setup openvpn with routing (debian)

ref: https://nikinuryadin.wordpress.com/2010/04/16/step-by-step-setting-up-openvpn-in-debian-with-routing-tun-connection/

Configure openvpn using routing (tun) connection

Configuring the server

#vim /etc/openvpn/server.conf
(add the following lines)

port 443

proto udp

dev tun

ca /etc/openvpn/easy-rsa/keys/ca.crt

cert /etc/openvpn/easy-rsa/keys/vpnsarandi.crt

key /etc/openvpn/easy-rsa/keys/vpnsarandi.key

dh /etc/openvpn/easy-rsa/keys/dh1024.pem

ifconfig-pool-persist ipp.txt

server 10.1.0.0 255.255.255.0

client-config-dir ccd

route 192.168.1.0 255.255.255.0

route 192.168.2.0 255.255.255.0

client-to-client

push “route 192.168.1.0 255.255.255.0”

push “route 192.168.2.0 255.255.255.0”

keepalive 10 120

comp-lzo

persist-key

persist-tun

status /var/log/openvpn-status.log

verb 3

Making directory ccd:

#mkdir /etc/openvpn/ccd

Making  file client1 in ccd directory

#vim /etc/openvpn/ccd/clent1
(add the following lines)

iroute 192.168.1.0 255.255.255.0

Restart OpenVPN:

#/etc/init.d/openvpn restart

Setting up the windows client. First, download the OpenVPN client from here (at the time of writing, select 2.1 RC15). Install it, and create a file ‘client.conf’ in the config directory with the following parameters

client

dev tun

proto udp

remote x.x.x.x  443 # (replace with your server IP)

resolv-retry infinite

nobind

pkcs12 client1.p12 # (replace with the client name)

ns-cert-type server

comp-lzo

verb 3

#redirect-gateway

You can also add ‘redirect-gateway’ to the client configuration to pass all traffic down the VPN tunnel (rather than just traffic intended for the VPN itself).

copy the client1.p12 certificate file to the config directory on the client, start the gui, and connect.

If you need to create any clients in the future, do the following command:

#cd /etc/openvpn/easy-rsa
#source ./vars
#./build-key-pkcs12 clientx

Enable IP and TUN/TAP forwarding:

On  linux client

IP Forwarding

Check if IP Forwarding is enabled

#sysctl net.ipv4.ip_forward

net.ipv4.ip_forward = 0 

or

cat /proc/sys/net/ipv4/ip_forward

0 

As we can see in both the above examples this was disabled (as show by the value 0).

Enable IP Forwarding on the fly

#sysctl -w net.ipv4.ip_forward=1 

or

#echo 1 > /proc/sys/net/ipv4/ip_forward 

Permanent setting using /etc/sysctl.conf

#/etc/sysctl.conf:

net.ipv4.ip_forward = 1

#sysctl -p /etc/sysctl.conf

On RedHat based systems this is also enabled when restarting the network service:

#service network restart

and on Debian/Ubuntu systems this can be also done restarting the procps service:

#/etc/init.d/procps.sh restart 

Using distribution specific init scripts

Although the methods presented above should work just fine and you would not need any other method of doing this, I just wanted to note that there are also other methods to enable IP Forwarding specific to some Linux distributions.
For example Debian based distributions might use the setting:

#/etc/network/options:

ip_forward=no 

set it to yes and restart the network service.
Also RedHat distributions might set this using:

#/etc/sysconfig/network:

FORWARD_IPV4=true 

and again restart the network service.

Regardless the method you have used once you have completed this you can check it out using the same method shown above:

#sysctl net.ipv4.ip_forward

net.ipv4.ip_forward = 1 

#cat /proc/sys/net/ipv4/ip_forward

1 

If the result is 1 then the Linux system will start forwarding IP packets even if they are not destined to any of its own network interfaces.

TUN/TAP forwarding:

Allow TUN interface connections to OpenVPN server
# iptables -A INPUT -i tun+ -j ACCEPT
Allow TUN interface connections to be forwarded through other interfaces
# iptables -A FORWARD -i tun+ -j ACCEPT
Allow TAP interface connections to OpenVPN server
# iptables -A INPUT -i tap+ -j ACCEPT
Allow TAP interface connections to be forwarded through other interfaces
# iptables -A FORWARD -i tap+ -j ACCEPT

** rule iptables for  internet  sharing from eth1  to  eth0.

#iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

#iptables-save

Restart Networking and OpenVPN

#/etc/init.d/networking restart

#/etc/init.d/openvpn restart

SMTP Relay With 'STARTTLS'

ref: https://simon.heimlicher.com/articles/2010/08/29/smtp-smarthost

A smart host is simply the SMTP server of another party, often your ISP, that is preferable to your own for reasons such as reliability or credibility.

To set the port, append :, for example smtp.example.com:587.

You may need to authenticate to the smart host. This is also possible. However, your email may still not go through—and often it is because the smart host expects a STARTTLS command. This is true for GMail SMTP.

Check if you find 530 5.7.0 Must issue a STARTTLS command first. in /var/log/mail.log.

If this is the case, try to append these two lines to /etc/postfix/main.cf:

smtp_tls_security_level = may
smtp_sasl_security_options = noanonymous

Then issue postfix reload.

CSF blank page webmin mobile on centos 7 (fixed!)

ref: https://www.vultr.com/docs/setup-csf-on-centos-7

If you having problem running csf module on webmin please install dependencies:
* notes: i'm using Epel and rpmforge repos before running this installation. worked for me.

Install the CSF dependencies.

  yum -y install wget perl unzip net-tools perl-libwww-perl perl-LWP-Protocol-https perl-GDGraph

ipv6 unifi on centos using PPPoE (final)

ref: https://www.bidon.ca/en/node/634

This is working setting for IPv6 unifi.

I uses route announcements (RA) so that the home router configures the default route as well as a /64 prefix for auto-configuration. We don't need the /64, but it can be useful for the default route.

For PPP on a router, this is disabled by default.

To enable the default route from route advertisements:

# sysctl -w net.ipv6.conf.ppp0.accept_ra=2

To auto-configure an IP address to ppp0:

# sysctl -w net.ipv6.conf.ppp0.autoconf=1

After a few seconds, "ifconfig ppp0" should show a global IPv6 address, and "ip -6 route" will show a default route. You should also be able to "ping6 google.com" or he.net from your router.

IMPORTANT: to make sysctl configurations permanent, you can try to add them to /etc/sysctl.conf, or to /etc/ppp/ipv6-up.d/my-network (script executed when the ppp connection is enabled).

Configuring the /56 prefix with DHCPv6-PD

A /64 network prefix is recommend for a single network. However, most IPv6 home topologies need more than one network. For example, the wireless access point (AP) should use its own network (bye bye network bridging), the wired network another network, another for home servers, appliances, etc.

Install the 'WIDE DHCPv6 client':

# apt-get install wide-dhcpv6-client

The Debian configuration wizard may ask for which interface to listen on: ppp0.

Sample configuration in /etc/wide-dhcpv6/dhcp6c.conf :

# c.f. http://www.ipcalypse.ca/?p=204
interface ppp0 {
  # Identity Association for Prefix Delegation
  send ia-pd 1;

  # Identity Association for Non-temporary Addresses
  send ia-na 1;

  # request domain-name-servers;
  # request domain-name;
  # script "/etc/wide-dhcpv6/dhcp6c-script";
};

id-assoc pd 1 {
  prefix-interface eth1 {
    # Assign subnet 1 to eth1
    sla-id 1;

    # IP address "postfix". if not set it will use EUI-64 address of the interface.
    # Combined with SLA-ID'd prefix to create full IP address of interface.
    ifid 1;

    # Prefix bits assigned.
    # Take the prefix size you're assigned (/48 or /56) and subtract it from 64.
    # In my case I was being assigned a /56, so 64-56=8
    sla-len 8;
  };
};

id-assoc na 1 {
};

Test from the command line:

# dhcp6c -fD -c /etc/wide-dhcpv6/dhcp6c.conf ppp0

Configure radvd for auto-configuration on the networks

Each network with clients (desktops/workstations/laptops) will need radvd so that the clients can auto-configure themselves.

Install radvd:

# apt-get install radvd

Example configuration for a subnet, in /etc/radvd.conf :

interface eth1
{
  AdvSendAdvert on;
  MaxRtrAdvInterval 30;

  prefix ::/64
  {
    AdvOnLink on;
    AdvAutonomous on;
    AdvRouterAddr off;
    AdvValidLifetime 300;
    AdvPreferredLifetime 120;
  };
};

Then restart radvd:

# services radvd restart

Enable ipv6 on centos PPPoE unifi

ref: http://wandin.net/dotclear/index.php?post/2011/02/10/Native-IPv6-with-Internode-and-CentOS

Note: you will need new BTU from unifi technician that support ipv6. old btu does not support ipv6 at my place.

remember to put ipv6[space],

# vi /etc/ppp/options 
lock
ipv6 ,

May  5 15:24:46 backup pppd[15296]: PAP authentication succeeded
May  5 15:24:46 backup pppd[15296]: local  LL address fe80::78e0:xxxx:xxxx:xxxx
May  5 15:24:46 backup pppd[15296]: remote LL address fe80::2a6e::xxxx:xxxx:xxx
May  5 15:24:46 backup pppd[15296]: local  IP address 175.143.xx.xx
May  5 15:24:46 backup pppd[15296]: remote IP address 175.143.xx.xx