Podrška #18557
Zatvoren
refresh_ip - dyndns-like implementacija, vpn on fritz!box, openvpn
Dodano od Ernad Husremović prije više od 15 godina. Izmjenjeno prije skoro 15 godina.
0%
Fajlovi
| fritz-dyndns.png (20,7 KB) fritz-dyndns.png | Jasmin Beganović, 23.10.2009 13:34 | ||
| fritz-dyndns-userdefined.png (21,1 KB) fritz-dyndns-userdefined.png | Jasmin Beganović, 23.10.2009 13:34 | ||
| proba-dyndns.ba.png (12 KB) proba-dyndns.ba.png | Jasmin Beganović, 23.10.2009 15:39 |
Povezani tiketi 1 (0 otvoreno — 1 zatvoren)
Izmjenjeno od Ernad Husremović prije više od 15 godina
Izmjenjeno od Ernad Husremović prije više od 15 godina
Izmjenjeno od Ernad Husremović prije više od 15 godina
Izmjenjeno od Ernad Husremović prije više od 15 godina
Find out my IP address
require 'resolv'
my_ip = Resolv.getaddress('mysite.dyndns.org')
Check my WAN (Broadband) address
require 'net/https'
require 'uri'
external_ip=''
uri = URI.parse('http://checkip.dyndns.org/')
Net::HTTP.new(uri.host,uri.port).start { |http|
http.request_get('/') { |resp|
# The response looks like:
#
# Current IP Address: 81.155.100.200
#
external_ip = resp.read_body.gsub(/[^:]*: ([^<]*)<.*$/,"\\1")
external_ip = external_ip.gsub(/\n/,'')
}
}
Update the IP address, but only if necessary
# do nothing if my IP address has not changed
exit 0 if my_ip == external_ip
# perform the update
# This header is required by dyndns.org
headers = {
"User-Agent" => "My Server - #{__FILE__} - 1.0"
}
uri = URI.parse('https://members.dyndns.org/')
http = Net::HTTP.new(uri.host, uri.port)
# switch on SSL
http.use_ssl = true if uri.scheme == "https"
# suppress verification warning
http.verify_mode = OpenSSL::SSL::VERIFY_NONE
req = Net::HTTP::Get.new('/nic/update?hostname=mysite.dyndns.org', headers)
# authentication details
req.basic_auth 'my_user_name','my_password'
resp = http.request(req)
# print out the response for the update
p resp.body
Izmjenjeno od Ernad Husremović prije više od 15 godina
Izmjenjeno od Ernad Husremović prije više od 15 godina
fritz!box vpn ?!¶
http://www.avm.de/de/Service/Service-Portale/VPN_en/VPN_Praxis_und_Tipps/box_zu_box.php?portal=VPNen
This example describes a classic LAN-LAN link between two FRITZ!Boxes. In this case one of the FRITZ!Boxes is logged on and accessible in the Internet under the DynDNS name "myside.dyndns.org"; the other FRITZ!Box under the DynDNS name "otherside.dyndns.org".
...
Izmjenjeno od Ernad Husremović prije više od 15 godina
fritz!vpn¶
ovo je opet nekakva windows aplikacija: ništa od toga
Basic Steps: VPN Connections with FRITZ!Box
With FRITZ!Box you can not only surf the Web and make phone calls, you can even connect physically separate networks and users securely and simply via the Internet. The following products can be used for this purpose:- FRITZ!Box Fon WLAN 7170
- FRITZ!Box Fon WLAN 7270
- "FRITZ!VPN": The free VPN software client for the Microsoft operating systems Windows Vista (32-bit) and XP (32-bit). The "FRITZ!VPN" program is available in the "Current Downloads" section on this Service Portal.
The configuration is created using the "Configure FRITZ!Box VPN Connection" administration software. See the Step-by-Step Guides for more instructions. The following section presents the basic and preparatory steps.
VPN Connection between Two Networks
Two physically separate networks can be connected via two FRITZ!Boxes. The following steps are necessary:
1. Adapt the IP Networks
The two devices you would like to connect via VPN must use different IP networks.
Neither of the devices participating in the connection may use the network preconfigured upon delivery, with the IP address 192.168.178.0 and the subnet mask 255.255.255.0.
The preset values can be changed in the user interface as follows:
When "Expert Mode" is enabled, click the "IP Address" button under "Settings / Advanced Settings / System / Network Settings".
2. Create Dynamic DNS Accounts
Create an account with a Dynamic DNS provider for each side of the connection. Free Dynamic DNS accounts are available on such web pages as www.dyndns.org or www.selfhost.de.
Note: A Dynamic DNS account must be set up for every device that is to be accessible via a VPN connection. Skip this step if the device has a fixed IP address in the Internet.
3. Enter the Dynamic DNS Accounts
Enter the Dynamic DNS accounts in the devices. To do this in the user interface:
On the "Dynamic DNS" page under "Settings / Advanced Settings / Internet / Permit Access" or "Remote Access".
4. Configure the VPN Connection Using the "Configure FRITZ!Box VPN Connection" Program
In this program select "New" and follow the steps as directed by the Wizard. A "fritzbox_‹name of the FRITZ!Box›.cfg" file is created for each side of the connection.
5. Import the Configuration in the FRITZ!Box
Import the corresponding file to each of the devices. To do this in the user interface:
Under "Settings / Advanced Settings / Internet / Permit Access" or "Remote Access / VPN".
Once the configuration was imported in both sides of the connection, the connection is established automatically upon request.
For detailed instructions on steps 4 and 5, see the Step-by-Step Guide on this Service Portal.
VPN Connection for One User
A remote user (perhaps field staff or an employee working from home) can use the "FRITZ!VPN" software client to connect with a FRITZ!Box in order to access the network. The following steps are necessary:
1. Create a Dynamic DNS Account
Create an account with a Dynamic DNS provider for the FRITZ!Box. Free Dynamic DNS accounts are available on such web pages as www.dyndns.org or www.selfhost.de. Skip this step if the device has a fixed IP address in the Internet.
Note: The user or the computer from which the connection is to be established does not require a Dynamic DNS account.
2. Enter the Dynamic DNS Account
Enter the Dynamic DNS account in the device. To do this in the user interface:
On the "Dynamic DNS" page under "Settings / Advanced Settings / Internet / Permit Access" or "Remote Access".
3. Configure the VPN Connection Using the "Configure FRITZ!Box VPN Connection" Program
In this program select "New" and follow the steps as directed by the Wizard. A "fritzbox_‹name of the FRITZ!Box›.cfg" file will be created for the FRITZ!Box; for the user a "vpnuser_‹name of the user›.cfg" file.
4. Import the Configuration in FRITZ!Box
Import each of the "fritzbox_‹name of the FRITZ!Box›.cfg" file. To do this in the user interface:
Under "Settings / Advanced Settings / Internet / Permit Access" or "Remote Access / VPN".
5. Import the Configuration in FRITZ!VPN
Import the "vpnuser_‹name of the user›.cfg" file in the "FRITZ!VPN" program installed on the computer from which the VPN connection is to be accessed. Do this by going to the "File" menu and selecting the "Import..." command. Afterward the connection appears in the overview and can be established or cleared at any time.
Izmjenjeno od Ernad Husremović prije više od 15 godina
- Naslov promijenjeno iz refresh_ip - my dyndns sistem u refresh_ip - my dyndns sistem, vpn on fritz!box
Izmjenjeno od Ernad Husremović prije više od 15 godina
fritz!box pseudo image ?!¶
ovo se već pominjalo ali ne kontam šta je to:
The best way to create a pseudo image of http://www.the-construct.com with openvpn and virtual-ip create. Dabei einfach irgendeine Key-Datei und eine server.ovpn angeben. It just any key-file and a server.ovpn specify.
Diese muss ausser im Falle eines Static-Keys sowieso per Hand nacheditiert werden. This must be, except in the case of static keys anyway nacheditiert by hand.
Es wird im folgenden auf eine Konfiguration mit pseudo-image eingegangen. It is in the following to a configuration with pseudo-image received. Aber im Prinzip sollte der Ansatz auch für jede andere Lösung gelten. But in principle, the approach should also apply to any other solution.
Izmjenjeno od Ernad Husremović prije više od 15 godina
evo na njemačkom integracija openvpn-a sa fritz!box-om http://www.ip-phone-forum.de/showthread.php?t=65863
tu se valjda pravi taj pseudo image
Izmjenjeno od Ernad Husremović prije više od 15 godina
evo šta mi nudi ovaj fritz!box pseudo-image construct:
Eigenes Image erstellen Bitte wählen Sie die Mods aus, die Sie auf Ihrer Fritz!Box einrichten wollen. Folgende Mods sind für Ihre Version der Fritz!Box verfügbar: Telnet aktivieren Enum im Webinterface freischalten (ändert das Branding auf AVM) Branding ändern Port 1011 öffnen SIP-Port ändern Callmessage WakeOnCall (benötigt Dropbear!) Audiocodec-Reihenfolge ändern OpenVPN Dropbear (SSH-Server) Virtuelle Netzwerkkarte einrichten eigenen Code am Anfang der 'debug.cfg' einfügen eigenen Code am Ende der 'debug.cfg' einfügen Mods, die auf Ihrer Box noch nicht getestet wurden, sind mit * gekennzeichnet.
Izmjenjeno od Ernad Husremović prije više od 15 godina
a google translate mi kaže
Create Your Own Image Please choose the mods you on your Fritz! Want to set up box. The following mods are for your version of the Fritz Box available: Enable Telnet Unlock Enum in the web interface (change the branding on AVM) Change branding Port 1011 open SIP port change Call Message WakeOnCall (requires Dropbear!) Audio Codec Order Change OpenVPN Dropbear (SSH server) Virtual Network Setup own code on top of the paste 'debug.cfg' own code at the end of the insert 'debug.cfg' Mods that have not been tested on your box, come with an asterisk.
aha to znači da možeš dignuti openvpn, ssh server, te možeš staviti pokretanje nekog proizvoljnog koda prilikom podizanja router-a (u tom debug.cfg-u)
Izmjenjeno od Ernad Husremović prije više od 15 godina
- Naslov promijenjeno iz refresh_ip - my dyndns sistem, vpn on fritz!box u refresh_ip - dyndns-like implementacija, vpn on fritz!box
povrat na dyndns¶
uredu kontam otprilike ali sad da se vratim na našu glavnu temu dyndns-like refresh-ip
Izmjenjeno od Ernad Husremović prije više od 15 godina
workflow¶
Komponente (application teers):
1. router side- obični dyndns klijent koji ne ide na dyndns nego na router-back server
- dobija request od router-a (dyndns protokol)
- stara se o tome da internet dns-ovi budu update-ovani
- "stara se" znači
- kada napravi update provjerava je li ok
- ako nije ponovo pokušava
- nakon određenog broja pokušaja (ili vremena) prijavljuje sysadminu problem
3. internet dns server side
Izmjenjeno od Ernad Husremović prije više od 15 godina
ako router-back dobije novi request, a stari nije završio, prekida stari request i obrađuje novi
kojim načinom refresh-ovati dns-ove ?
Stari način je bio ssh, ali to baš i nije dobra ideja.
Bolje je u lan-u, na router-back napraviti internet server koji će router-back server kontrolisati i koji će biti master server internet dns-ovima
Izmjenjeno od Ernad Husremović prije više od 15 godina
znači dns serveri bi bili
dns master (on LAN, najbolje da bude zajedno sa router-back serverom) koji refreshira slave dns-ove
da li to znači da ovaj lokalni dns server mora biti internet vidljiv ?
ne znam kako fukcioniše dns master-slave protokol, ovo treba provjeriti
ako treba biti vidljiv onda to pada u vodu, jer slave dns-serveri ga neće vidjeti
Izmjenjeno od Ernad Husremović prije više od 15 godina
openvpn na vpshosting:
http://forum.hostican.com/virtual-private-servers-VPS-f9/openvpn-on-linux-vps-hosting-t1936/
Izmjenjeno od Ernad Husremović prije više od 15 godina
treba mi vpn - openvpn¶
Na #18559 sam pokrenuo da podesim za openhosting vpn server tako da mu mogu pristupiti iz office-sa
time bi se uspostavila veza preko koje bi se mogao ažurirati dns server sa route-back officesa LAN dns serverom koji je (master dns)
Izmjenjeno od Ernad Husremović prije više od 15 godina
kako kontrolisati promjene router-back dns-a ?¶
koristiti chef ?
ionako treba uvesti neki configuration tool. mislim da chef i jeste baš za te poslove
Izmjenjeno od Ernad Husremović prije više od 15 godina
bjasko: hernad znaš li ti možda na ovom fritzu kako se podešava manuelno ns-ovi - 09:48 - hernad: hm hernad: prvo jesi ti otvorio pristup njegovoj konzoli ? hernad: da li to može po default-u biti ili se mora ono na telefonu enable-ovati kod svakog boot-a hernad: ovo je generalno rješenje http://redmine.bring.out.ba/issues/18557#note-9 hernad: ali nažalost to nikad nisam istestirao hernad: moj komentar 13: aha to znači da možeš dignuti openvpn, ssh server, te možeš staviti pokretanje nekog proizvoljnog koda prilikom podizanja router-a (u tom debug.cfg-u) bjasko: ??? neznam ali nisam našao, pokušao sam na konzoli u hosts dodati ip bhingco.ba smtp-a ali ni to ne fercera a pitanje je dali bi preživilo restart i da radi ja bih zbog peripetija hylafax stavio - 09:54 - hernad: ima li /tmp/etc/resolv.conf ili nešto takvo hernad: hm hernad: odmah da ti kažem da je potrebna ova kontrola uređaja da se može određeni host usmjeriti na našu adresu hernad: to će mi kod refresh_ip implementacije trebati hernad: naime sad kad si podesio adsl bjasko: hm neznam dali da diram resolv.conf da ne urokam internet pristup bjasko: zato sam i pokušao sa hosts tu nema se šta zeznuti hernad: echo "nameserver 192.168.45.250" > /etc/resolv.conf je rješenje hernad: to je obični linux hernad: jedino što on kod svakog refresh-a uzima hernad: novi resolv hernad: u pravu si da nama treba /etc/hosts hernad: tako da kod refresha nema promjena u dns resolviranju hernad: da se vratim na refresh_ip hernad: meni je potrebno da fritz hernad: kad dođe do promjene ip adrese hernad: uradi dyndns refresh hernad: ali ne prema vanjskom dyndns serveru hernad: nego prema željenom lan host-u hernad: i za to mi treba da hernad: members.dyndns.org ili kako već bjasko: tobro to možemo po IP adresi staviti tu imamo kontrolu hernad: bude lokalni IP - 09:59 - hernad: mislim da ne možeš to ovisi kako je kod fritza napravljen taj dyndns servis hernad: de mi to postiraj ovdje na ovaj ticket
Izmjenjeno od Ernad Husremović prije više od 15 godina
bjasko: hernad znaš li ti možda na ovom fritzu kako se podešava manuelno ns-ovi - 09:48 - hernad: hm hernad: prvo jesi ti otvorio pristup njegovoj konzoli ? hernad: da li to može po default-u biti ili se mora ono na telefonu enable-ovati kod svakog boot-a hernad: ovo je generalno rješenje http://redmine.bring.out.ba/issues/18557#note-9 hernad: ali nažalost to nikad nisam istestirao hernad: moj komentar 13: aha to znači da možeš dignuti openvpn, ssh server, te možeš staviti pokretanje nekog proizvoljnog koda prilikom podizanja router-a (u tom debug.cfg-u) bjasko: ??? neznam ali nisam našao, pokušao sam na konzoli u hosts dodati ip bhingco.ba smtp-a ali ni to ne fercera a pitanje je dali bi preživilo restart i da radi ja bih zbog peripetija hylafax stavio - 09:54 - hernad: ima li /tmp/etc/resolv.conf ili nešto takvo hernad: hm hernad: odmah da ti kažem da je potrebna ova kontrola uređaja da se može određeni host usmjeriti na našu adresu hernad: to će mi kod refresh_ip implementacije trebati hernad: naime sad kad si podesio adsl bjasko: hm neznam dali da diram resolv.conf da ne urokam internet pristup bjasko: zato sam i pokušao sa hosts tu nema se šta zeznuti hernad: echo "nameserver 192.168.45.250" > /etc/resolv.conf je rješenje hernad: to je obični linux hernad: jedino što on kod svakog refresh-a uzima hernad: novi resolv hernad: u pravu si da nama treba /etc/hosts hernad: tako da kod refresha nema promjena u dns resolviranju hernad: da se vratim na refresh_ip hernad: meni je potrebno da fritz hernad: kad dođe do promjene ip adrese hernad: uradi dyndns refresh hernad: ali ne prema vanjskom dyndns serveru hernad: nego prema željenom lan host-u hernad: i za to mi treba da hernad: members.dyndns.org ili kako već bjasko: tobro to možemo po IP adresi staviti tu imamo kontrolu hernad: bude lokalni IP - 09:59 - hernad: mislim da ne možeš to ovisi kako je kod fritza napravljen taj dyndns servis hernad: de mi to postiraj ovdje na ovaj ticket
Izmjenjeno od Jasmin Beganović prije više od 15 godina
na #18645 testirano
- cat /etc/hosts
127.0.0.1 localhost 192.168.58.2 mail.bhingco.ba
- ping mail.bhingco.ba
PING mail.bhingco.ba (192.168.58.2): 56 data bytes 64 bytes from 192.168.58.2: seq=0 ttl=64 time=0.425 ms 64 bytes from 192.168.58.2: seq=1 ttl=64 time=0.917 ms
Izmjenjeno od Jasmin Beganović prije više od 15 godina
terba vidjeti dali restart preživi
Izmjenjeno od Ernad Husremović prije više od 15 godina
Jasmin Beganović je napisao/la:
terba vidjeti dali restart preživi
mislim da ne preživi
Izmjenjeno od Ernad Husremović prije više od 15 godina
zato su ljudi napravili onaj pseudo-image gdje se može dodati debug (što je ustvari startup skripta) skripta
Izmjenjeno od Ernad Husremović prije više od 15 godina
a da li se može passwordless telnetom to uraditi
znači napraviti skriptu koja bi sa servera taj posao uradila po potrebi, telnet je character protokol sigurno je da može ... tako da ne diramo router
koji je router-ip ? je li telnet nakon restarta enable-ovan ?
Izmjenjeno od Jasmin Beganović prije više od 15 godina
Ernad Husremović je napisao/la:
a da li se može passwordless telnetom to uraditi
znači napraviti skriptu koja bi sa servera taj posao uradila po potrebi, telnet je character protokol sigurno je da može ... tako da ne diramo router
koji je router-ip ? je li telnet nakon restarta enable-ovan ?
telent je on pri startu, ip routera je 192.168.58.254
Izmjenjeno od Ernad Husremović prije više od 15 godina
nadam se da se telnetu ne može prići sa wan-a. provjeri
Izmjenjeno od Ernad Husremović prije više od 15 godina
znači napraviti skriptu koja bi sa servera taj posao uradila po potrebi, telnet je character protokol sigurno je da može ... tako da ne diramo router
pogledaj malo ima li takvih rješenja u bash-u ili python-u ili ruby-ju po internetu, al' nemoj gubiti bez potrebe vrijeme
Izmjenjeno od Ernad Husremović prije više od 15 godina
pošto ovaj /etc/hosts fercera, de na ovom ticketu evidentiraj podešenje dyndns-servisa, interesuje me koje opcije fritz nudi
Izmjenjeno od Ernad Husremović prije više od 15 godina
vezano za telnet pristup putem skripte:
Ne trebaš tražiti, ima to ruby u standardnom lib-u
http://www.ruby-doc.org/stdlib/libdoc/net/telnet/rdoc/index.html
Izmjenjeno od Jasmin Beganović prije više od 15 godina
Ernad Husremović je napisao/la:
nadam se da se telnetu ne može prići sa wan-a. provjeri
nemože
Izmjenjeno od Ernad Husremović prije više od 15 godina
- Odgovorna osoba promijenjeno iz Ernad Husremović u Jasmin Beganović
odradi ovaj dyndns jasko
Izmjenjeno od Jasmin Beganović prije više od 15 godina
nemam trenutno vezu sa bhingco lan-om
Izmjenjeno od Jasmin Beganović prije više od 15 godina
izgleda dok je telnet aktivan web interfej neradi evo sad je proferceralo
Izmjenjeno od Jasmin Beganović prije više od 15 godina
nsupdate is a computer network maintenance utility used by network administrators to request the name server of a DNS zone to update its database. The name server might be local to a domain or, with appropriate authentication and permission provided by DNSSEC, an internet name server. BIND 8 and later supports this feature.
nsupdate > server ns.mydns.com > update delete oldhost.example.com. A > update add newhost.example.com. 86400 A 192.168.254.117 > send
i ovo je sastavni dio BIND-a
Izmjenjeno od Jasmin Beganović prije više od 15 godina
a najvjerovatnije da ovaj fritz to ima jer dyndns se vrti na bind-u
Izmjenjeno od Jasmin Beganović prije više od 15 godina
fritz pored poznatih servisa ima i dyndns i custom servis, ovo bi se moralo moći prilagoditi bind-u
Izmjenjeno od Jasmin Beganović prije više od 15 godina
- Fajl fritz-dyndns.png fritz-dyndns.png dodano
- Fajl fritz-dyndns-userdefined.png fritz-dyndns-userdefined.png dodano
Izmjenjeno od Jasmin Beganović prije više od 15 godina
evo dyndns podešenja
i custom raspoloživih podešenja
Izmjenjeno od Jasmin Beganović prije više od 15 godina
ovo nebi trebao biti problem istestirati
Izmjenjeno od Jasmin Beganović prije više od 15 godina
opet sam izgubio konekciju ???, nešto prekida
Izmjenjeno od Jasmin Beganović prije više od 15 godina
zvao seida, haman da je server ubloko, nerade uopšte servisi ???, uputio ga da resetuje server na dugme
Izmjenjeno od Jasmin Beganović prije više od 15 godina
izgleda da se server zgemba u momentu kada se resetuje fritz, da nije neka zvrčka sa fbrcapi da ne ubloka server kada je remote capi nedostupan ??
Izmjenjeno od Jasmin Beganović prije više od 15 godina
Jasmin Beganović je napisao/la:
izgleda da se server zgemba u momentu kada se resetuje fritz, da nije neka zvrčka sa fbrcapi da ne ubloka server kada je remote capi nedostupan ??
za ovo sam otvorio #18663 pa ćemo tu vidjeti šta se dešava
Izmjenjeno od Jasmin Beganović prije više od 15 godina
- Fajl proba-dyndns.ba.png proba-dyndns.ba.png dodano
Izmjenjeno od Jasmin Beganović prije više od 15 godina
na ns lan bhingco.ba sa podigao apache i tu ću testirati custom dns
podešenja fritza
Izmjenjeno od Jasmin Beganović prije više od 15 godina
ali ga nevidim u /var/log/apache2/access.log na ns-u , mora de čeka promjenu IP
Izmjenjeno od Ernad Husremović prije više od 15 godina
jasko je napisao
nsupdate
super si ovo našao
Izmjenjeno od Ernad Husremović prije više od 15 godina
nsupdate¶
Introduced in BIND version 8 and refined in BIND version 9, the nsupdate utility provides the system administrator or casual user with a quick and painless method of updating a DNS zone, adding or deleting any type of DNS record the name server supports.
This article describes how to setup dynamic DNS, and provides some examples of use. For Fedora Core (and Red Hat) users, you will need to install both the bind (for dnssec-keygen) and bind-utils (for nsupdate) packages. If you plan to configure a DNS server, also read the companion article on configuring your server.
My home network is the same as millions of other Internet users: dynamic IP obtained from my ISP via DHCP. Wanting to make sure that I can connect to my home network remotely, even if the underlying dynamic IP changes, I looked around for a reliable (and hopefully free!) dynamic DNS service. I found dyndns.org, which I use today, and recently someone also pointed me to zoneedit.com.
Even though my DNS is automatically updated when it changes, via the highly versatile ddclient package, the traditional dynamic DNS update protocols (including dyndns.org's) are typically site-specific and non-standard. While googling around for a better solution, a friend on IRC pointing me to a utility that has been around since BIND 8: nsupdate.
nsupdate is a fantastic little utility that enable quick and secure DNS zone updates. Setup is quick and painless, and use is fairly intuitive for anyone remotely familiar with DNS, and skilled enough to admin their own Linux system.
...
Izmjenjeno od Ernad Husremović prije više od 15 godina
- ifconfig
adsl Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 UP POINTOPOINT RUNNING NOARP MULTICAST MTU:2000 Metric:1 RX packets:119879 errors:0 dropped:0 overruns:0 frame:0 TX packets:84983 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:32 RX bytes:133440821 (127.2 MiB) TX bytes:19982972 (19.0 MiB) cpmac0 Link encap:Ethernet HWaddr 00:1C:4A:13:99:10 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:119140 errors:0 dropped:0 overruns:0 frame:0 TX packets:158136 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:23231422 (22.1 MiB) TX bytes:147188326 (140.3 MiB) dsl Link encap:Point-to-Point Protocol inet addr:169.254.2.1 P-t-P:169.254.2.1 Mask:255.255.255.255 UP POINTOPOINT RUNNING NOARP ALLMULTI MULTICAST MTU:1500 Metric:1 RX packets:25853 errors:0 dropped:0 overruns:0 frame:0 TX packets:28931 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:4185352 (3.9 MiB) TX bytes:13019370 (12.4 MiB) eth0 Link encap:Ethernet HWaddr 00:1C:4A:13:99:10 UP BROADCAST RUNNING ALLMULTI MULTICAST MTU:1500 Metric:1 RX packets:119140 errors:0 dropped:0 overruns:0 frame:0 TX packets:69801 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:128 RX bytes:23231422 (22.1 MiB) TX bytes:20412956 (19.4 MiB) lan Link encap:Ethernet HWaddr 00:1C:4A:13:99:10 inet addr:192.168.58.254 Bcast:192.168.58.255 Mask:255.255.255.0 UP BROADCAST RUNNING ALLMULTI MULTICAST MTU:1500 Metric:1 RX packets:119122 errors:0 dropped:0 overruns:0 frame:0 TX packets:69803 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:21080159 (20.1 MiB) TX bytes:20133880 (19.2 MiB) lan:0 Link encap:Ethernet HWaddr 00:1C:4A:13:99:10 inet addr:169.254.1.1 Bcast:169.254.255.255 Mask:255.255.0.0 UP BROADCAST RUNNING ALLMULTI MULTICAST MTU:1500 Metric:1 lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:1646 errors:0 dropped:0 overruns:0 frame:0 TX packets:1646 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:128316 (125.3 KiB) TX bytes:128316 (125.3 KiB)
hah a gdje je ovdje public ip adresa ?!
Izmjenjeno od Ernad Husremović prije više od 15 godina
- traceroute www.google.ba
traceroute: warning: www.google.ba has multiple addresses; using 74.125.39.103 traceroute to www.l.google.com (74.125.39.103), 30 hops max, 38 byte packets 1 c10k-sa.pppoe1.sa.bih.net.ba (92.36.128.1) 14.838 ms 12.611 ms 6.117 ms 2 dlp-66.max2.sa-mlt.bih.net.ba (195.222.42.66) 11.934 ms 7.607 ms 7.896 ms 3 195.29.249.45 (195.29.249.45) 20.858 ms 15.384 ms 15.170 ms 4 194.25.209.85 (194.25.209.85) 37.979 ms 39.273 ms 37.360 ms 5 m-ec1-i.M.DE.NET.DTAG.DE (217.5.66.42) 37.301 ms 38.541 ms 38.326 ms 6 74.125.50.149 (74.125.50.149) 40.278 ms 40.180 ms 72.14.198.117 (72.14.198.117) 38.104 ms 7 66.249.94.86 (66.249.94.86) 39.200 ms 66.249.94.88 (66.249.94.88) 39.481 ms 66.249.94.86 (66.249.94.86) 39.790 ms
Izmjenjeno od Ernad Husremović prije više od 15 godina
openvn¶
odakle da iščupam adresu bhingco-a ?
iz openvpn-a !!! uopšte mi fritz ne treba
Oct 23 10:33:24 router-back ovpn-server[4180]: bhingco/92.36.194.116:60457 SENT CONTROL [bhingco]: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.191 10.8.0.1' (status=1) Oct 23 11:07:07 router-back ovpn-server[4180]: bhingco/92.36.194.116:59627 SENT CONTROL [bhingco]: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.191 10.8.0.1' (status=1) Oct 23 13:13:08 router-back ovpn-server[4180]: bhingco/92.36.206.254:57315 SENT CONTROL [bhingco]: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.191 10.8.0.1' (status=1) Oct 23 14:24:18 router-back ovpn-server[4180]: bhingco/92.36.206.254:52622 SENT CONTROL [bhingco]: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.191 10.8.0.1' (status=1) root@router-back:/etc/openvpn/clients# tail --lines=100000 /var/log/syslog | grep "SENT CONTROL \[bhingco\]"
root@router-back:/etc/openvpn/clients# ssh root@92.36.206.254
Linux bhingco-pedge-t100 2.6.24-24-openvz #1 SMP Wed Apr 15 17:40:08 UTC 2009 x86_64 The programs included with the Ubuntu system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law.
Izmjenjeno od Ernad Husremović prije više od 15 godina
"openvpn" refresh_ip workflow¶
- router-back: monitorišem openvpn server kada se desi nova konekcija "SENT CONTROL \[bhingco]\"
- router-back: uzimam ip adresu odatle ... bhingco/92.36.206.254 ...
- router-back -> lan-dns: radim nsupdate servera
- lan-dns => internet-dns-ovi: ovaj opet lančano update-uje naše internet DNS servere
u ovoj priči imamo rješenje za sve router-e na dunjaluku :)
Izmjenjeno od Ernad Husremović prije više od 15 godina
- Odgovorna osoba promijenjeno iz Jasmin Beganović u Ernad Husremović
openvpn nam nudi rješenje
http://openvpn.net/index.php/open-source/documentation/manuals/65-openvpn-20x-manpage.html
--ipchange cmd
Execute shell command cmd when our remote ip-address is initially authenticated or changes.
Execute as:
cmd ip_address port_number
Don't use --ipchange in --mode server mode. Use a --client-connect script instead.
See the "Environmental Variables" section below for additional parameters passed as environmental variables.
Note that cmd can be a shell command with multiple arguments, in which case all OpenVPN-generated arguments will be appended to cmd to build a command line which will be passed to the script.
If you are running in a dynamic IP address environment where the IP addresses of either peer could change without notice, you can use this script, for example, to edit the /etc/hosts file with the current address of the peer. The script will be run every time the remote peer changes its IP address.
Similarly if our IP address changes due to DHCP, we should configure our IP address change script (see man page for dhcpcd(8) ) to deliver a SIGHUP or SIGUSR1 signal to OpenVPN. OpenVPN will then reestablish a connection with its most recently authenticated peer on its new IP address.
Izmjenjeno od Ernad Husremović prije više od 15 godina
- Naslov promijenjeno iz refresh_ip - dyndns-like implementacija, vpn on fritz!box u refresh_ip - dyndns-like implementacija, vpn on fritz!box, openvpn
OpenVPN SCRIPTING AND ENVIRONMENTAL VARIABLES¶
OpenVPN exports a series of environmental variables for use by user-defined scripts.
Script Order of Execution¶
--up
Executed after TCP/UDP socket bind and TUN/TAP open.
--tls-verify
Executed when we have a still untrusted remote peer.
--ipchange
Executed after connection authentication, or remote IP address change.
--client-connect
Executed in --mode server mode immediately after client authentication.
--route-up
Executed after connection authentication, either immediately after, or some number of seconds after as defined by the --route-delay option.
--client-disconnect
Executed in --mode server mode on client instance shutdown.
--down
Executed after TCP/UDP and TUN/TAP close.
--learn-address
Executed in --mode server mode whenever an IPv4 address/route or MAC address is added to OpenVPN's internal routing table.
--auth-user-pass-verify
Executed in --mode server mode on new client connections, when the client is still untrusted.
String Types and Remapping¶
In certain cases, OpenVPN will perform remapping of characters in strings. Essentially, any characters outside the set of permitted characters for each string type will be converted to underbar ('_').
Q: Why is string remapping necessary?
A: It's an important security feature to prevent the malicious coding of strings from untrusted sources to be passed as parameters to scripts, saved in the environment, used as a common name, translated to a filename, etc.
Here is a brief rundown of OpenVPN's current string types and the permitted character class for each string:
X509 Names: Alphanumeric, underbar ('_'), dash ('-'), dot ('.'), at ('@'), colon (':'), slash ('/'), and equal ('='). Alphanumeric is defined as a character which will cause the C library isalnum() function to return true.
Common Names: Alphanumeric, underbar ('_'), dash ('-'), dot ('.'), and at ('@').
--auth-user-pass username: Same as Common Name, with one exception: starting with OpenVPN 2.0.1, the username is passed to the OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY plugin in its raw form, without string remapping.
--auth-user-pass password: Any "printable" character except CR or LF. Printable is defined to be a character which will cause the C library isprint() function to return true.
--client-config-dir filename as derived from common name or username: Alphanumeric, underbar ('_'), dash ('-'), and dot ('.') except for "." or ".." as standalone strings. As of 2.0.1-rc6, the at ('@') character has been added as well for compatibility with the common name character class.
Environmental variable names¶
For all cases, characters in a string which are not members of the legal character class for that string type will be remapped to underbar ('_').
Environmental Variables
Once set, a variable is persisted indefinitely until it is reset by a new value or a restart,
As of OpenVPN 2.0-beta12, in server mode, environmental variables set by OpenVPN are scoped according to the client objects they are associated with, so there should not be any issues with scripts having access to stale, previously set variables which refer to different client instances.
bytes_received
Total number of bytes received from client during VPN session. Set prior to execution of the --client-disconnect script.
bytes_sent
Total number of bytes sent to client during VPN session. Set prior to execution of the --client-disconnect script.
common_name
The X509 common name of an authenticated client. Set prior to execution of --client-connect, --client-disconnect, and --auth-user-pass-verify scripts.
config
Name of first --config file. Set on program initiation and reset on SIGHUP.
daemon
Set to "1" if the --daemon directive is specified, or "0" otherwise. Set on program initiation and reset on SIGHUP.
daemon_log_redirect
Set to "1" if the --log or --log-append directives are specified, or "0" otherwise. Set on program initiation and reset on SIGHUP.
dev
The actual name of the TUN/TAP device, including a unit number if it exists. Set prior to --up or --down script execution.
foreign_option_{n}
An option pushed via --push to a client which does not natively support it, such as --dhcp-option on a non-Windows system, will be recorded to this
environmental variable sequence prior to --up script execution.
ifconfig_broadcast
The broadcast address for the virtual ethernet segment which is derived from the --ifconfig option when --dev tap is used. Set prior to OpenVPN calling the ifconfig or netsh (windows version of ifconfig) commands which normally occurs prior to --up script execution.
ifconfig_local
The local VPN endpoint IP address specified in the --ifconfig option (first parameter). Set prior to OpenVPN calling the ifconfig or netsh (windows version of ifconfig) commands which normally occurs prior to --up script execution.
ifconfig_remote
The remote VPN endpoint IP address specified in the --ifconfig option (second parameter) when --dev tun is used. Set prior to OpenVPN calling the
ifconfig or netsh (windows version of ifconfig) commands which normally occurs prior to --up script execution.
ifconfig_netmask
The subnet mask of the virtual ethernet segment that is specified as the second parameter to --ifconfig when --dev tap is being used. Set prior to OpenVPN calling the ifconfig or netsh (windows version of ifconfig) commands which normally occurs prior to --up script execution.
ifconfig_pool_local_ip
The local virtual IP address for the TUN/TAP tunnel taken from an --ifconfig-push directive if specified, or otherwise from the ifconfig pool (controlled by the --ifconfig-pool config file directive). Only set for --dev tun tunnels. This option is set on the server prior to execution of the --client-connect and --client-disconnect scripts.
ifconfig_pool_netmask
The virtual IP netmask for the TUN/TAP tunnel taken from an --ifconfig-push directive if specified, or otherwise from the ifconfig pool (controlled by the --ifconfig-pool config file directive). Only set for --dev tap tunnels. This option is set on the server prior to execution of the --client-connect and --client-disconnect scripts.
ifconfig_pool_remote_ip
The remote virtual IP address for the TUN/TAP tunnel taken from an --ifconfig-push directive if specified, or otherwise from the ifconfig pool (controlled by the --ifconfig-pool config file directive). This option is set on the server prior to execution of the --client-connect and --client-disconnect scripts.
link_mtu
The maximum packet size (not including the IP header) of tunnel data in UDP tunnel transport mode. Set prior to --up or --down script execution.
local
The --local parameter. Set on program initiation and reset on SIGHUP.
local_port
The local port number, specified by --port or --lport. Set on program initiation and reset on SIGHUP.
password
The password provided by a connecting client. Set prior to --auth-user-pass-verify script execution only when the via-env modifier is specified, and deleted from the environment after the script returns.
proto
The --proto parameter. Set on program initiation and reset on SIGHUP.
remote_{n}
The --remote parameter. Set on program initiation and reset on SIGHUP.
remote_port_{n}
The remote port number, specified by --port or --rport. Set on program initiation and reset on SIGHUP.
route_net_gateway
The pre-existing default IP gateway in the system routing table. Set prior to --up script execution.
route_vpn_gateway
The default gateway used by --route options, as specified in either the --route-gateway option or the second parameter to --ifconfig when --dev tun is specified. Set prior to --up script execution.
route_{parm}_{n}
A set of variables which define each route to be added, and are set prior to --up script execution.
parm will be one of "network", "netmask", "gateway", or "metric".n is the OpenVPN route number, starting from 1.If the network or gateway are resolvable DNS names, their IP address translations will be recorded rather than their names as denoted on the command line or configuration file.script_context
Set to "init" or "restart" prior to up/down script execution. For more information, see documentation for --up.
script_type
One of up, down, ipchange, route-up, tls-verify, auth-user-pass-verify, client-connect, client-disconnect, or learn-address. Set prior to execution of any script.
signal
The reason for exit or restart. Can be one of sigusr1, sighup, sigterm, sigint, inactive (controlled by --inactive option), ping-exit (controlled by --ping-exit option), ping-restart (controlled by --ping-restart option), connection-reset (triggered on TCP connection reset), error, or unknown (unknown signal). This variable is set just prior to down script execution.
tls_id_{n}
A series of certificate fields from the remote peer, where n is the verification level. Only set for TLS connections. Set prior to execution of --tls-verify script.
tls_serial_{n}
The serial number of the certificate from the remote peer, where n is the verification level. Only set for TLS connections. Set prior to execution of --tls-verify script.
tun_mtu
The MTU of the TUN/TAP device. Set prior to --up or --down script execution.
trusted_ip
Actual IP address of connecting client or peer which has been authenticated. Set prior to execution of --ipchange, --client-connect, and --client-disconnect scripts.
trusted_port
Actual port number of connecting client or peer which has been authenticated. Set prior to execution of --ipchange, --client-connect, and --client-disconnect scripts.
untrusted_ip
Actual IP address of connecting client or peer which has not been authenticated yet. Sometimes used to nmap the connecting host in a --tls-verify script to ensure it is firewalled properly. Set prior to execution of --tls-verify and --auth-user-pass-verify scripts.
untrusted_port
Actual port number of connecting client or peer which has not been authenticated yet. Set prior to execution of --tls-verify and --auth-user-pass-verify scripts.
username
The username provided by a connecting client. Set prior to --auth-user-pass-verify script execution only when the via-env modifier is specified.
Izmjenjeno od Ernad Husremović prije više od 15 godina
ostaviću radi primjera ovo
root@router-back:/etc/openvpn/clients# cat bhingco
ifconfig-push 10.8.0.191 10.8.0.1 iroute 192.168.58.0 255.255.255.0 ipchangecmd /usr/local/sbin/refresh_ip_bhingco
fake refresh_ip komandu za bhingco
root@router-back:/etc/openvpn/clients# cat /usr/local/sbin/refresh_ip_bhingco
#!/bin/bash date > /tmp/bhingco_refreship echo $1 >> /tmp/bhingco_refreship
Izmjenjeno od Ernad Husremović prije više od 15 godina
pa ćemo vidjeti šta smo dobili kod sljedećeg refresh-a
Izmjenjeno od Ernad Husremović prije više od 15 godina
hm nije se desio refresh, ali izgleda nije bilo ni promjena ip-a !?
i dalje ovo radi
bringout@desk-c2:~$ ssh root@92.36.206.254
Izmjenjeno od Ernad Husremović prije više od 15 godina
jasko resetovao router ali je opet istu adresu dobio:
root@router-back:~/refresh_ip# tail /var/log/syslog --lines=1000 | grep bhingco
Oct 26 15:11:38 router-back ovpn-server[4180]: bhingco/92.36.206.254:42337 MULTI: Learn: 192.168.58.111 -> bhingco/92.36.206.254:42337 Oct 26 15:11:52 router-back ovpn-server[4180]: MULTI: Learn: 192.168.58.254 -> bhingco/92.36.206.254:42337
Izmjenjeno od Ernad Husremović prije skoro 15 godina
- Status promijenjeno iz Dodijeljeno u Zatvoreno