Re: ipsec or iked to deploy under openbsd carp fws

2013-12-05 Thread Anders Berggren
>> Searching in google and reading some docs, I have several doubts >> about which one to choose. If I am not wrong, iked doesn't supports >> sasyncd, is it correct?? > > I am *much* happier with my use of isakmpd since I got rid of sasyncd > and just rely on dead peer detection (DPD), I use ifsta

Re: creating a VPN tunnel with an iPhone client

2013-12-03 Thread Anders Berggren
> I'm looking for a way to connect an iPhone to the local subnet for VOIP usage > through VPN. > Has anyone succeeded in creating a VPN tunnel from an iPhone to OpenBSD? Yes. npppd's L2TP http://www.openbsd.org/cgi-bin/man.cgi?query=npppd, or OpenVPN is what I have used.

Re: Hyper-V and OpenBSD

2013-07-31 Thread Anders Berggren
> This is running the latest version with all the current patches. However, each > time when I create a VM instance; the network doesn't work or work properly. > If I use the default NIC, it doesn't work at all; but the legacy NIC is > recognized as de0. However, it gets stuck after fetching the fi

Re: IPSec VPNs when traffic originates from a daemon on the OBSD firewall

2013-07-04 Thread Anders Berggren
> I'd rather not have to create extra tunnels or define VPN policies with > subnets which have prefixes wider than the internal LANs. > That leaves mangling, but I cannot see how I would do the mangling in PF to > make it work without doing a redirect through the loopback etc.. Just > wondering

Re: IPSec VPNs when traffic originates from a daemon on the OBSD firewall

2013-07-04 Thread Anders Berggren
>>> Perhaps you've created flows from our LAN network range only? If so, for a >>> ping to work, you need to specify the local IP, like >>> ping -I 192.168.1.1 192.168.2.1 >> how to change the source address for the 'netcat' command payload? > According to http://www.openbsd.org/cgi-bin/man.cgi?qu

Re: IPSec VPNs when traffic originates from a daemon on the OBSD firewall

2013-07-04 Thread Anders Berggren
>> Perhaps you've created flows from our LAN network range only? If so, for a >> ping to work, you need to specify the local IP, like >> ping -I 192.168.1.1 192.168.2.1 > how to change the source address for the 'netcat' command payload? According to http://www.openbsd.org/cgi-bin/man.cgi?query=n

Re: IPSec VPNs when traffic originates from a daemon on the OBSD firewall

2013-07-04 Thread Anders Berggren
> When I try to do a ping or otherwise on the remote firewalls to the head > office lan, I get a 'no route to host' error which implies that the IPSec vpn > policy route which can be seen in the 'route show' is not being used as the > source IP of the ping/payload is not going to have the firewa

Re: Hyper-V drivers?

2013-05-26 Thread Anders Berggren
>> At the risk of sounding like an idiot, did you do anything particular in >> the OpenBSD configuration to make Hyper-V's Legacy Network Adapter work? >> I can't seem to make it do so--OpenBSD picks it up as de0, and I've >> configured /etc/hostname.de0 appropriately. The same Hyper-V setup >> wo

Re: radius client /NAS server for OpenBSD

2013-05-10 Thread Anders Berggren
>> I am looking for a RADIUS client/NAS server that can >> glean accounting info like packets/bytes transferred, time >> connected and even kick users who exceed a threshold. >> I know that freeradius is in ports but I don't see any Radius client/NAS >> port. > What's the intended use, PPPoE/L2TP

Re: openbsd router performance (i know.. again)

2012-09-27 Thread Anders Berggren
On Sep 26, 2012, at 10:05 PM, rik wrote: > I haven't had yet the opportunity to upgrade it to -current, I'll do in the > next few days. Perhaps this one will make a difference: http://marc.info/?l=openbsd-cvs&m=134436237406664

Re: correct netmask on carp interfaces

2011-12-19 Thread Anders Berggren
On Nov 24, 2011, at 8:40 PM, Henning Brauer wrote: > * Russell Garrison [2011-11-22 18:28]: >> I have set up my system accordingly and my advice is to set your carp >> primary IP to the proper network mask (especially if it is using the >> carp IP to provide a gateway to the connected network) and