headers
George Georgalis | 1 Feb 2006 04:41

using netbsd

Hi, I just figured out how to setup a netbsd client. It's pretty
nominal to run through the steps, but I couldn't make sense of
some of the errors, and the netbsd doc and support is thin. This
should be easy to straighten up. The hardest part was the tap up
script.

Would someone with a commit bit be willing to work with me to
patch this up?

Tue Jan 31 21:57:05 2006 Sorry but you cannot use --dev tap and --ifconfig together on this OS because I have
not ye t been programmed to understand the appropriate ifconfig syntax to use for TAP-style devices on
this OS.  Your best alternative is to use an --up script and do the ifconfig command manually.

another error that came up was from ifconfig,
ifconfig: can't set destination address on non-point-to-point link

here's my command line:

  openvpn --up /root/ovpn/addtap0alias.sh  --ifconfig-noexec --config George_Georgalis.ovpn

here's my script

#!/bin/sh

int=$1
mtu=$2
line=$3
remote=$4
mask=$5
(Continue reading)

Permalink | Reply | 0 comments |
headers
Victor | 1 Feb 2006 13:36
Favicon

unnumbered IP for local PtP interfaces

Hello!

Is it possible?
Im using unnumbered IP from ethernet interface fom my pppd sessions and
want same settings for openvpn sessions. Lost at least 1 IP for every
sessons for local side is bad idea and additional security holes.
Unfortunatly openvpn support just one such session. On second it
forward all traffic for local IP (ethernet IP) to vpn peer and flood
tunnel.
ifconfig show simmilar settings for ppp and tun interfaces, but ppp
work correct with single local IP for all ppp units and openvpn no.

Sorry for pure english.

--

-- 
Best regards,
 Victor                          mailto:kha0s <at> ukr.net

-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642
Permalink | Reply | 0 comments |
headers
Victor | 1 Feb 2006 13:41
Favicon

ping local ip over tun

Hello,

OvenVPN 2.0.5, simple PtP session:

dev tun
ifconfig 192.168.1.1 192.168.1.2

Im pinging local IP 192.168.1.1 and see this packets on peer side.
Is it correct openvpn behavior?

--

-- 
Best regards,
 Victor                          mailto:kha0s <at> ukr.net

-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642
Permalink | Reply | 0 comments |
headers
yquenechdu | 1 Feb 2006 16:00
Favicon

RE: Request: --crl-verify in DER format

Hi,

I would add following Jon, that to validate a CRL, the file must be
transformed into DER to analyze the ASN.1 contained in this one.
 Format PEM thus becomes useless. All CA of the market provide only DER.
this is the format by default for LCR,  it has yet only OpenSSL there to
use PEM in the LCR.

Cheers
Yannick Quenec'hdu
Linagora

-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid3432&bid#0486&dat1642
Permalink | Reply | 5 comments |
headers
Alon Bar-Lev | 1 Feb 2006 16:15
Picon
Gravatar

Re: RE: Request: --crl-verify in DER format

yquenechdu <at> linagora.com wrote:
> Hi,
> 
> I would add following Jon, that to validate a CRL, the file must be
> transformed into DER to analyze the ASN.1 contained in this one.
>  Format PEM thus becomes useless. All CA of the market provide only DER.
> this is the format by default for LCR,  it has yet only OpenSSL there to
> use PEM in the LCR.
> 
> Cheers
> Yannick Quenec'hdu
> Linagora

I use the following:

if wget -q -k -O - http://xxxx/CAInfo/xxx.crl | openssl crl 
-inform DER > ${CRL}.new; then
         mv ${CRL}.new ${CRL}
fi

Best Regards,
Alon Bar-Lev.

-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642
Permalink | Reply | 2 comments |
headers
Cameron Gocke | 1 Feb 2006 22:53
Picon

Intermittently lost connections - affecting IP Phones

Over the last couple of months I've had numerous reports of
intermittent loss of connectivity.  This doesn't last for more than a
few seconds, but it results in the users' dropping their IP phone
connection.  At first I started troubleshooting the Inactivity timeout
messages, but have all but eliminated those and the issue continues. 
(Aside from which I would assume that the IP phone would be sending
traffic over the VPN and therefore keep it from timing out.)

I am getting these messages:
Wed Feb 01 15:21:58 2006 clientname/71.99.3.226:1142 TLS: tls_process:
killed expiring key

Almost exactly every hour on the client side, but am not losing
connection nearly that often.

I've done some preliminary testing, and I don't see any evidence that
their internet connectivity is dropping at any point.

Does anyone have any suggestions for me?

-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid3432&bid#0486&dat1642
Permalink | Reply | 6 comments |
headers
Leonard Isham | 1 Feb 2006 23:37
Picon

Re: Intermittently lost connections - affecting IP Phones

On 2/1/06, Cameron Gocke <livedrive777 <at> gmail.com> wrote:
> Over the last couple of months I've had numerous reports of
> intermittent loss of connectivity.  This doesn't last for more than a
> few seconds, but it results in the users' dropping their IP phone
> connection.  At first I started troubleshooting the Inactivity timeout
> messages, but have all but eliminated those and the issue continues.
> (Aside from which I would assume that the IP phone would be sending
> traffic over the VPN and therefore keep it from timing out.)
>
> I am getting these messages:
> Wed Feb 01 15:21:58 2006 clientname/71.99.3.226:1142 TLS: tls_process:
> killed expiring key
>
> Almost exactly every hour on the client side, but am not losing
> connection nearly that often.
>
> I've done some preliminary testing, and I don't see any evidence that
> their internet connectivity is dropping at any point.
>
> Does anyone have any suggestions for me?
>

Packet loss, latency issues, bottlenecking, or dynamic IP
reallocation(with a new IP).  Could all potentually cause the problem.

Is the universal or anly limited to a few?

Have you checked for resource starvation on your systems?

How about bandwidth saturation, typically about 70%+ utilization,?
(Continue reading)

Permalink | Reply | 2 comments |
headers
Monty Ree | 2 Feb 2006 10:16
Picon
Favicon

Why Openvpn is SSL-VPN?

Hello, all.

I don't know the difference between IPSEC and SSL based vpn well.
But many documents say like below.

IPSEC VPN is required other program installed, but SSLVPN is not required 
other SW but only needs Explorer. I use OpenVPN using OpenVPNGUI at my PC 
not Explorer.
But, documents say that "OpenVPN is SSL based VPN".
How can I understand about this??

Thanks in advance and sorry poot english.

_________________________________________________________________
싸게 싸게 MSN공동구매   
http://www.waawaa.com/cobuy/cobuy_default.asp?siteid=10160 

-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642
Permalink | Reply | 1 comment |
headers
Monty Ree | 2 Feb 2006 10:39
Picon
Favicon

Why Openvpn is SSL-VPN?

Hello, all.

I don't know the difference between IPSEC and SSL based vpn well.
But many documents say like below.

IPSEC VPN is required other program installed, but SSLVPN is not required 
other SW but only needs Explorer. I use OpenVPN using OpenVPNGUI at my PC 
not Explorer.
But, documents say that "OpenVPN is SSL based VPN".
How can I understand about this??

Thanks in advance and sorry poot english.

_________________________________________________________________
전세계인이 함께하는 웹 메일 서비스인 MSN Hotmail을 만나 보세요.    
http://loginnet.passport.com/login.srf?id=2&svc=mail&cbid=24325&msppjph=1&lc=1042 

-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642
Permalink | Reply | 3 comments |
headers
Monty Ree | 2 Feb 2006 10:57
Picon
Favicon

OpenVPN through VPN is possible?

Hello, all.

I setup like below. 
OpenVPN1 and OpenVPN2 (all are linux server) is connected with OpenVPN.

PC(XP) -- OpenVPN1 -- OpenVPN1  -- Server(linux) 
                 (gateway)     (gateway)

# first question 

So all connections from PC must go pass OpenVPN1 and OpenVPN2, and it works 
well.
and I would like to connect between PC and Server too. But I can't connect.

Belows are log message at my PC. 

Thu Feb 02 17:18:18 2006 us=178904 Data Channel Encrypt: Cipher 'BF-CBC' 
initialized with 128 bit key
Thu Feb 02 17:18:18 2006 us=179010 Data Channel Encrypt: Using 160 bit 
message hash 'SHA1' for HMAC authentication
Thu Feb 02 17:18:18 2006 us=179114 Data Channel Decrypt: Cipher 'BF-CBC' 
initialized with 128 bit key
Thu Feb 02 17:18:18 2006 us=179173 Data Channel Decrypt: Using 160 bit 
message hash 'SHA1' for HMAC authentication
Thu Feb 02 17:18:18 2006 us=179517 Control Channel: TLSv1, cipher 
TLSv1/SSLv3 EDH-RSA-DES-CBC3-SHA, 1024 bit RSA
Thu Feb 02 18:18:16 2006 us=508777 TLS: tls_process: killed expiring key

I don't know the meaning of the last line(TLS: tls_process: killed expiring 
key) What is it?
(Continue reading)

Permalink | Reply | 1 comment |

Gmane