Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    [SOLVED] How to use VIP's for OpenVPN

    Scheduled Pinned Locked Moved OpenVPN
    16 Posts 5 Posters 1.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • RicoR
      Rico LAYER 8 Rebel Alliance
      last edited by

      ...in combination with tls-crypt ?

      -Rico

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by johnpoz

        tls-crypt is set when you set tls to both encryption and auth.0_1540905729309_tlscrypt.png

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 0
        • RicoR
          Rico LAYER 8 Rebel Alliance
          last edited by

          Yes I know, my posting was before I saw you edited yours.

          -Rico

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by

            ah... makes more sense now ;)

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            1 Reply Last reply Reply Quote 0
            • JKnottJ
              JKnott @Glacier
              last edited by

              @glacier said in How to use VIP's for OpenVPN:

              We have a department in china and the chineese ISP's regularly block ip's with VPN traffic. So we need to cycle the ip addresses otherwise our employees can't connect to the HQ via openvpn.

              Do they block by IP or protocol? It seems to me protocol would be more likely.

              PfSense running on Qotom mini PC
              i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
              UniFi AC-Lite access point

              I haven't lost my mind. It's around here...somewhere...

              1 Reply Last reply Reply Quote 0
              • RicoR
                Rico LAYER 8 Rebel Alliance
                last edited by

                They are blocking/ban by null routing IPs as well. ☠

                -Rico

                1 Reply Last reply Reply Quote 0
                • G
                  Glacier
                  last edited by

                  @rico said in How to use VIP's for OpenVPN:

                  They are blocking/ban by null routing IPs as well.

                  Exactly. We migth be able to hide it better, however eventually the ip will get blocked, which is why we would like to use VIP's to cycle through the bans.

                  1 Reply Last reply Reply Quote 0
                  • RicoR
                    Rico LAYER 8 Rebel Alliance
                    last edited by Rico

                    Well you don't have unlimited VIPs to cycle them over and over again right? So in the long run it would be better to hide the VPN traffic. I think with the 443 Port Share trick and tls-crypt it could work to get around this.
                    Anyway, I will try to answer your question. :-) Bind your OpenVPN to localhost, then use a Port Forward with your VIP to localhost.

                    -Rico

                    1 Reply Last reply Reply Quote 1
                    • PippinP
                      Pippin
                      last edited by

                      Port share won't hide the traffic and tls-crypt maybe for a while, eventually they will find out how to identify it.
                      stunnel is what I would do...

                      I gloomily came to the ironic conclusion that if you take a highly intelligent person and give them the best possible, elite education, then you will most likely wind up with an academic who is completely impervious to reality.
                      Halton Arp

                      1 Reply Last reply Reply Quote 1
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator
                        last edited by

                        I don't see how the share thing would hide anything - other than if you have normal https traffic going to that dest IP from the IP in china.. That might confuse them seeing normal web and vpn going to the same IP? All depends on how exactly they identify it as vpn traffic.

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        1 Reply Last reply Reply Quote 1
                        • G
                          Glacier
                          last edited by

                          Thanks alot for all of the answers.
                          I'll try out the portforwarding thing, aswell as tls-crypt and stunnel.

                          @rico said in How to use VIP's for OpenVPN:

                          Well you don't have unlimited VIPs to cycle them over and over again right?

                          No, but in the past the banned ip's have been unbanned after a month or so.

                          Best Regards
                          Esben

                          1 Reply Last reply Reply Quote 1
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.