 

# here were some rules accepting certain ports  22, 80, etc

-A INPUT -p icmp -m icmp --icmp-type 8 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -p icmp -m icmp --icmp-type 13 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -p icmp -m icmp --icmp-type 30 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT 

# this is the client that needs internet thru the gateway
# i've tried to make as permissive as possible but still to no avail
-A INPUT -s 10.171.0.1 -j ACCEPT
-A FORWARD -s 10.171.0.1 -j ACCEPT

-A FORWARD -j REJECT --reject-with icmp-port-unreachable 
-A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT 
COMMIT

I've additionaly tried adding

iptables -t nat -A POSTROUTING -s 10.171.0.1 -o eth0 -j MASQUERADE

But still no work. Any ideas?

I have a server in a network receiving all its network information from DHCP. The problem is that the ntp-server being sent is not set to UTC. I want to use the configuration for ntp found in /etc/ntp.conf but the DHCP information takes precedence. How can I force ntpd to use the configuration in /etc/ntp.conf as opposed to the one sent by DHCP? What is the Debian way to do this?

I just moved to debian squeeze and need to change the startup sequence of some scripts. I used to do this with update-rc.d service defaulta xx xx but now with the LSB way of doing things the update-rc.d method does not change the order.

I need to start the packages in this order:

• openvpn
• ndo2db
• nagios
• apache2

Any ideas?

I just managed to cut my OpenVPN connection to some 20 servers tonight. I was experimenting with the client-connect scripts, and at some point one of the scripts returned a non zero response. This non zero response triggered an AUTH: Received AUTH_FAILED control message in the syslog which eventually resulted in a SIGTERM[soft,auth-failure] received, process exiting exit from the OpenVPN client. Is there a way to protect myself from this? Any configuration on the server or client side?

Is there a simple way to route certain domains (i.e. debian.org) through a different network interface. Here is the situation. I have a server with two interfaces eth0 going to the local network and tun0 going to an openvpn network. I would like to have all requests going to *.debian.org go out tun0 and the rest go through eth0. Is there a simple way to do this using names as opposed to ip addresses?

I've been giving this thing a try for the last 3 hours and nothing. I need to drop a new war and have tomcat autodeploy it. It is not happening. Here is my simplified configuration:

server.xml

<Engine name="Catalina" defaultHost="localhost">
  <Host name="something.com" appBase="/var/www/something.com/webapps"
        unpackWARs="false" autoDeploy="true" 
        xmlValidation="false" xmlNamespaceAware="false">
    <Context path="" docBase="application.war" debug="0" reloadable="true">
      ... some realm and data source stuff here
    </Context>
  </Host>
</Engine>

When I start tomcat everything works great. I have tried two approaches:

1. Copy a new war using scp in the location.
2. Touching /var/www/something.com/webapps/application.war.

In both cases I can see catalina.err with the same message:

INFO: Undeploying context [/application]

Without a corresponding

INFO: Deploying web application archive application.war

which I get when I restart tomcat. I have a feeling this is because it is not inside the CATALINA_BASE/webapps but don't know how to proceed. Any help?

Just installed nagios on a central machine and nrpe on 10 remote linux machines and just started monitoring them. It works great. I can get cpu load, current users, processes, mysql, etc. I can't find a way to monitor memory usage using the core plugins. What am I missing? Do I need an external plugin to do this?

I'm trying to monitor a remote jvm using jconsole. I need to do this monitoring through an OpenVPN network which might me part of the problem. This is the network configuration:

 Server A         Server B         Server C
 Jconsole                             JVM
10.171.0.1 <---> 10.170.0.1 <---> 10.170.0.14

When all servers are on different physical networks it doesn't work. When Server A and Server C are in the same physical network it works. In both cases the traceroute is the one described in the network configuration and looks something like this:

traceroute to 10.170.0.14 (10.170.0.14), 64 hops max, 52 byte packets
 1  10.170.0.1 (10.170.0.1)  114.440 ms  109.152 ms  109.581 ms
 2  10.170.0.14 (10.170.0.14)  234.207 ms  228.535 ms  229.630 ms

Any ideas on how to solve this?

[EDIT]

All systems are linux.

Jmx remote parameters are:

-Dcom.sun.management.jmxremote.port=8086 
-Dcom.sun.management.jmxremote.ssl=false 
-Dcom.sun.management.jmxremote.authenticate=false

Server Server B (10.170.0.1) is used as the bridge and firewall between the two networks. The firewall in 10.170.0.1 is as follows:

*filter
:INPUT DROP [1000:900000]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -s 127.0.0.1 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 389 -j ACCEPT
-A INPUT -p udp -m udp --dport 1194 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8086 -j ACCEPT
-A INPUT -p udp -m udp --dport 8086 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -p icmp -m icmp --icmp-type 13 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -p icmp -m icmp --icmp-type 30 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT 
-A FORWARD -s 10.171.0.1 -d 10.170.0.0/16 -j ACCEPT
-A FORWARD -s 10.171.0.3 -d 10.170.0.0/16 -j ACCEPT
-A FORWARD -s 10.170.0.0/16 -d 10.171.0.0/16 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-port-unreachable 
-A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT 
COMMIT

I need to setup a multi machine VPN with the following characteristics:

• 1 hub (10.170.0.1) which is the base of the VPN
• 20 users (10.170.0.0/16)
• 5 administrators (10.171.0.0/16)

The first part, the hub and the 20 users, are working as I need. In this setup I need to:

• Connect from the hub to every user
• Connect from every user to the hub
• Reject connection between users.

Plain vanilla OpenVPN configuration without using client-to-client.

Now I want to add the 5 administrators with some superpowers of connection. In this new setup I need to:

• Connect from the administrators to the hub.
• Connect from every administrator to every user (perhaps need to eventually restrict certain administrators to certain users).
• Reject connection between users and administrators (except the ones originated from the administrators).
• Reject connection between administrators.

I think that to get this granularity of control I need to enable the client-to-client in the server.conf. When doing this I already have users (170.0.0/16) and administrators (10.171.0.0/16) talking. The problem is that I need to enforce the restrictions above. I'm sure that this should be an iptables problem but I've been trying for more hours that I care to admit and can't make it work. So far my iptables.conf looks like this:

*filter
:INPUT DROP [1000:900000]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -s 127.0.0.1 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 389 -j ACCEPT
-A INPUT -p udp -m udp --dport 1194 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -p icmp -m icmp --icmp-type 13 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -p icmp -m icmp --icmp-type 30 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT 
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 10.170.0.0/16 -d 10.170.0.1 -j ACCEPT
-A FORWARD -s 10.170.0.0/16 -d 10.171.0.0/16 -j ACCEPT
-A FORWARD -s 10.170.0.0/16 -d 10.170.0.0/16 -j REJECT
-A FORWARD -j REJECT --reject-with icmp-port-unreachable 
-A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT 
COMMIT

I think the forwards in the same subnet are the problem... but don't even know where to start.

I have a server with two telephony cards (digium) and both are sharing the same IRQ. I'm getting a lot of interrupt misses on both cards and is affecting the quality. This wasn't like this before but I changed the cards from their original positions and now they are sharing the same IRQ. I've moved them to their original places but the IRQs are still the same. Is there a way to manually set an interrupt to a particular PCI card so that no cards share the same IRQ?

This question is related to this one but with a twist. I have many LANs that I manage and would like to have DNS entries for the machines in those LANs. For example, let's assume:

LAN A - is 192.168.128.X (with external IP 200.90.89.2)
  snoopy is 192.168.128.2
  router sends port 80 on 200.90.89.2 to 192.168.128.2

LAN B - is 192.168.130.x (with external IP 201.32.59.2)
  charlie is 192.168.130.4
  router sends port 80 on 201.32.59.2 to 192.168.130.4

The DNS would be for mydomain.com (outside all LANs) and I would like to register snoopy.mydomain.com and charlie.mydomain.com. Whenever I'm in LAN A the DNS for snoopy.mydomain.com would resolve to 192.168.128.2 and whenever I'm not it would resolve to 200.90.89.2. Same for LAN B.

The problem is that the DNS server will be outside all LANs and yet it must know if the request is coming from inside any of the LANs.

I have a debian linux firewall/gateway connecting my wan and lan working with iptables. I have eth1 as the wan with dynamic address 190.200.229.102 attached to somehost.com via DYNDNS and eht0 as the lan with address 192.168.128.2. Everything works as expected. Traffic coming in gets rejected for all ports except the ones specified with ACCEPT and the port forwarding works as expected redirecting traffic to the inside machines.

The problem is that when I try to connect to somehost.com from the inside network I don't get redirected to the internal machines as I expect. My firewall rules for port redirection are attached to the wan interface (eth1). I'm assuming that when I try to connect to somehost.com I'm coming from the lan connection and that is why the redirection does not work. I have experimented with REDIRECT, DNAT, INPUT and other tags without success. Any hints on how to achieve this?

I'm trying to setup a simple port forwarding firewall and I can't make the basic non-firewall configuration to work. I have setup the iptables script as follows

#!/bin/sh

# interfaces
LAN="eth1"
WAN="eth0"

# enable forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward

# delete all existing rules to start from scratch
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X

# accept everything
iptables -A INPUT -j ACCEPT
iptables -A FORWARD -j ACCEPT
iptables -A OUTPUT -j ACCEPT

# port forwarding to local machine
iptables -t nat -A PREROUTING -i $WAN -p tcp --dport 80 -j DNAT --to 192.168.1.96

# masquerade
iptables -t nat -A POSTROUTING -o $WAN -j MASQUERADE

This script will not firewall anything but it should redirect port 80 on the gateway machine to my internal machine 192.168.1.96. This is not working. The problem is that I can't get from the outside into the inside machine. I don't even know how to start debugging. Any hints on where to look?