mirror of
https://github.com/pi-hole/docs.git
synced 2026-08-17 02:13:54 +01:00
Merge pull request #1398 from pi-hole/remove/openvpn
Remove deprecated OpenVPN documentation
This commit is contained in:
Dominik
Binary file not shown.
|
Before Width: | Height: | Size: 20 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 16 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 20 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 9.4 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 24 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 9.5 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 7.7 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 15 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 12 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 8.2 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 12 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 15 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 8.7 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 15 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 31 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 14 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 15 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 3.0 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 21 KiB |
@@ -1,55 +0,0 @@
|
||||
{!guides/vpn/openvpn/deprecation_notice.md!}
|
||||
|
||||
- Install the official OpenVPN App from the [App Store](https://play.google.com/store/apps/details?id=net.openvpn.openvpn)
|
||||
|
||||
- Log into your OpenVPN server and use the road warrior installer to create a new certificate for your device:
|
||||
|
||||
```text
|
||||
root@ubuntu-512mb-fra1-01:~# bash openvpn-install.sh
|
||||
Looks like OpenVPN is already installed
|
||||
|
||||
What do you want to do?
|
||||
1) Add a cert for a new user
|
||||
2) Revoke existing user cert
|
||||
3) Remove OpenVPN
|
||||
4) Exit
|
||||
Select an option [1-4]: 1
|
||||
|
||||
Tell me a name for the client cert
|
||||
Please, use one word only, no special characters
|
||||
Client name: android
|
||||
Generating a 2048 bit RSA private key
|
||||
.....+++
|
||||
..................................+++
|
||||
writing new private key to '...'
|
||||
-----
|
||||
Using configuration from /etc/openvpn/server/easy-rsa/openssl-1.0.cnf
|
||||
Check that the request matches the signature
|
||||
Signature ok
|
||||
The Subject's Distinguished Name is as follows
|
||||
commonName :ASN.1 12:'android'
|
||||
Certificate is to be certified until Jan 25 15:07:37 2027 GMT (3650 days)
|
||||
|
||||
Write out database with 1 new entries
|
||||
Data Base Updated
|
||||
|
||||
Client android added, configuration is available at /root/android.ovpn
|
||||
```
|
||||
|
||||
- Copy the mentioned file (`/root/android.ovpn`) to your Android device (e.g. SD card) and import it in the app:
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
- Connect to your OpenVPN server
|
||||
|
||||
|
||||
|
||||
- You are ready to go!
|
||||
|
||||
|
||||
@@ -1,85 +0,0 @@
|
||||
##############################################
|
||||
# Sample client-side OpenVPN 2.0 config file #
|
||||
# for connecting to Pi-hole OpenVPN server. #
|
||||
# #
|
||||
# This configuration can be used by multiple #
|
||||
# clients, however each client should have #
|
||||
# its own cert and key files. #
|
||||
##############################################
|
||||
|
||||
# Specify that we are a client and that we
|
||||
# will be pulling certain config file directives
|
||||
# from the server.
|
||||
client
|
||||
dev tun
|
||||
|
||||
# Are we connecting to a TCP or
|
||||
# UDP server? Use the same setting as
|
||||
# on the server.
|
||||
dev tun
|
||||
proto udp
|
||||
;proto tcp
|
||||
|
||||
# The hostname/IP and port of the server.
|
||||
# You can have multiple remote entries
|
||||
# to load balance between the servers.
|
||||
remote <<<<<my.ip.address.here>>>> 1194
|
||||
|
||||
# Keep trying indefinitely to resolve the
|
||||
# host name of the OpenVPN server. Very useful
|
||||
# on machines which are not permanently connected
|
||||
# to the internet such as laptops.
|
||||
resolv-retry infinite
|
||||
|
||||
# Most clients don't need to bind to
|
||||
# a specific local port number.
|
||||
nobind
|
||||
|
||||
# Try to preserve some state across restarts.
|
||||
persist-key
|
||||
persist-tun
|
||||
|
||||
# SSL/TLS params.
|
||||
# See the server config file for more
|
||||
# description. It's best to use
|
||||
# a separate .crt/.key file pair
|
||||
# for each client. A single ca
|
||||
# file can be used for all clients.
|
||||
ca /home/dl6er/openvpn/ca.crt
|
||||
cert /home/dl6er/openvpn/client.crt
|
||||
key /home/dl6er/openvpn/client.key
|
||||
|
||||
# Verify server certificate by checking that the
|
||||
# certificate has the correct key usage set.
|
||||
# This is an important precaution to protect against
|
||||
# a potential attack discussed here:
|
||||
# https://openvpn.net/howto.html#mitm
|
||||
remote-cert-tls server
|
||||
|
||||
# If a tls-auth key is used on the server
|
||||
# then every client must also have the key.
|
||||
tls-auth /home/dl6er/openvpn/ta.key 1
|
||||
|
||||
# Select a cryptographic cipher.
|
||||
# If the cipher option is used on the server
|
||||
# then you must also specify it here.
|
||||
cipher AES-256-CBC
|
||||
|
||||
# Enable compression on the VPN link.
|
||||
# Don't enable this unless it is also
|
||||
# enabled in the server config file.
|
||||
comp-lzo
|
||||
|
||||
# Set log file verbosity.
|
||||
verb 3
|
||||
|
||||
# Call script that updates DNS settings are
|
||||
# pushed by the OpenVPN server. It updates your
|
||||
# /etc/resolv.conf with DNS settings that come
|
||||
# from the received push dhcp-options. Since
|
||||
# network management is out of OpenVPN client
|
||||
# scope, this script adds and removes the
|
||||
# provided from those settings.
|
||||
script-security 2
|
||||
up /etc/openvpn/update-resolv-conf
|
||||
down /etc/openvpn/update-resolv-conf
|
||||
@@ -1,99 +0,0 @@
|
||||
{!guides/vpn/openvpn/deprecation_notice.md!}
|
||||
|
||||
## Create a client config file (`.ovpn`)
|
||||
|
||||
Now that the server is configured, you'll want to connect some clients so you can make use of your Pi-hole wherever you are. Doing so requires the use of a certificate. You generate these and the resulting `.ovpn` file by running the installer and choosing `1) Add a new user` for each client that will connect to the VPN.
|
||||
|
||||
You can repeat this process for as many clients as you need. In this example, we'll "Add a new user" by naming the `.ovpn` file the same as the client's hostname but you may want to adopt your own naming strategy.
|
||||
|
||||
Run the OpenVPN installer again
|
||||
|
||||
```bash
|
||||
./openvpn-install.sh
|
||||
```
|
||||
|
||||
Choose `1) Add a new user` and enter a client name
|
||||
|
||||
```text
|
||||
Looks like OpenVPN is already installed
|
||||
|
||||
What do you want to do?
|
||||
1) Add a new user
|
||||
2) Revoke an existing user
|
||||
3) Remove OpenVPN
|
||||
4) Exit
|
||||
Select an option [1-4]: 1
|
||||
|
||||
Tell me a name for the client certificate
|
||||
Please, use one word only, no special characters
|
||||
Client name: iphone7
|
||||
```
|
||||
|
||||
This will generate a `.ovpn` file, which needs to be copied to your client machine (oftentimes using the OpenVPN app). This process also generates a few other files found in `/etc/openvpn/server/easy-rsa/pki/`, which make public key authentication possible; you only need to worry about the `.ovpn` file, though.
|
||||
|
||||
## Connect a client using the `.ovpn` file
|
||||
|
||||
The OpenVPN documentation has some decent [guides on connecting desktop clients for Mac, Windows, and Linux](https://openvpn.net/vpn-server-resources/), so we'll instead explain how to connect a mobile device since that provides the most usefulness in today's world--**connecting to your ad-blocking VPN via a mobile device**. We'll go through two examples:
|
||||
|
||||
1. connect an iPhone using the OpenVPN Connect mobile app (see [here](android-client.md) for Android)
|
||||
2. connect a Linux machine
|
||||
|
||||
### iOS
|
||||
|
||||
First, make sure the OpenVPN connect app is installed on your phone or mobile device.
|
||||
|
||||
Import the `.ovpn` file into iOS. There are several ways to do this, but be careful about transferring it over an insecure medium.
|
||||
|
||||
1. Airdrop the file from another device
|
||||
2. Store the file in a cloud app and open it ion your device
|
||||
3. Message the file to yourself (not recommended)
|
||||
4. Email the file to yourself (not recommended)
|
||||
|
||||
!!! WARNING
|
||||
Anyone who gets his hands on this configuration/certificate file can obtain full access to your VPN. Make sure that you use only trusted paths for transferring the file (e.g. never send it via an unencrypted channel, e.g. email or FTP). The best strategy is to use a USB thumb drive to avoid any network transport at all (when possible). Make sure to delete the certificate on the USB drive afterward.
|
||||
|
||||
!!! NOTICE
|
||||
If one of your certificates has been compromised, remove it using option 2 when you run the installer and generate a new certificate. This will effectively lock out anyone who might have gotten access to the certificate.
|
||||
|
||||
Once you get it on your device, you can open the file in the OpenVPN app.
|
||||
|
||||
Click the green plus to add the profile to your phone.
|
||||
|
||||
You can connect from within the app or you can connect from the Settings app once you grant it access to do so.
|
||||
|
||||
### Linux
|
||||
|
||||
We'll demonstrate the procedure here for Ubuntu Linux (which trivially extends to Linux Mint, etc.)
|
||||
|
||||
1. Install the necessary network-manager plugins
|
||||
|
||||
```bash
|
||||
sudo apt-get install network-manager-openvpn network-manager-openvpn-gnome
|
||||
sudo service network-manager restart
|
||||
```
|
||||
|
||||
2. Securely copy the necessary certificates from your OpenVPN server to your client (e.g. using `sftp`). They are located in `/etc/openvpn/server/easy-rsa/pki`
|
||||
|
||||
You will need:
|
||||
|
||||
* User Certificate: `/etc/openvpn/server/easy-rsa/pki/issued/client.crt`
|
||||
* CA Certificate: `/etc/openvpn/server/easy-rsa/pki/ca.crt`
|
||||
* Private Key: `/etc/openvpn/server/easy-rsa/pki/private/client.key`
|
||||
* Private Key Password: Depending on your settings (might even be empty)
|
||||
* TA Key: `/etc/openvpn/server/ta.key`
|
||||
|
||||
Further details can be found in the screenshots provided below:
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
Your whole network traffic will now securely be transferred to your Pi-hole.
|
||||
|
||||
|
||||
|
||||
### Windows
|
||||
|
||||
You will have to install additional software. See <https://openvpn.net/community-downloads/>
|
||||
@@ -1,5 +0,0 @@
|
||||
<!-- markdownlint-disable code-block-style -->
|
||||
!!! warning "OpenVPN is no longer recommended"
|
||||
We no longer recommend that you use OpenVPN for new deployments. Although OpenVPN has served us well in the past, we believe it's time to move towards more modern and efficient solutions.
|
||||
|
||||
We suggest that users now turn their attention to [WireGuard](../wireguard/index.md), a forward-thinking VPN solution that offers better performance, faster speeds, and easier implementation. WireGuard has been designed with the latest technology in mind, providing simple yet powerful tools for securing your network communications. Pi-hole's step-by-step tutorial is designed to help you understand the ins and outs of WireGuard, regardless of your technical expertise.
|
||||
@@ -1,69 +0,0 @@
|
||||
{!guides/vpn/openvpn/deprecation_notice.md!}
|
||||
|
||||
### Dual VPN Setup - Separate DNS and VPN Traffic
|
||||
|
||||
In order to separate VPN traffic from DNS queries, you will need to run two VPN servers. One server routes the normal user traffic and the second routes only DNS requests. This can be done with two OpenVPN configurations.
|
||||
|
||||
#### Prerequisites and Configuration
|
||||
|
||||
You should have an existing OpenVPN server configured and running. We are going to use the original configuration file located at `/etc/openvpn/server/server.conf`.
|
||||
|
||||
First, copy the file:
|
||||
|
||||
```bash
|
||||
sudo cp /etc/openvpn/server/server.conf /etc/openvpn/server/server2.conf
|
||||
```
|
||||
|
||||
Next, exit the new copy of the configuration. We use the `nano` editor in this example, but any editor will work. Remember to edit under the root account via `sudo`.
|
||||
|
||||
```bash
|
||||
sudo nano /etc/openvpn/server/server2.conf
|
||||
```
|
||||
|
||||
We will need to change the port to one different from the original so that it does not conflict with the first instance of OpenVPN. Assuming you used the default port configuration, you should have 1194 as the port. You need to change this to a different value, making sure the port is available - 1195 should be.
|
||||
|
||||
Next, if needed, port forward the newly configured port from your router to your device. You will also need to assign a different class of IP addresses that will serve this connection only.
|
||||
|
||||
Your server line should look like this:
|
||||
|
||||
```text
|
||||
server 10.9.0.0 255.255.255.0
|
||||
```
|
||||
|
||||
Make sure that the DNS requests go through the instance of OpenVPN:
|
||||
|
||||
```text
|
||||
push "dhcp-option DNS 10.9.0.1"
|
||||
```
|
||||
|
||||
One other setting that we need to change is to comment out the `bypass-dhcp` instruction so that it looks like:
|
||||
|
||||
```text
|
||||
# push "redirect-gateway def1 bypass-dhcp"`.
|
||||
```
|
||||
|
||||
Commenting out this line ensures that no traffic is routed via the VPN server.
|
||||
|
||||
Save the file and start the second instance of OpenVPN:
|
||||
|
||||
```bash
|
||||
systemctl start openvpn@server2.service
|
||||
```
|
||||
|
||||
*If your distribution does not have `systemctl` you may use the command below to start an OpenVPN daemon with your second configuration:*
|
||||
|
||||
```bash
|
||||
/usr/sbin/openvpn --daemon --writepid /run/openvpn/server2.pid --cd /etc/openvpn --config server2.conf --script-security 2
|
||||
```
|
||||
|
||||
Finally, edit the existing `.ovpn` file used for the client connection. Update the port from the previous value to the port you used for the second instance of OpenVPN.
|
||||
|
||||
#### Testing
|
||||
|
||||
Before testing, make sure that:
|
||||
|
||||
1. Port forwarding is configured for the second instance of OpenVPN.
|
||||
2. `ps ax | grep openvpn` shows two instances of OpenVPN running (with different configs).
|
||||
3. The modified ovpn file is loaded on the client.
|
||||
|
||||
*Note: when connected to your DNS only VPN connection **you will not get a Pi-hole splash page when accessing a blocked domain directly.** The page will not load or it may load with an error. **This is because the web server traffic is not routed through the VPN.** We did not create an `iptables` rule for masquerading, and the return packets (since they are not part of the same LAN subset as your VPN Client) are prevented.*
|
||||
@@ -1,73 +0,0 @@
|
||||
{!guides/vpn/openvpn/deprecation_notice.md!}
|
||||
|
||||
**Up until now, this wiki has been about a server set up on a cloud host, available on the public Internet. This section is aimed at a server set up in a private network like on a Raspberry Pi.**
|
||||
|
||||
So if blocking works using `eth0` but stops working for `tun0`, as described [here](https://github.com/pi-hole/pi-hole/issues/1553), you may want to run this command `pihole -a -i all`, which should get the behavior you want by opening pihole-FTL up to listen on all ports. This is not recommended for cloud servers as they should _not_ be listening on `eth0`.
|
||||
|
||||
If you want to set up your Pi-hole + OpenVPN such that you can use from both internal ((W)LAN) and external (VPN) networks, you have to apply some small changes. As an additional benefit, you will be able to reach all devices in the internal network (e.g. computers, networking-aware printers, etc.) through the VPN.
|
||||
|
||||
This setup assumes that your local network is in the range **192.168.2.0** (i.e. device addresses are in the range of 192.168.2.1 - 192.168.2.254). If this is not the case for you, you have to adjust the settings, accordingly, e.g.
|
||||
|
||||
- devices in 192.168.0.1 - 192.168.0.254 -> `route 192.168.0.0`
|
||||
- devices in 192.168.123.1 - 192.168.123.254 -> `route 192.168.123.0`
|
||||
|
||||
Edit your `/etc/openvpn/server/server.conf`:
|
||||
|
||||
```text
|
||||
push "route 192.168.2.0 255.255.255.0"
|
||||
push "dhcp-option DNS 192.168.2.123"
|
||||
```
|
||||
|
||||
As you can see, we change the address of the DNS server to the local IP address of our Pi-hole (which is **192.168.2.123** in this example).
|
||||
|
||||
Afterward, we change the interface of `Pi-hole` to `eth0` (your local network adapter instead of the VPN adapter `tun0`). This can conveniently be done by using `pihole -r` + `Reconfigure`.
|
||||
|
||||
After a restart of the OpenVPN server, all clients should be able to see all devices within your (at home) local network. This is an example running on a distant server, which is connected through the VPN and can successfully communicate with all internal devices:
|
||||
|
||||
```bash
|
||||
me@client ~ $ ifconfig
|
||||
eth0 Link encap:Ethernet HWaddr e0:xx:xx:xx:xx:xx
|
||||
inet addr:134.x.x.x Bcast:134.x.x.x Mask:255.x.x.x
|
||||
inet6 addr: X:X:X:X::X/64 Scope:Link
|
||||
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
|
||||
RX packets:3623911 errors:0 dropped:0 overruns:0 frame:0
|
||||
TX packets:2803670 errors:0 dropped:0 overruns:0 carrier:0
|
||||
collisions:0 txqueuelen:1000
|
||||
RX bytes:1921375471 (1.9 GB) TX bytes:1227835028 (1.2 GB)
|
||||
|
||||
lo Link encap:Local Loopback
|
||||
inet addr:127.0.0.1 Mask:255.0.0.0
|
||||
inet6 addr: ::1/128 Scope:Host
|
||||
UP LOOPBACK RUNNING MTU:65536 Metric:1
|
||||
RX packets:553426 errors:0 dropped:0 overruns:0 frame:0
|
||||
TX packets:553426 errors:0 dropped:0 overruns:0 carrier:0
|
||||
collisions:0 txqueuelen:1
|
||||
RX bytes:113417383 (113.4 MB) TX bytes:113417383 (113.4 MB)
|
||||
|
||||
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
|
||||
inet addr:10.8.0.2 P-t-P:10.8.0.2 Mask:255.255.255.0
|
||||
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
|
||||
RX packets:274676 errors:0 dropped:0 overruns:0 frame:0
|
||||
TX packets:331178 errors:0 dropped:0 overruns:0 carrier:0
|
||||
collisions:0 txqueuelen:100
|
||||
RX bytes:43745313 (43.7 MB) TX bytes:43956250 (43.9 MB)
|
||||
|
||||
me@client ~ $ ping 192.168.2.123
|
||||
PING 192.168.2.123 (192.168.2.123) 56(84) bytes of data.
|
||||
64 bytes from 192.168.2.123: icmp_seq=1 ttl=64 time=18.9 ms
|
||||
64 bytes from 192.168.2.123: icmp_seq=2 ttl=64 time=18.9 ms
|
||||
64 bytes from 192.168.2.123: icmp_seq=3 ttl=64 time=18.9 ms
|
||||
64 bytes from 192.168.2.123: icmp_seq=4 ttl=64 time=18.7 ms
|
||||
64 bytes from 192.168.2.123: icmp_seq=5 ttl=64 time=18.7 ms
|
||||
64 bytes from 192.168.2.123: icmp_seq=6 ttl=64 time=19.0 ms
|
||||
^C
|
||||
--- 192.168.2.123 ping statistics ---
|
||||
6 packets transmitted, 6 received, 0% packet loss, time 5007ms
|
||||
rtt min/avg/max/mdev = 18.740/18.894/19.017/0.189 ms
|
||||
```
|
||||
|
||||
### Important last step
|
||||
|
||||
The undocumented `pihole -a -i all` command is simply what runs when you choose _Listen on all interfaces, permit all origins (make sure your Pi-hole is firewalled)_, which if you've read this far in the tutorial, you should understand that we don't want you to knowingly or unknowing set up an open resolver.
|
||||
|
||||
|
||||
@@ -1,97 +0,0 @@
|
||||
{!guides/vpn/openvpn/deprecation_notice.md!}
|
||||
|
||||
If you operate your Pi-hole + OpenVPN at home, you are likely sitting behind a NAT / dynamically changing IP address. In this case, you should set up a dynamic DNS record, which allows you to reach your server. You can exchange the address that has been configured during the setup of OpenVPN like this:
|
||||
|
||||
```bash
|
||||
vim /etc/openvpn/server/client-common.txt
|
||||
```
|
||||
|
||||
Look for the `remote` line and adjust it accordingly (remove IP address, add hostname), e.g.
|
||||
|
||||
```text
|
||||
remote home.mydomain.de 1194
|
||||
```
|
||||
|
||||
This change has to be repeated in each client config file (`*.conf`) that you have been created up till now.
|
||||
|
||||
If you have set up a DDNS domain for your IP address, you will likely need to add a host-record to Pi-hole's settings.
|
||||
|
||||
```bash
|
||||
pihole -a hostrecord home.mydomain.de 192.168.1.10
|
||||
```
|
||||
|
||||
If you don't do this, clients (like the Android OpenVPN client) will not able to connect to the VPN server when *inside the internal network* (while it will work from outside). Afterward, the client will be able to connect to the VPN server both from inside and outside your local network.
|
||||
|
||||
## Setting up DynDNS update
|
||||
|
||||
If your router cannot update the dynamic DNS record, you can use for example `ddclient`.
|
||||
|
||||
```bash
|
||||
sudo apt install ddclient
|
||||
```
|
||||
|
||||
This configuration file resides in `/etc/ddclient.conf`. During installation, `apt` probably already asked you some questions and prepared a useful config file. In general, configuration files look like:
|
||||
|
||||
```bash
|
||||
# /etc/ddclient.conf
|
||||
#
|
||||
protocol=dyndns2
|
||||
use=web
|
||||
login=mylogin
|
||||
password=mypassword
|
||||
myhost.dyndns.org
|
||||
```
|
||||
|
||||
If you want to have `ddclient` running as daemon (recommended!), change also your `/etc/default/ddclient` to:
|
||||
|
||||
```bash
|
||||
# Configuration for ddclient scripts
|
||||
# generated from debconf on Do 9. Feb 22:29:13 CET 2017
|
||||
#
|
||||
# /etc/default/ddclient
|
||||
|
||||
# Set to "true" if ddclient should be run every time DHCP client ('dhclient'
|
||||
# from package isc-dhcp-client) updates the systems IP address.
|
||||
run_dhclient="false"
|
||||
|
||||
# Set to "true" if ddclient should be run every time a new ppp connection is
|
||||
# established. This might be useful, if you are using dial-on-demand.
|
||||
run_ipup="false"
|
||||
|
||||
# Set to "true" if ddclient should run in daemon mode
|
||||
# If this is changed to true, run_ipup and run_dhclient must be set to false.
|
||||
run_daemon="true"
|
||||
|
||||
# Set the time interval between the updates of the dynamic DNS name in seconds.
|
||||
# This option only takes effect if the ddclient runs in daemon mode.
|
||||
daemon_interval="300"
|
||||
```
|
||||
|
||||
### Example: Strato DynDNS
|
||||
|
||||
In the following, we give an example of how to set up `ddclient` using the German Internet hosting provider Strato. First, you need to create a subdomain. Then you need to enable DynDNS for this domain:
|
||||
|
||||
|
||||
|
||||
---
|
||||
|
||||
|
||||
|
||||
---
|
||||
|
||||
|
||||
|
||||
Afterwards, modify your `ddclient` config file to look like:
|
||||
|
||||
```bash
|
||||
protocol=dyndns2
|
||||
use=if, if=eth0
|
||||
use=web, web=checkip.dyndns.org
|
||||
server=dyndns.strato.com/nic/update
|
||||
login=strato-login-name
|
||||
password='password1234'
|
||||
|
||||
meine.domain.de
|
||||
```
|
||||
|
||||
where you replace `strato-login-name` by your Strato login name (most likely your domain name, like `maxmustermann.de`), `password1234` by the password you configured above (see the third screenshot), and `meine.domain.de` by the subdomain you created and enabled dynamic DNS for.
|
||||
@@ -1,169 +0,0 @@
|
||||
{!guides/vpn/openvpn/deprecation_notice.md!}
|
||||
|
||||
### (optional) Secure the server with firewall rules (`iptables`)
|
||||
|
||||
**If you are behind a NAT and not running the Pi-hole on a cloud server, you do not need to issue the IPTABLES commands below as the firewall rules are already handled by the RoadWarrior installer, but you will need to portforward whatever port you chose in the setup from your public ip to your device using your router.**
|
||||
|
||||
**This step is optional but recommended if you are running your server in the cloud, such as a droplet made on [Digital Ocean](https://www.digitalocean.com/?refcode=344d234950e1)**. If this is the case, you need to secure the server for your safety as well as others to prevent aiding in DDoS attacks.
|
||||
|
||||
In addition to the risk of being an open resolver, your Web interface is also open to the world increasing the risk. So you will want to prevent ports 53 and 80, respectively, from being accessible from the public Internet.
|
||||
|
||||
It's recommended that you [clear out your entire firewall](https://serverfault.com/questions/200635/best-way-to-clear-all-iptables-rules) so you have full control over its setup. You have two options for setting up your firewall with your VPN.
|
||||
|
||||
#### Option 1: Allow everything from within your VPN
|
||||
|
||||
Enter this command, which will allow all traffic through the VPN `tun0` interface.
|
||||
|
||||
```bash
|
||||
iptables -I INPUT -i tun0 -j ACCEPT
|
||||
```
|
||||
|
||||
#### Option 2: Explicitly allow what can be accessed within the VPN
|
||||
|
||||
These commands will allow DNS and HTTP needed for name resolution (using Pi-hole as a resolver) and accessing the Web interface, respectively.
|
||||
|
||||
```bash
|
||||
iptables -A INPUT -i tun0 -p tcp --destination-port 53 -j ACCEPT
|
||||
iptables -A INPUT -i tun0 -p udp --destination-port 53 -j ACCEPT
|
||||
iptables -A INPUT -i tun0 -p tcp --destination-port 80 -j ACCEPT
|
||||
```
|
||||
|
||||
You will also want to enable SSH and VPN access from anywhere.
|
||||
|
||||
```bash
|
||||
iptables -A INPUT -p tcp --destination-port 22 -j ACCEPT
|
||||
iptables -A INPUT -p tcp --destination-port 1194 -j ACCEPT
|
||||
iptables -A INPUT -p udp --destination-port 1194 -j ACCEPT
|
||||
```
|
||||
|
||||
The next crucial setting is to explicitly allow TCP/IP to do "three-way handshakes":
|
||||
|
||||
```bash
|
||||
iptables -I INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
|
||||
```
|
||||
|
||||
Also, we want to allow any loopback traffic, i.e. the server is allowed to talk to itself without any limitations using 127.0.0.0/8:
|
||||
|
||||
```bash
|
||||
iptables -I INPUT -i lo -j ACCEPT
|
||||
```
|
||||
|
||||
Finally, reject access from anywhere else (i.e. if no rule has matched up to this point):
|
||||
|
||||
```bash
|
||||
iptables -P INPUT DROP
|
||||
```
|
||||
|
||||
##### Blocking HTTPS advertisement assets
|
||||
|
||||
Since you're `:head-desk:`ing with `iptables`, you can also use this opportunity to block HTTPS advertisements to [improve blocking ads that are loaded via HTTPS](https://discourse.pi-hole.net/t/why-do-some-sites-take-forever-to-load-when-using-pi-hole-for-versions-v4-0/3654/4) and also deal with QUIC.
|
||||
|
||||
> Why doesn't Pi-hole just use a certificate to prevent this? The answer is [here](https://discourse.pi-hole.net/t/slow-loading-websites/3408/12).
|
||||
|
||||
```bash
|
||||
iptables -A INPUT -p udp --dport 80 -j REJECT --reject-with icmp-port-unreachable
|
||||
iptables -A INPUT -p tcp --dport 443 -j REJECT --reject-with tcp-reset
|
||||
iptables -A INPUT -p udp --dport 443 -j REJECT --reject-with icmp-port-unreachable
|
||||
```
|
||||
|
||||
Depending on the systems you have connecting, you may benefit from appending `--reject-with tcp-reset` to the command above. If you still get slow load times of HTTPS assets, the above may help.
|
||||
|
||||
##### IPv6 `iptables`
|
||||
|
||||
If your server is reachable via IPv6, you'll need to run the same commands but using `ip6tables`:
|
||||
|
||||
```bash
|
||||
ip6tables -A INPUT -i tun0 -p tcp --destination-port 53 -j ACCEPT
|
||||
ip6tables -A INPUT -i tun0 -p udp --destination-port 53 -j ACCEPT
|
||||
ip6tables -A INPUT -i tun0 -p tcp --destination-port 80 -j ACCEPT
|
||||
ip6tables -A INPUT -p tcp --destination-port 22 -j ACCEPT
|
||||
ip6tables -A INPUT -p tcp --destination-port 1194 -j ACCEPT
|
||||
ip6tables -A INPUT -p udp --destination-port 1194 -j ACCEPT
|
||||
ip6tables -I INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
|
||||
ip6tables -I INPUT -i lo -j ACCEPT
|
||||
ip6tables -A INPUT -p udp --dport 80 -j REJECT --reject-with icmp6-port-unreachable
|
||||
ip6tables -A INPUT -p tcp --dport 443 -j REJECT --reject-with tcp-reset
|
||||
ip6tables -A INPUT -p udp --dport 443 -j REJECT --reject-with icmp6-port-unreachable
|
||||
ip6tables -P INPUT DROP
|
||||
```
|
||||
|
||||
View the rules you just created
|
||||
|
||||
```bash
|
||||
iptables -L --line-numbers
|
||||
```
|
||||
|
||||
and they should look something like this:
|
||||
|
||||
```text
|
||||
Chain INPUT (policy DROP)
|
||||
num target prot opt source destination
|
||||
1 ACCEPT all -- anywhere anywhere
|
||||
2 ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
|
||||
3 ACCEPT all -- anywhere anywhere
|
||||
4 ACCEPT tcp -- anywhere anywhere tcp dpt:domain
|
||||
5 ACCEPT udp -- anywhere anywhere udp dpt:domain
|
||||
6 ACCEPT tcp -- anywhere anywhere tcp dpt:http
|
||||
7 ACCEPT udp -- anywhere anywhere udp dpt:80
|
||||
8 ACCEPT tcp -- anywhere anywhere tcp dpt:ssh
|
||||
9 ACCEPT tcp -- anywhere anywhere tcp dpt:openvpn
|
||||
10 ACCEPT udp -- anywhere anywhere udp dpt:openvpn
|
||||
11 ACCEPT tcp -- 10.8.0.0/24 anywhere tcp dpt:domain
|
||||
12 ACCEPT udp -- 10.8.0.0/24 anywhere udp dpt:domain
|
||||
13 ACCEPT tcp -- 10.8.0.0/24 anywhere tcp dpt:http
|
||||
14 ACCEPT udp -- 10.8.0.0/24 anywhere udp dpt:80
|
||||
15 ACCEPT tcp -- 10.8.0.0/24 anywhere tcp dpt:domain
|
||||
16 ACCEPT tcp -- 10.8.0.0/24 anywhere tcp dpt:http
|
||||
17 ACCEPT udp -- 10.8.0.0/24 anywhere udp dpt:domain
|
||||
18 ACCEPT udp -- 10.8.0.0/24 anywhere udp dpt:80
|
||||
19 REJECT tcp -- anywhere anywhere tcp dpt:https reject-with icmp-port-unreachable
|
||||
|
||||
Chain FORWARD (policy ACCEPT)
|
||||
num target prot opt source destination
|
||||
|
||||
Chain OUTPUT (policy ACCEPT)
|
||||
num target prot opt source destination
|
||||
```
|
||||
|
||||
Similarly, `ip6tables -L --line-numbers` should look like this:
|
||||
|
||||
```text
|
||||
Chain INPUT (policy DROP)
|
||||
num target prot opt source destination
|
||||
1 ACCEPT all anywhere anywhere
|
||||
2 ACCEPT all anywhere anywhere state RELATED,ESTABLISHED
|
||||
3 ACCEPT tcp anywhere anywhere tcp dpt:domain
|
||||
4 ACCEPT udp anywhere anywhere udp dpt:domain
|
||||
5 ACCEPT tcp anywhere anywhere tcp dpt:http
|
||||
6 ACCEPT udp anywhere anywhere udp dpt:80
|
||||
7 ACCEPT tcp anywhere anywhere tcp dpt:ssh
|
||||
8 ACCEPT tcp anywhere anywhere tcp dpt:openvpn
|
||||
9 ACCEPT udp anywhere anywhere udp dpt:openvpn
|
||||
10 REJECT tcp anywhere anywhere tcp dpt:https reject-with icmp6-port-unreachable
|
||||
|
||||
Chain FORWARD (policy ACCEPT)
|
||||
num target prot opt source destination
|
||||
|
||||
Chain OUTPUT (policy ACCEPT)
|
||||
num target prot opt source destination
|
||||
```
|
||||
|
||||
##### Verify the rules are working
|
||||
|
||||
Connect to the VPN as a client and verify you can resolve DNS names as well as access the Pi-hole Web interface. These settings are stored in memory until you save them. If it's not working, you can restart your server to start from scratch. Alternatively, you could also go through and delete lines with `iptables -D INPUT <SOME LINE NUMBER>`
|
||||
|
||||
#### Save your `iptables`
|
||||
|
||||
If things look good, you may want to save your rules so you can revert to them if you ever make changes to the firewall. Save them with these commands:
|
||||
|
||||
```bash
|
||||
iptables-save > /etc/pihole/rules.v4
|
||||
ip6tables-save > /etc/pihole/rules.v6
|
||||
```
|
||||
|
||||
Similarly, you can restore these rules:
|
||||
|
||||
```bash
|
||||
iptables-restore < /etc/pihole/rules.v4
|
||||
ip6tables-restore < /etc/pihole/rules.v6
|
||||
```
|
||||
@@ -1,25 +0,0 @@
|
||||
{!guides/vpn/openvpn/deprecation_notice.md!}
|
||||
|
||||
This tutorial is tailored for setting up OpenVPN on a cloud-hosted virtual server. If you wish to have this working on your home network, you will need to tailor Pi-hole to listen on `eth0` (or similar), which we explain in [this section of the tutorial](dual-operation.md).
|
||||
|
||||
### High-level Overview
|
||||
|
||||
Using a VPN is a responsible, respectful, and safe way to access your Pi-hole's capabilities remotely. Setting up a DNS server has become a simple task with Pi-hole's automated installer, which has resulted in many people knowingly--or unknowingly--creating an open resolver, which aids in DNS Amplification Attacks.
|
||||
|
||||
We do not encourage open resolvers but there are always people wanting access to their ad-blocking capabilities outside of their home network, whether it's on their cellular network or on an unsecured wireless network. This article aims to provide a step-by-step walk-through on setting up a server running Pi-hole and OpenVPN so you can connect to your Pi-hole's DNS from anywhere. This guide should work for a private server installed on your private network, but it will also work for cloud servers, such as those created on [Digital Ocean](https://www.digitalocean.com/?refcode=344d234950e1).
|
||||
|
||||
**This tutorial walks you through the installation of Pi-hole combined with a VPN server for secure access from remote clients**.
|
||||
|
||||
Via this VPN, you can:
|
||||
|
||||
- use the DNS server and full filtering capabilities of your Pi-hole from everywhere around the globe
|
||||
- access your admin interface remotely
|
||||
- encrypt your Internet traffic
|
||||
|
||||
If you don't want a full-tunnel, we provide a page of how to [set up your server to exclusively route DNS traffic, but nothing else via the VPN](only-dns-via-vpn.md). On another optional page, we describe how to set up Pi-hole + VPN in such a way that it is [usable both locally (no VPN) and from remote (through VPN)](dual-operation.md) while preserving full functionality.
|
||||
|
||||
In the end, you will have access to a VPN that uses Pi-hole for DNS and tunnels some or all of your network traffic
|
||||
|
||||
---
|
||||
|
||||
This manual is partially based on this [HowTo](https://discourse.pi-hole.net/t/pi-hole-with-openvpn-vps-debian/861) on [Discourse](https://discourse.pi-hole.net).
|
||||
@@ -1,79 +0,0 @@
|
||||
{!guides/vpn/openvpn/deprecation_notice.md!}
|
||||
|
||||
## Install an operating system
|
||||
|
||||
Once you have your preferred OS up and running. You may already have a server set up on your network, or you may prefer to make a [Digital Ocean](https://www.digitalocean.com/?refcode=344d234950e1) droplet. In either case, you'll use the quick OpenVPN "road warrior" installer. The cloud-hosted server option is convenient if you don't want to host the hardware at home, but you'll need to take additional steps to secure the server as it's available on the public Internet. Failure to do so is [not only irresponsible, but you also put yourself and others at risk](https://us-cert.cisa.gov/ncas/alerts/TA13-088A).
|
||||
|
||||
## Install OpenVPN + Pi-hole
|
||||
|
||||
### A note about security
|
||||
|
||||
For security purposes, it is recommended that the CA machine should be separate from the machine running OpenVPN. If you lose control of your CA private key, you can no longer trust any certificates from this CA. Anyone with access to this CA private key can sign new certificates without your knowledge, which then can connect to your OpenVPN server without needing to modify anything on the VPN server. Place your CA files on storage that can be offline as much as possible, only to be activated when you need to get a new certificate for a client or server.
|
||||
|
||||
This is less convenient, so many users will simply decide to install Pi-hole and OpenVPN on a single machine, which is what this guide will walkthrough.
|
||||
|
||||
### Install the OpenVPN server
|
||||
|
||||
First, download the OpenVPN installer; make it executable, and then run it:
|
||||
|
||||
```bash
|
||||
wget https://github.com/Nyr/openvpn-install/raw/master/openvpn-install.sh
|
||||
chmod 755 openvpn-install.sh
|
||||
./openvpn-install.sh
|
||||
```
|
||||
|
||||
Enter your server's IP address and accept all the defaults, unless you require special needs:
|
||||
|
||||
```text
|
||||
Welcome to this quick OpenVPN "road warrior" installer
|
||||
|
||||
I need to ask you a few questions before starting the setup
|
||||
You can leave the default options and just press enter if you are ok with them
|
||||
|
||||
First I need to know the IPv4 address of the network interface you want OpenVPN
|
||||
listening to.
|
||||
IP address: 10.8.0.1
|
||||
|
||||
Which protocol do you want for OpenVPN connections?
|
||||
1) UDP (recommended)
|
||||
2) TCP
|
||||
Protocol [1-2]: 1
|
||||
|
||||
What port do you want OpenVPN listening to?
|
||||
Port: 1194
|
||||
|
||||
Which DNS do you want to use with the VPN?
|
||||
1) Current system resolvers
|
||||
2) Google
|
||||
3) OpenDNS
|
||||
4) NTT
|
||||
5) Hurricane Electric
|
||||
6) Verisign
|
||||
DNS [1-6]: 1
|
||||
|
||||
Finally, tell me your name for the client certificate
|
||||
Please, use one word only, no special characters
|
||||
Client name: pihole
|
||||
|
||||
Okay, that was all I needed. We are ready to setup your OpenVPN server now
|
||||
Press any key to continue...
|
||||
```
|
||||
|
||||
Let the installer run...
|
||||
|
||||
```text
|
||||
Finished!
|
||||
|
||||
Your client configuration is available at /root/pihole.ovpn
|
||||
If you want to add more clients, you simply need to run this script again!
|
||||
```
|
||||
|
||||
**You can set your port to whatever you would like, however you will have to portforward this port in your routers settings from your public ip to your device (if self hosting).**
|
||||
|
||||
### Install Pi-hole
|
||||
|
||||
Next, install Pi-hole and choose `tun0` as the interface and `10.8.0.1/24` as the IP address. You can accept the rest of the defaults, or configure Pi-hole to your liking. The interface selection is the most important step; if you don't choose `tun0` (at least to begin with), it will not work properly.
|
||||
|
||||
```bash
|
||||
curl -sSL https://install.pi-hole.net | bash
|
||||
```
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 9.0 KiB |
@@ -1,74 +0,0 @@
|
||||
{!guides/vpn/openvpn/deprecation_notice.md!}
|
||||
|
||||
### Optional: Only route DNS via VPN
|
||||
|
||||
With this setup, you will force connected clients to use **only the DNS provided by the VPN connection, i.e. the Pi-hole.** Do this only if you **don't** want to tunnel all traffic from the client through the VPN, but only its DNS queries.
|
||||
|
||||
Edit your `/etc/openvpn/server/server.conf` and remove (comment out) the following line:
|
||||
|
||||
```ini
|
||||
# push "redirect-gateway def1 bypass-dhcp"
|
||||
```
|
||||
|
||||
### Using a client config file
|
||||
|
||||
This works pretty much out of the box with common `client.ovpn` files, like this provided one: [client.ovpn](client.ovpn)
|
||||
|
||||
Remember to replace the locations of your keys and the address/hostname of your server.
|
||||
|
||||
### Using the Network Manager
|
||||
|
||||
When using the Network Manager, you will have to do some additional setting on the client's side of things:
|
||||
|
||||
|
||||
|
||||
#### Alternative 1: Disable Network Manager's internal DNS server
|
||||
|
||||
Edit `/etc/NetworkManager/NetworkManager.conf`:
|
||||
|
||||
```ini
|
||||
# dns=dnsmasq
|
||||
```
|
||||
|
||||
and restart the Network Manager:
|
||||
|
||||
```bash
|
||||
sudo restart network-manager
|
||||
```
|
||||
|
||||
When connecting your DNS server will now be properly picked up and used by your client.
|
||||
|
||||
#### Alternative 2: Set DNS server address of your Pi-hole manually on the main interface
|
||||
|
||||
You can also set the address of the DNS server manually (use the device which actually connects to the internet, e.g. `eth0`):
|
||||
|
||||
|
||||
|
||||
After doing either alternative, you should see:
|
||||
|
||||
```text
|
||||
pi.hole has address W.X.Y.Z (outside address of your VPN server)
|
||||
pi.hole has IPv6 address A:B:C:D:E:F (outside address of your VPN server)
|
||||
```
|
||||
|
||||
The web interface of your Pi-hole will be visible at `http://pi.hole/admin/` (even with the recommended firewall configuration mentioned on another subpage)
|
||||
|
||||
|
||||
|
||||
---
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
If your new DNS server configuration has not been activated (try restarting the interface/system) you will see
|
||||
|
||||
```text
|
||||
host pi.hole
|
||||
Host pi.hole not found: 3(NXDOMAIN)
|
||||
```
|
||||
|
||||
If you are not connected to your VPN network you will see
|
||||
|
||||
```text
|
||||
host pi.hole
|
||||
;; connection timed out; no servers could be reached
|
||||
```
|
||||
@@ -1,81 +0,0 @@
|
||||
{!guides/vpn/openvpn/deprecation_notice.md!}
|
||||
|
||||
### Change OpenVPN's resolvers
|
||||
|
||||
First, find the IP of your `tun0` interface:
|
||||
|
||||
On Jessie
|
||||
|
||||
```bash
|
||||
ifconfig tun0 | grep 'inet addr'
|
||||
```
|
||||
|
||||
On Stretch
|
||||
|
||||
```bash
|
||||
ip a
|
||||
```
|
||||
|
||||
Edit the OpenVPN config file:
|
||||
|
||||
```bash
|
||||
vim /etc/openvpn/server/server.conf
|
||||
```
|
||||
|
||||
Set this line to use your Pi-hole's IP address, which you determined from the `ifconfig` command and comment out or remove the other line (if it exists):
|
||||
|
||||
```text
|
||||
push "dhcp-option DNS 10.8.0.1"
|
||||
#push "dhcp-option DNS 8.8.8.8"
|
||||
```
|
||||
|
||||
This `push` directive is setting a [DHCP option](https://www.incognito.com/tutorials/dhcp-options-in-plain-english/), which tells clients connecting to the VPN that they should use Pi-hole as their primary DNS server.
|
||||
|
||||
It's [suggested to have Pi-hole be the only resolver](https://discourse.pi-hole.net/t/why-should-pi-hole-be-my-only-dns-server/3376) as it defines the upstream servers. Setting a non-Pi-hole resolver here [may have adverse effects on ad blocking](https://discourse.pi-hole.net/t/why-should-pi-hole-be-my-only-dns-server/3376) but it _can_ provide failover connectivity in the case of Pi-hole not working if that is something you are concerned about.
|
||||
|
||||
Furthermore, you might want to enable logging for your OpenVPN server. In this case, add the following lines to your server's config file:
|
||||
|
||||
```text
|
||||
log /var/log/openvpn.log
|
||||
verb 3
|
||||
```
|
||||
|
||||
### Restart OpenVPN to apply the changes
|
||||
|
||||
Depending on your operating system, one of these commands should work to restart the service.
|
||||
|
||||
```bash
|
||||
systemctl restart openvpn-server@server
|
||||
service openvpn-server@server restart
|
||||
```
|
||||
|
||||
## Create a client config file (`.ovpn`)
|
||||
|
||||
Now that the server is configured, you'll want to connect some clients so you can make use of your Pi-hole wherever you are. Doing so requires the use of a certificate. You generate these and the resulting `.ovpn` file by running the installer and choosing `1) Add a new user` for each client that will connect to the VPN.
|
||||
|
||||
You can repeat this process for as many clients as you need. In this example, we'll "Add a new user" by naming the `.ovpn` file the same as the client's hostname but you may want to adopt your own naming strategy.
|
||||
|
||||
Run the OpenVPN installer again
|
||||
|
||||
```bash
|
||||
./openvpn-install.sh
|
||||
```
|
||||
|
||||
Choose `1) Add a new user` and enter a client name
|
||||
|
||||
```text
|
||||
Looks like OpenVPN is already installed
|
||||
|
||||
What do you want to do?
|
||||
1) Add a new user
|
||||
2) Revoke an existing user
|
||||
3) Remove OpenVPN
|
||||
4) Exit
|
||||
Select an option [1-4]: 1
|
||||
|
||||
Tell me a name for the client certificate
|
||||
Please, use one word only, no special characters
|
||||
Client name: iphone7
|
||||
```
|
||||
|
||||
This will generate a `.ovpn` file, which needs to be copied to your client machine (oftentimes using the OpenVPN app). This process also generates a few other files found in `/etc/openvpn/server/easy-rsa/pki/`, which make public key authentication possible; you only need to worry about the `.ovpn` file, though.
|
||||
@@ -1,42 +0,0 @@
|
||||
{!guides/vpn/openvpn/deprecation_notice.md!}
|
||||
|
||||
### CRL expired
|
||||
|
||||
OpenVPN 2.4 and newer check the validity of the Certificate Revocation List (CRL). This can result in a sudden malfunction of `openvpn` after an update even though no configuration files have changed. This error manifests in the following, not very helpful, error on the client's side:
|
||||
|
||||
```text
|
||||
Wed Apr 24 11:19:07 2019 VERIFY OK: depth=0, CN=server
|
||||
Wed Apr 24 11:19:07 2019 Connection reset, restarting [0]
|
||||
Wed Apr 24 11:19:07 2019 SIGUSR1[soft,connection-reset] received, process restarting
|
||||
Wed Apr 24 11:19:07 2019 Restart pause, 5 second(s)
|
||||
```
|
||||
|
||||
Android clients simply report: "Transport error, trying to reconnect..."
|
||||
|
||||
> 
|
||||
|
||||
On the OpenVPN server, the following messages are logged:
|
||||
|
||||
```text
|
||||
Wed Apr 24 11:19:07 2019 aaa.bbb.ccc.ddd:pppp TLS: Initial packet from [AF_INET]aaa.bbb.ccc.ddd:pppp, sid=57719cb8 77945ae9
|
||||
Wed Apr 24 11:19:07 2019 aaa.bbb.ccc.ddd:pppp VERIFY ERROR: depth=0, error=CRL has expired: CN=client1
|
||||
Wed Apr 24 11:19:07 2019 aaa.bbb.ccc.ddd:pppp OpenSSL: error:11089086:SSL routines:ssl3_get_client_certificate:certificate verify failed
|
||||
Wed Apr 24 11:19:07 2019 aaa.bbb.ccc.ddd:pppp TLS_ERROR: BIO read tls_read_plaintext error
|
||||
Wed Apr 24 11:19:07 2019 aaa.bbb.ccc.ddd:pppp TLS Error: TLS object -> incoming plaintext read error
|
||||
Wed Apr 24 11:19:07 2019 aaa.bbb.ccc.ddd:pppp TLS Error: TLS handshake failed
|
||||
Wed Apr 24 11:19:07 2019 aaa.bbb.ccc.ddd:pppp Fatal TLS error (check_tls_errors_co), restarting
|
||||
Wed Apr 24 11:19:07 2019 aaa.bbb.ccc.ddd:pppp SIGUSR1[soft,tls-error] received, client-instance restarting
|
||||
```
|
||||
|
||||
The error is `CRL has expired` and can be solved using the following commands:
|
||||
|
||||
```bash
|
||||
sudo -s
|
||||
cd /etc/openvpn
|
||||
mv crl.pem crl.pem_old
|
||||
cd easy-rsa
|
||||
./easyrsa gen-crl
|
||||
cp pki/crl.pem ../
|
||||
service openvpn restart
|
||||
exit
|
||||
```
|
||||
-25
@@ -191,19 +191,6 @@ nav:
|
||||
- 'Make local devices accessible': guides/vpn/wireguard/internal.md
|
||||
- 'Tunnel all Internet traffic': guides/vpn/wireguard/route-everything.md
|
||||
- 'Troubleshooting': guides/vpn/wireguard/faq.md
|
||||
- 'OpenVPN':
|
||||
- 'OpenVPN': guides/vpn/openvpn/index.md
|
||||
- 'Installation': guides/vpn/openvpn/installation.md
|
||||
- 'Setup OpenVPN Server': guides/vpn/openvpn/setup-openvpn-server.md
|
||||
- 'Firewall Configuration': guides/vpn/openvpn/firewall.md
|
||||
- 'Connecting clients':
|
||||
- 'General': guides/vpn/openvpn/clients.md
|
||||
- 'Android': guides/vpn/openvpn/android-client.md
|
||||
- 'Optional: Only route DNS via VPN': guides/vpn/openvpn/only-dns-via-vpn.md
|
||||
- 'Optional: Dual operation: LAN & VPN at the same time': guides/vpn/openvpn/dual-operation.md
|
||||
- 'Optional: Full and DNS-only': guides/vpn/openvpn/dual-VPN.md
|
||||
- 'Optional: Dynamic DNS': guides/vpn/openvpn/dynDNS.md
|
||||
- 'Troubleshooting': guides/vpn/openvpn/troubleshooting.md
|
||||
- 'Misc':
|
||||
- 'Home Assistant': guides/misc/homeassistant.md
|
||||
- 'Benchmarking': guides/misc/benchmark.md
|
||||
@@ -228,7 +215,6 @@ nav:
|
||||
|
||||
not_in_nav: |
|
||||
/abbreviations.md
|
||||
/guides/vpn/openvpn/deprecation_notice.md
|
||||
|
||||
extra:
|
||||
social:
|
||||
@@ -256,16 +242,6 @@ plugins:
|
||||
'guides/upstream-dns-providers.md': guides/dns/upstream-dns-providers.md
|
||||
'guides/dns-over-https.md': guides/dns/cloudflared.md
|
||||
'guides/vpn/overview.md': guides/vpn/wireguard/index.md
|
||||
'guides/vpn/installation.md': guides/vpn/openvpn/installation.md
|
||||
'guides/vpn/setup-openvpn-server.md': guides/vpn/openvpn/setup-openvpn-server.md
|
||||
'guides/vpn/firewall.md': guides/vpn/openvpn/firewall.md
|
||||
'guides/vpn/clients.md': guides/vpn/openvpn/clients.md
|
||||
'guides/vpn/android-client.md': guides/vpn/openvpn/android-client.md
|
||||
'guides/vpn/only-dns-via-vpn.md': guides/vpn/openvpn/only-dns-via-vpn.md
|
||||
'guides/vpn/dual-operation.md': guides/vpn/openvpn/dual-operation.md
|
||||
'guides/vpn/dual-VPN.md': guides/vpn/openvpn/dual-VPN.md
|
||||
'guides/vpn/dynDNS.md': guides/vpn/openvpn/dynDNS.md
|
||||
'guides/vpn/troubleshooting.md': guides/vpn/openvpn/troubleshooting.md
|
||||
'guides/benchmark.md': guides/misc/benchmark.md
|
||||
'guides/tor/overview.md': guides/misc/tor/index.md
|
||||
'guides/tor/setup.md': guides/misc/tor/setup.md
|
||||
@@ -285,7 +261,6 @@ plugins:
|
||||
'group_management/groups.md': group_management/index.md
|
||||
'regex/overview.md': regex/index.md
|
||||
'guides/vpn/wireguard/overview.md': guides/vpn/wireguard/index.md
|
||||
'guides/vpn/openvpn/overview.md': guides/vpn/openvpn/index.md
|
||||
'guides/misc/tor/overview.md': guides/misc/tor/index.md
|
||||
'guides/github/contributing.md': guides/github/index.md
|
||||
'guides/misc/whitelist-blacklist.md': guides/misc/allowlist-denylist.md
|
||||
|
||||
Reference in New Issue
Block a user