[Openvpn-users] firewalling TUN iface - how?

2021-05-02 Thread lejeczek via Openvpn-users
Hi guys. Not being an expert I expected that, on a Linux box, I can firewall 'tun0' of ovpn server. Using 'firewalld' it put 'tun0' into a dedicated zone and selected a few ports for access but it turns out that clients see all ports as accessible. Is that default & expected behaviour? If ye

Re: [Openvpn-users] firewalling TUN iface - how?

2021-05-02 Thread Gert Doering
Hi, On Sun, May 02, 2021 at 03:02:37PM +0100, lejeczek via Openvpn-users wrote: > Not being an expert I expected that, on a Linux box, I can > firewall 'tun0' of ovpn server. > Using 'firewalld' it put 'tun0' into a dedicated zone and > selected a few ports for access but it turns out that > cl

[Openvpn-users] Adding RSA-PSS support in pkcs11-helper

2021-05-02 Thread Selva Nair
Hi, Currently RSA-PSS signatures are handled in pkcs11-helper by asking the token to do raw RSA signature of data already padded by OpenSSL. Many new hardware tokens refuse to support this mode and require the padding to be done in hardware. For a recent user report see this thread: https://www.m

Re: [Openvpn-users] firewalling TUN iface - how?

2021-05-02 Thread Kenneth Porter
--On Sunday, May 02, 2021 8:17 PM +0200 Gert Doering wrote: I have no idea what firewalld is, but generally speaking, for the OS kernel, "tun0" is "just a normal input/output interface". So you can apply iptables, pf, ... rules on it. firewalld is a wrapper around iptables or nft that defin