Thanks for adding more technical content!

@wrx7m said in Passing OpenVPN through ER-X: @scottalanmiller said in Passing OpenVPN through ER-X: I can't find any references to OpenVPN using 943/TCP. You sure that that isn't a custom setting somewhere? https://openvpn.net/vpn-server-resources/how-to-configure-the-openvpn-access-server/ It must just be access server. "TCP port 943 is the port where the web server interface is listening by default." Yeah, no web server in OpenVPN itself.

@DustinB3403 said in Openvpn HELPPP!!: @abdel-hakim-abousrea to start, if you have access to the internet, you have a public IP, it could be a statically assigned IP or one that could change randomly. Having a static public IP to use for this would be ideal. Set up a FQDN for your system, even if it is a static IP. Either via some type of dynamic DNS or a manual records in your public DNS.

@JaredBusch said in Alternatives to OpenVPN for FreePBX on cell phone...: @scottalanmiller said in Alternatives to OpenVPN for FreePBX on cell phone...: @JaredBusch said in Alternatives to OpenVPN for FreePBX on cell phone...: There has never been a promise or timeline made for the mobile apps. Anyone expecting anything on that front is operating in their own little fantasy. That's the main use case of softphones, though. Like 95% I would guess. Softphones for the desktop are way more niche. I totally disagree. Softphone on the desktop is by far the largest user base thanks to call centers. Softphone on mobile is a far second to that. Maybe overall, but for FreePBX? FreePBX is pretty rare in call centers, AFAIK.

@Pete-S said in Edge Router X OpenVPN Configuration: Be aware that you might run into some performance issues with that unit and openvpn - depending on the speed of your link and what cipher the openvpn server uses. Expect to top out around 25 Mbps according to this: https://community.ubnt.com/t5/EdgeRouter/Test-ER-X-OpenVPN-performance/td-p/1615188 The 2.0 firmware will increase that thanks to a community member posting some new configuration changes to the source code.

@scottalanmiller said in Untangle Site to Site VPN Not Connecting: @dbeato said in Untangle Site to Site VPN Not Connecting: @scottalanmiller said in Untangle Site to Site VPN Not Connecting: We DID find last night that one machine had updated to a different version than the other. But the other is months behind but refuses to recognize that an update exists. Untangle claims updates are delayed to reduce server load and there is no option to control versions (basically... this is in no way a business product.) There is always a way to force the updates, I bet this are actual old workstations or servers with Untangle, otherwise they would have been in version 14.1... This is not way configured the same for updates on both devices.. Don't think so, looking at the hardware they looked like store bought Untangle commercial devices. Weird all around, but I understand

Doing a bit of reverse name matching... I may have it now.

Hak5 OpenVPN Series: http://www.youtube.com/playlist?list=PL9Gx4S6DDjBvoIpQZiAhdRFpZ0yztZJms

@Dashrender said in Considering a New VPN: @JaredBusch said in Considering a New VPN: @scottalanmiller said in Considering a New VPN: @JaredBusch said in Considering a New VPN: @scottalanmiller said in Considering a New VPN: @JaredBusch said in Considering a New VPN: @scottalanmiller said in Considering a New VPN: @Carnival-Boy said in Considering a New VPN: Yeah, I need hub and spoke really. But that's not too difficult to setup on ZeroTier is it? ZeroTier doesn't offer hub and spoke at all. It's pure SDN / mesh. This is not true, ZeroTier has gateway functionality. https://www.zerotier.com/community/topic/5/bridging-ethernet-to-zerotier-virtual-networks-on-linux I was leaving that out for simplicity as he's not going to build custom Linux systems for this. Why? Because a single VM setup as a gateway means that ZT now meets all needs also. No different than replacing a router, etc. I've not used it, does it require you to change your IP range or can you keep what you have? The biggest recommendation is to make it inclusive of your LAN subnet so make life easier. I've not had the time to set it up on my lab yet. I use ZT in a number of places, but not using the gateway anywhere yet. Right, so being inclusive means that you did follow Scott's recommendation, only that you bent ZT to the current setup, instead of making a whole new IP setup with this in mind. Did that solve all of the Windows DNS issues? I have no idea WTF you are talking about. You are implying and inferring things that are not being discussed here.

Viscosity is a nice OpenVPN client

@Dashrender said in OpenVPN and Andriod Mobiles: @iroal said in OpenVPN and Andriod Mobiles: Right now I'm connected to Openvnp, in a Pfsense, and sending you this message all from my android Phone. I use OpenVnp 0.6.60 for Android. His problem isn't using OpenVPN from his android device. His issue is split tunneling - or the ability to surf the web through his office network's internet connection. I mean I connect from a Samsung S5 using OpenVpn App, the OpenVnp server It's the Pfsense.

@martianx said in Modern Open Source Replacement for SSLExplorer: Update: We prototyped integrating NoVNC with the Hypersocket VPN. It was relatively simple as it hooked straight into our forwarding mechanism that was already using websockets. Will be releasing an update to support this in the next month or so. We will also integrate our client-less SSH terminal at the same time. RDP is a little more complex so will need further research before we can support this. Very cool, thanks for the update!

@RamblingBiped said in SIP Phone registers no audio...: Here is the guide I followed to get the Yealink T23G to work with OpenVPN: http://www.sunstatetechnology.com/docs/YealinkOpenVPNGuide.pdf When I disable NAT on the extension the phone is unable to register. Something is wrong there, that sounds like the VPN is not working as there is no NAT when there is a VPN.

@jrc said in OpenVPN and DNS: Do you know if you can configure OpenVPN to work as a DNS relay (local relayed to remote)? What would be the local component, in that case?

@scottalanmiller said in FreePBX External/Remote Extensions: @JaredBusch said in FreePBX External/Remote Extensions: @RamblingBiped said in FreePBX External/Remote Extensions: Option #1 up and running. Now to work on the OpenVPN part of the equation... I have set this up but then ran into the problem of the OpenVPN port being blocked. Slightly hard to change once out in the wild. On which end? The remote end obviously. As I have full control of the server side.

@marcinozga Thanks, but already tried net.inet.ip.fastforwarding in all combinations with TCP and UDP.

@JaredBusch Good to know. I'm planning on starting this later this week. If I can get this working, I'm going to replace a PFSense firewall with an ERX or lite. Right now, this is the only thing that I dont have setup for ERX yet.

Everything that you are doing sounds logical and makes sense to me. I'm pretty confident you are not going to hurt anything here. Will it help dramatically? No idea there. But I think it is likely to help without much risk. Seems like a good idea.

I also tried to use the ccd with different segment, with config below: server.conf client-config-dir /etc/openvpn/ccd route 10.8.2.0 255.255.255.0 /etc/openvpn/ccd/username1: Code: ifconfig-push 10.8.2.9 10.8.2.10 but still getting 10.8.0.x internal IP instead of 10.8.2.x. Also put in IPtables: iptables -A FORWARD -s 10.8.2.0/24 -j ACCEPT

We recently had to set up an L2TP tunnel for our apple devices, since the last iOS 10 update took PPTP out of the picture. It was a huge PITA too, because I didn't figure out for a while that the secondary tunnel wouldn't let me reuse existing user accounts in our Watchguard.... that was some fun trial and error. And the WG how-tos never specified anything about needing different user accounts. It sucks to do all the steps right and then get login errors... makes ya feel like an amateur.

@dafyre said: What kind of authentication is the daloradius / freeradius back-end using? Can you test the authentication to the freeradius server from another server at Location B? Not sure how to answer that, daloradius is just a web based front end of freeradius to manage users. What I think is for some reason the ovpn server is not communicating with dalo server. @scottalanmiller its ubuntu which is my issue too. I am so comfortable with centos, and ufw firewall is something new to me. Not even sure if this thing is enabled or disabled!

Found it. First run the iptables entry iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to xxx.xx.xx.xx Then run sudo apt-get install iptables-persistent, and follow the prompts. When it asks to save the current rules, hit "Yes" at both prompts. Now, on reboots, your iptables rules will be restored. All done, working fine!

how do they compare to the Ubiquiti?