Author Topic: openvpn configuration?  (Read 43602 times)

Rich Walsh

  • Sr. Member
  • ****
  • Posts: 331
  • Karma: +23/-0
  • ONU! (OS/2 is NOT Unix!)
    • View Profile
Re: openvpn configuration?
« Reply #15 on: October 03, 2019, 04:42:37 pm »
I have no idea how difficult it might be to create a tun driver for OS/2 - from what I've read, almost all VPN services prefer tun to tap - which is awkward as our port only supports tap!

I wouldn't worry about 'tap' vs 'tun'. Win uses 'tap', so it's going to be supported by commercial providers if they want any customers. Writing a new device driver for 'tun' is a tall order and best avoided if possible.

Quote
I'm sure I can tweak the code around loading ifconfig.exe - I'll try and remember to zip up the source tonight.

I suspect that this warning is the cause for the misconfiguration:
> WARNING: 'dev-type' is used inconsistently, local='dev-type tap', remote='dev-type tun'

My _guess_ is that there's some code or flag in the Win version that tells the server to use 'tap' during the initial connection setup - code that's being bypassed because Win32 isn't #defined.

If you'd care to share a diff of your changes, I'd be happy to pull the source and start looking.

Paul Smedley

  • Hero Member
  • *****
  • Posts: 2092
  • Karma: +159/-0
    • View Profile
Re: openvpn configuration?
« Reply #16 on: October 04, 2019, 05:02:39 am »
Hi Rich!

I wouldn't worry about 'tap' vs 'tun'. Win uses 'tap', so it's going to be supported by commercial providers if they want any customers. Writing a new device driver for 'tun' is a tall order and best avoided if possible.

OK - from my reading I thought tun was more common, but happy to be wrong.


I suspect that this warning is the cause for the misconfiguration:
> WARNING: 'dev-type' is used inconsistently, local='dev-type tap', remote='dev-type tun'

My _guess_ is that there's some code or flag in the Win version that tells the server to use 'tap' during the initial connection setup - code that's being bypassed because Win32 isn't #defined.

If you'd care to share a diff of your changes, I'd be happy to pull the source and start looking.

I forgot to run a diff last night, but the netlabs build source (based on Pasha's original source on hobbes for 2.0.x) is at http://trac.netlabs.org/ports/browser/openvpn/trunk

Cheers,

Paul

Paul Smedley

  • Hero Member
  • *****
  • Posts: 2092
  • Karma: +159/-0
    • View Profile
Re: openvpn configuration?
« Reply #17 on: October 04, 2019, 11:05:08 am »

Bernhard Pöttinger

  • Jr. Member
  • **
  • Posts: 52
  • Karma: +10/-0
    • View Profile
Re: openvpn configuration?
« Reply #18 on: October 05, 2019, 06:12:11 pm »
Hi Paul,

excuse the delay.

Hi Bernhard,

Thanks for sharing - are you also able to test with https://smedley.id.au/tmp/openvpn-2.2.2-os2-20190929.zip

I'll try bump our port to a currently supported one, however, from 2.3.x onwards, ipv6 support is included and will need to be worked around in the code.

Cheers,

Paul.

Your new openvpn executable version 2.2 worked like a charm with all my vpn connections. As i said, on severside I use linux machines or pfSense firewalls. In former times I have used ipcop / ipfire as openvn servers and they worked too with os/2 or arcaos.

best regards
Bernhard.

David McKenna

  • Hero Member
  • *****
  • Posts: 742
  • Karma: +24/-0
    • View Profile
Re: openvpn configuration?
« Reply #19 on: October 06, 2019, 02:16:20 am »
 @Doug,

  In the openvpn.zip file found on Hobbes, in the 'another' folder, there is a good cookbook for setting up a server and client on OS/2. I gave it a shot and it works great... Paul's new build too. Now I can use ArcaMapper to access my shares remotely on my laptop. Had to set up a port forward on my router to do it....

Regards,

Doug Bissett

  • Hero Member
  • *****
  • Posts: 1593
  • Karma: +4/-2
    • View Profile
Re: openvpn configuration?
« Reply #20 on: October 07, 2019, 06:55:57 am »
@Doug,

  In the openvpn.zip file found on Hobbes, in the 'another' folder, there is a good cookbook for setting up a server and client on OS/2. I gave it a shot and it works great... Paul's new build too. Now I can use ArcaMapper to access my shares remotely on my laptop. Had to set up a port forward on my router to do it....

Thanks. I tried that but it wasn't connecting. I will try it again, when I find a few minutes.

Paul Smedley

  • Hero Member
  • *****
  • Posts: 2092
  • Karma: +159/-0
    • View Profile
Re: openvpn configuration?
« Reply #21 on: October 07, 2019, 11:16:01 am »
Hi All,

I managed to build OpenVPN 2.3.18 & 2.4.7 today. I had to add some ipv6 stuff to the libc headers as there's no way to disable ipv6 support in OpenVPN 2.3.x

It's now compiling, but I'm getting some select() errors - I suspect that some sockets are being created using non-ipv4 flags causing 'socket operation on non-socket' errors...

Will try work through it...

Cheers,

Paul

Paul Smedley

  • Hero Member
  • *****
  • Posts: 2092
  • Karma: +159/-0
    • View Profile
Re: openvpn configuration?
« Reply #22 on: October 08, 2019, 10:39:37 am »
With thanks to Rich for some fixes to the default gateway code, the 2.3.18 code seems to be working....

http://smedley.id.au/tmp/openvpn-2.3.18-os2-20191008.zip

Feedback appreciated - this still will only work for providers that use the tap interface....

Bernhard Pöttinger

  • Jr. Member
  • **
  • Posts: 52
  • Karma: +10/-0
    • View Profile
Re: openvpn configuration?
« Reply #23 on: October 08, 2019, 01:43:53 pm »
Hallo Paul,
I tested your version 2.3 and it's working as expected. Thank's for the excelent work.
best regards
Bernhard

TeLLie

  • Full Member
  • ***
  • Posts: 226
  • Karma: +11/-0
    • View Profile
Re: openvpn configuration?
« Reply #24 on: October 08, 2019, 06:23:13 pm »
Hi all,
I saw this passing by, its a gui for openvpn.
You can download from https://tellie.stackstorage.com/s/4iYPdyALJyH36uh
Its build with QT5.
Not sure it works there i have not ever use openvpn..

Paul Smedley

  • Hero Member
  • *****
  • Posts: 2092
  • Karma: +159/-0
    • View Profile
Re: openvpn configuration?
« Reply #25 on: October 08, 2019, 10:55:05 pm »
Hi Bernard,

I tested your version 2.3 and it's working as expected. Thank's for the excelent work.

Great! Next step 2.4.7 - then to try get tun working .....

Cheers,

Paul

Doug Bissett

  • Hero Member
  • *****
  • Posts: 1593
  • Karma: +4/-2
    • View Profile
Re: openvpn configuration?
« Reply #26 on: October 09, 2019, 04:36:11 am »
Quote
@Doug,

  In the openvpn.zip file found on Hobbes, in the 'another' folder, there is a good cookbook for setting up a server and client on OS/2. I gave it a shot and it works great...

Hmmm. Yes, it does work, once you realize that this section is sort of misleading:

Quote
Starting the client:
  The client makes an outgoing connection to the server, so it shouldn't matter
  if you are behind a Firewall/NAT. Making connections out through a http-
  proxy is beyond the scope of this document (see openvpn.net).
  You need to change 1 line in the client configuration file - client.ovpm -
  before you can use it. Look for this line:

  remote microsoft.com

  and change the hostname to the hostname of the server you wich to connect to.
  You can use an IP address instead, if you want to.
  Save file, and start Openvpn client this way:

In client.ovpm, it is not "remote microsoft.com" it is "remote 10.3.3.54", and then you need to realize, that the address that you change it to is the address of the other machine that you wish to connect to, and that has nothing to do with the address range that is used by the virtual network.

In testing, I am using a machine on my local network, that has address 192.168.0.116 for the server, and another local machine at address 192.168.0.107 for the client. The virtual connection is 10.7.7.1 and 10.7.7.2, but that path travels over the local network on the local addresses. To go over the internet, you would need to use your outside IP address, and have port 1194 open in your router(s).

There has got to be a better way to describe this, but my main problem was that the "remote" statement in the instructions, was not what was in the sample client.ovpn.

Okay, now, to figure out how to actually use this thing.   :o

Thanks...

BTW, I got Paul's 20191008 version, and it works too, now that I have decoded the instructions. There are a few warning messages, about security, that I need to figure out, but it seems to connect okay.

Paul Smedley

  • Hero Member
  • *****
  • Posts: 2092
  • Karma: +159/-0
    • View Profile
Re: openvpn configuration?
« Reply #27 on: October 09, 2019, 10:32:45 am »
BTW, I got Paul's 20191008 version, and it works too, now that I have decoded the instructions. There are a few warning messages, about security, that I need to figure out, but it seems to connect okay.

Assuming you're talking about:
Tue Oct  8 19:06:02 2019 WARNING: file 'pass.txt' is group or others accessible

That should be addressed (actually just suppressed per WIN32) in http://smedley.id.au/tmp/openvpn-2.3.18-os2-20191009.zip

Doug Bissett

  • Hero Member
  • *****
  • Posts: 1593
  • Karma: +4/-2
    • View Profile
Re: openvpn configuration?
« Reply #28 on: October 09, 2019, 11:31:10 pm »
Quote
Assuming you're talking about:
Tue Oct  8 19:06:02 2019 WARNING: file 'pass.txt' is group or others accessible

I don't think so. This is what I see, when starting the server, or the client (this is from the client):
Code: [Select]
[W:\TOOLS\OPENVPN]OpenVPN.exe client.ovpn
Wed Oct  9 15:14:39 2019 OpenVPN 2.3.18 i386-pc-os2-emx [SSL (OpenSSL)] [LZO] [MH] [IPv6] built on Oct  7 2019
Wed Oct  9 15:14:39 2019 library versions: OpenSSL 1.0.2n  7 Dec 2017, LZO 2.04
Wed Oct  9 15:14:39 2019 WARNING: INSECURE cipher with block size less than 128 bit (64 bit).  This allows attacks like SWEET32.  Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
Wed Oct  9 15:14:39 2019 WARNING: INSECURE cipher with block size less than 128 bit (64 bit).  This allows attacks like SWEET32.  Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
dev_node = (null)
Wed Oct  9 15:14:39 2019 UDPv4 link local (bound): [undef]
sem reset rc=300
Wed Oct  9 15:14:39 2019 UDPv4 link remote: [AF_INET]192.168.0.107:1194
Wed Oct  9 15:14:50 2019 Peer Connection Initiated with [AF_INET]192.168.0.107:1194
Wed Oct  9 15:14:51 2019 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Wed Oct  9 15:14:51 2019 Initialization Sequence Completed

It does work, but it seems that the program is suggesting that better security settings should be used. I am using the suggested setup from the "another" directory in the openvpn package, from HOBBES, updated to the new openvpn.exe, and minimally modified to match my local network. It looks like a good place to start, but I need to figure out what to change, to make it happy (LOW priority on my part).

Doug Bissett

  • Hero Member
  • *****
  • Posts: 1593
  • Karma: +4/-2
    • View Profile
Re: openvpn configuration?
« Reply #29 on: October 09, 2019, 11:41:01 pm »
Quote
That should be addressed (actually just suppressed per WIN32) in http://smedley.id.au/tmp/openvpn-2.3.18-os2-20191009.zip

I downloaded this file, and the Archive Tool says the data is invalid.