I have a computer that I use as a file server. It is correctly configured (finally!) to connect to KeepSolid VPN servers at boot, via an OpenVPN systemd service. At first, I could only connect by issuing an openvpn --daemon command, as I was having trouble making the VPN client connect at boot. I resolved that by looking at another thread and learned I had not properly configured the service. But now I have that all taken care of. Now I am just missing full access from a remote client.
THINGS I CAN DO:
- connect via internal IP while on LAN (e.g. ssh email@example.com)
- connect via FQDN while on LAN (e.g. ssh user@XXXX.zapto.org, my free DDNS service)
- connect via either of those while away from LAN if I first shutdown OpenVPN service (e.g. systemctl stop openvpn@keepsolid)
THINGS I want TO DO BUT CANNOT:
- connect via FQDN while away from LAN
In case it wasn't already clear, I really am not an expert on networking. I tried some suggestions that were marked as "ANSWERED" on similar posts with my problem, including opening external connections for SSH by using sudo ufw allow ssh, as suggested here. I get this now
sudo ufw status Status: active To Action From -- ------ ---- 22/tcp ALLOW Anywhere 22/tcp (v6) ALLOW Anywhere (v6)
I even tried to fiddle with the IP tables and routing tables, following the instructions here. Although I didn't understand the spells I was casting, I didn't see any errors in the output from the commands, and doing these steps did not seem to stop me from being able to access the machine locally. I can at least say that there were no pre-existing ip rules dealing with netfilter masks.
Thanks in advance! Also, I've read enough forums and help pages to know that it may be helpful to see certain outputs. Below are the ones that seem relevant. I love tinkering with my machine and learning more about how it works. Thank you to anyone helping me overcome this latest hurdle.
Here is the output of ifconfig
enp0s25: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet 10.0.0.5 netmask 255.255.255.0 broadcast 10.0.0.255 inet6 fe80::21d:9ff:fe95:5343 prefixlen 64 scopeid 0x20<link> ether 00:1d:09:95:53:43 txqueuelen 1000 (Ethernet) RX packets 3701 bytes 1113971 (1.1 MB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 5440 bytes 2390198 (2.3 MB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 device interrupt 20 memory 0xfdfc0000-fdfe0000 lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536 inet 127.0.0.1 netmask 255.0.0.0 inet6 ::1 prefixlen 128 scopeid 0x10<host> loop txqueuelen 1000 (Local Loopback) RX packets 1341 bytes 391348 (391.3 KB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 1341 bytes 391348 (391.3 KB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST> mtu 1500 inet 10.200.0.70 netmask 255.255.255.255 destination 10.200.0.69 inet6 fe80::16c9:9b04:376d:3412 prefixlen 64 scopeid 0x20<link> unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 100 (UNSPEC) RX packets 2562 bytes 606632 (606.6 KB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 3647 bytes 1979619 (1.9 MB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
This is the output of systemd service
systemctl status firstname.lastname@example.org ● email@example.com - OpenVPN connection to keepsolid.ovpn Loaded: loaded (/lib/systemd/system/openvpn@.service; indirect; vendor preset: enabled) Active: active (running) since Tue 2019-11-05 21:43:11 EST; 12min ago Docs: man:openvpn(8) https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage https://community.openvpn.net/openvpn/wiki/HOWTO Main PID: 1616 (openvpn) Status: "Initialization Sequence Completed" Tasks: 1 (limit: 4915) CGroup: /firstname.lastname@example.org └─1616 /usr/sbin/openvpn --daemon ovpn-keepsolid.ovpn --status /run/openvpn/keepsolid.ov Nov 05 21:43:07 inspiron530 systemd: Starting OpenVPN connection to keepsolid.ovpn... Nov 05 21:43:11 inspiron530 ovpn-keepsolid.ovpn: UDP link local: (not bound) Nov 05 21:43:11 inspiron530 ovpn-keepsolid.ovpn: UDP link remote: [AF_INET]22.214.171.124:11 Nov 05 21:43:12 inspiron530 ovpn-keepsolid.ovpn: [openvpn2.vpnunlimitedapp.com] Peer Connecti Nov 05 21:43:11 inspiron530 systemd: Started OpenVPN connection to keepsolid.ovpn. Nov 05 21:43:19 inspiron530 ovpn-keepsolid.ovpn: TUN/TAP device tun0 opened Nov 05 21:43:19 inspiron530 ovpn-keepsolid.ovpn: do_ifconfig, tt->did_ifconfig_ipv6_setup=0 Nov 05 21:43:19 inspiron530 ovpn-keepsolid.ovpn: /sbin/ip link set dev tun0 up mtu 1500 Nov 05 21:43:19 inspiron530 ovpn-keepsolid.ovpn: /sbin/ip addr add dev tun0 local 10.200.0.70 Nov 05 21:43:19 inspiron530 ovpn-keepsolid.ovpn: Initialization Sequence Completed
This is my attempt at adding an ASCII representation of how my machines connect to the Internet
Machine 1------- |----- Router ---- Cable Modem ----- WORLD Machine 2-------
Both machines are connected via Ethernet. Machine 1 is my server, and I have configured it to connect to a KeepSolid VPN server. when that configuration is active, I can no longer connect to Machine 1 via Machine 2.
This question is specifically about SSH connections, but upon further inspection, I also cannot ....
- login to a Webmin GUI via port 10000
- connect to a deluge-webui via port 8112
- directly connect to a plex server on port 32400
For what it's worth, I could do all of those things (except SSH) when I was connecting to VPN by issuing an
openvpn --config --daemon command. The problem seems to have gotten worse after I created the OpenVPN systemd service. In both cases - daemon or service - the VPN connects to the correct server and my new public IP is changed to the one I expect it to. So I think that I have somehow erred in setting up the systemd service