IP tunnel Puns

Hi beautiful people!

I‘m still new in the game of deeper network. Watched tons of videos how to set up etc. Generally it‘s running, rewards coming in as expected.

What I am wondering about is that the IP is still mine for the website I set a tunnel for. It’s Netflix. Just wanted to check, if there are different series or new episodes of my favourite series. So I set up a tunnel for Netflix.com through United States (I’m in Europe). If I am connected to my wifi and visit Netflix.com, it still shows my location and it still knows that I’m in Europe.

What did I do wrong?

I also did a test with setting a tunnel for myipaddress.com to see if it works, but also there is my local IP shown and not the one I put the tunnel.

Would be cool, if you have some advice! :)

Hello Guys,

I was having a problem that users could not connect to the SSL VPN tunnel via Forticlient, they were getting error -30 "could not get an IP Address" and after looking at the SSL VPN Monitor i see that a user gets many IP Addresses.

Is there a way to fix this as I've searched and didnt find anything.

https://preview.redd.it/sd3xi5kwdjy71.png?width=1267&format=png&auto=webp&s=8784d90e3b604cf678e250ea1ffcde6314c0bbee

Any help is appreciated.

Thanks

As the title suggest, there's a device out there trying to establish a VPN tunnel. No policy exists for that IP/tunnel so logs show a VPN Warning IKE Responder : VPN Policy for gateway address not found every 30 seconds. I assumed that creating a Deny rule with the originating IP as the source and all services denied would block everything from that IP, but log keeps showing the IKE responder messages with the inevitable Payload processing failed message. Is there a way to block everything, including attempted VPN tunnels from a WAN IP?

Hi everyone,

I've site A with Wireguard server (172.16.x.x) & IPBX, and B site (192.168.x.x) with Wireguard client & IP phone with DHCP auto-configuration.

Both Wireguard machines are Debian 10.

Is there any way to IP phone to recover via DHCP its configuration & IP from IPBX ? No matter it's on 172.16 range or 192.168 range.

Many thanks for your help.

PS newbie trying to set up a VPN that has a script I need to run to create the installer. It keeps hanging up on a section that has a zip cmdlet that obviously does not exist. Any help would be appreciated.

https://techdocs.f5.com/en-us/edge-client-7-1-7/big-ip-access-policy-manager-edge-client-and-application-configuration-7-1-7/big-ip-edge-client-for-windows.html#unique_1722185343

C:\temp([Parameter(Mandatory=$true)][string] $client_iso)

$MountResult = Mount-DiskImage -ImagePath $client_iso -PassThru $mountdrive = ($MountResult | Get-Volume).DriveLetter

$tempDirectoryBase = [System.IO.Path]::GetTempPath(); Do { $newTempDirPath = [String]::Empty; [string] $name = [System.Guid]::NewGuid(); $newTempDirPath = (Join-Path $tempDirectoryBase $name); } While (Test-Path $newTempDirPath);

New-Item -ItemType Directory -Path $newTempDirPath;

$setupConfig = @" <?xml version="1.0" encoding="UTF-8"?> <CLIENT_CONFIGURATOR> <SETUP_CONFIGURATION> <PRODUCTNAME>BIG-IP Edge Client (TM) package</PRODUCTNAME> <DATABASE>f5fpclients.msi</DATABASE> <MINIMUM_MSI>150</MINIMUM_MSI> <PROPERTIES>STARTAPPWITHWINDOWS=1</PROPERTIES> <OPERATION>INSTALLUPD</OPERATION> </SETUP_CONFIGURATION> <FEATURES> <FEATURE>MachineTunnelService</FEATURE> <FEATURE>PortRedirector</FEATURE> </FEATURES> <STONEWALL_EXCLUSIONS> </STONEWALL_EXCLUSIONS> </CLIENT_CONFIGURATOR> "@

$setupConfig | Add-Content (-join ($newTempDirPath, "_setup_configuration_.f5c")); Copy-Item -Path (-join ($mountdrive, ":\sam\www\webtop\public\download\f5fpclients.msi")) -Destination (-join ($newTempDirPath, "\f5fpclients.msi")); $F5_VPNPath = (Join-Path $newTempDirPath "F5 VPN"); $amd64Path = (Join-Path $F5_VPNPath "amd64"); $F5_TMPPath = (Join-Path $F5_VPNPath "F5_TMP");

New-Item -ItemType Directory -Path $F5_VPNPath; New-Item -ItemType Directory -Path $amd64Path; New-Item -ItemType Directory -Path $F5_TMPPath;

Copy-Item -Path (-join ($mountdrive, ":\sam\www\webtop\public\download\F5MachineTunnelService.exe")) -Destination (-join ($F5_VPNPath, "\F5MachineTunnelService.exe")); Copy-Item -Path (-join ($mountdrive, ":\sam\www\webtop\public\download\scew_uls.dll")) -Destination (-join ($F5_VPNPath, "\scew_uls.dll")); Copy-Item -Path (-join ($mountdrive, ":\sam\www\webtop\public\download\F5MachineTunnelInfo.exe")) -Destination (-join ($F5_VPNPath, "\F5MachineTunnelInfo

Hi everybody,

Thanks in advance for reading! I'm sure this problem is quite simple & common for experienced folks - but I tried Googling for no avail.

Context-

I have a DB that I don't want open to the internet. I want it to be accessible for:

• resources in the same VPC
• devs connected to VPN (that's connected to the VPC)
• whitelisted IPs (e.g tasks running in CI SaaS)

Since I want the DB to be accessible to the SaaS, I gave it a public IP and a security group that only allows inbound requests form the VPC and the SaaS IPs. This works great.

My problem-

Since the DB has a public IP, the VPN split-tunnel does not recognize that it's in the VPC and does not tunnel the traffic, blocking my devs.

Please advise about the right network configuration to solve this issue!

Thanks

EDIT: Solved. Look at my comment on this thread

So we have a server that external customers access over site-to-site tunnels with is true IP.

A new customer wants to establish a tunnel with us but wants us to NAT the server IP as it goes out to something specific for them. Is it possible on a Cisco ASA to NAT an IP for only one specific tunnel and not others?

My pushback was for them to NAT our IP on their side as it comes in (not sure what device they have yet, waiting for that info)

I've set up WireGuard on a Raspberry Pi. When I activate the tunnel on either my Mac or iPhone, I am able to access the Raspberry Pi's IP, but nothing else on the network (not my router for example). Is there a configuration step I missed? What am I doing wrong?

Update

I figured out why it wasn't working. I had a bridge interface set up on my raspberry which I need for a smart home software I'm running on the pi. The interface is configured in /etc/network/interfaces as follows:

auto lo
iface lo inet loopback

iface eth0 inet manual

auto br0
iface br0 inet static
bridge_ports eth0
address <>
netmask <>
gateway <>
dns-nameservers <>

I had selected br0 as my interface when setting up Wireguard (using pivpn). But that way I was only able to connect to the Pi's IP via the VPN.

When removing the bridge interface and changing the interface to eth0 in the pivpn install, everything works. But I need this bridge interface for my smart home software to work. Is there a way to make the VPN work with the bridge interface?

Hello, anyone have any idea on how to implement HA / floating IP on wireguard? Typical stuff like VRRP won't work because it's l3 and VRRP requires L2.

I have an RPI running wireguard (WG). My son has WG address 10.x.x.6 and his traffic is received at 10.x.x.1, a WG server on the RPI. The RPI has 192.x.x.64 and the internet router has 192.x.x.253.

He uses a windows laptop so the WG keys/configuration are stored in the clear AFAIK. He doesn't need to be on my home network. He just uses WG as a VPN, occasionally. I am concerned one day somebody will copy the WG configuration ...

How do I make sure any traffic coming from 10.x.x.6 at the RPI/WG server is denied access to the 192.x.x.y domain or routed out of the intranet (by default)? (please correct any of my terminology above, if needed ...)

I have a DIY/home server running various services, some of them accessible via reverse proxy (Nginx;linuxserver's SWAG docker container). My own network is behind a carrier NAT through which I cannot port forward. To circumvent this, I have a VPS with a static IP, and I have a reverse SSH tunnel running from my home server (some ports forwarded to SWAG conatiner) to the VPS (port 80/443) and have pointed my domain to this static IP.

This works, but I can't resolve the original IP's, as all traffic is recognized by the SWAG container as coming from an IP like 127.28.0.3. For instance, I am running a PLEX server that recognizes any outside connection as coming from this IP. I am using the X-Forwarded-For header in the nginx conf.

I believe the 'issue' to be that the SSH tunnel works in such a way that the SWAG container just recognizes any request as coming from the host machine; I'd like to solve this. My question is three-fold:

- Is this indeed (most likely) the issue that's 'causing' this? (I realize that this is a slightly ill-posed question)

- If so, can I solve this by running another nginx instance at the VPS and route all incoming traffic on 443 and 80 to some other port on the VPS while using the `X-Forwarder-For` header, and subsequently reverse SSH tunnel from the home server to those ports on the VPS?

- If again affirmative, I'd love a little help with the `.conf` file for this setup. Is the following app.conf`adequate to reroute all traffic and doing nothing but just adding the header? (I am a beginner with reverse proxies, so excuse me if this is baloney)

upstream https_port {
    server 127.0.0.1:HTTPS_PORT
}

upstream http_port {
    server 127.0.0.1:HTTP_PORT
}


# Route all HTTP traffic
server {
    listen 80;
    server_name *.my_domain.tld
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header Host $host;
    
    location / {
    proxy_pass http://http_port
    }

# Route all HTTPS traffic
server {
    listen 443 ssl;
    server_name *.my_domain.tld
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header Host $host;
    
    location / {
    proxy_pass http://https_port
    }

Many thanks in advance.

## Footnote

I realize t

Got a bit of a challenge today that I can't seem to find a solution to.

A potential client uses ranges like 192.168.0.0/22 and 10.0.0.0/8 on their location subnets.

I've set up a POC Fortigate SSL VPN with Forticlient with split tunneling, but they're unable to access local resources like printers and whatnot because hey guess what, most of the world's SOHO routers defaults to handing out local addresses in one of those ranges.

The kicker is that they're currently on an old Cisco ASA/AnyConnect-solution that apparently is able to solve this with a "Allow local LAN access"-setting that somehow allows access to local resources in spite of conflicting addresses. I have no idea how that works, but somehow it does. Allegedly.

What are my options here? HOSTS files? A million non-persistent routes added on connect and removed on disconnect that hopefully catch all use cases? Is there some trick in Fortiland that performs the same voodoo as Cisco's "Allow local LAN access"?

Any help appreciated.

I have a windows PC with SoftEther VPN. I also have a VPS. How exactly would I turn the VPS in to a VPN so all the windows traffic is tunneled through it? This would result in my Windows PC having the IP address of the VPS.

Note: I currently "rent" a dedicated IP from a third party service and use SoftEther to tunnel all the traffic through it. However I would like to learn to do this myself and have control over everything.

Hi,

I am trying to setup and ip tunnel for 6o4 tunnelling and I am having a bit of a issue with some logic. The tunnel broker (HE) lists that using an ip tunnel is the way I should talk to them but the issue I am unsure of is if I can create an ip tunnel interface with a dynamically allocated wan IP (as my ISP doesn't give neither static ip4 nor anything ipv6).

So I was trying to do something like this (but without luck):

[edit]
user@gw# show interfaces ip-0/0/0
unit 0 {
    tunnel {
        source dhcp-allocated-ip;
        destination detination-ip;
    }
    family inet6 {
        address some-ipv6-address/64;
    }
}

[edit]
user@gw# show interfaces ge-0/0/0
description ISP;
unit 0 {
    family inet {
        dhcp {
            retransmission-attempt 6;
            retransmission-interval 10;
        }
    }
}

I think this might not be possible as I would think for this to work I probably need the source to be an static IP (?)

Any insights would be appreciated.

Thanks

I upgraded to 2.5.1 from 2.5 last night and noticed that IPSec tunnel wasn't showing any traffic, looking at logs I see an odd issue where outbound IP is not using default WAN IP, it's instead sending out on virtual IP and handshake fails because other end of the tunnel is expecting main WAN IP.

13[NET] <con100000|1660> sending packet: from x.x.x.203[500] to z.z.z.154[500] (108 bytes)

x.x.x.203 is one of my virtual IPs, it is NOT selected in IPSec as interface for this tunnel. I can select any of the virtual IPs and its working fine on all of them if I change the other end of the tunnel to look for selected address, but default WAN just wont take. Has anyone else seen this after latest upgrade?

We use Verizon's GRE Tunnel service for VPN & are getting a new public static IP this week on our side of the connection. Does anyone know the process to have Verizon update/change the new IP in their system?

I've been trying to get in contact with our Account Rep. for over a week with no luck. Hopefully someone here has experience with this. Of course I have no documentation or anything from the past to work with.

Hello all! I cannot for the life of me figure out what terms to search, or find anything that explains this easily. Maybe I've overlooked something or haven't understood something correctly.

I currently have 2 VPN servers set up. One in AWS, and one on my home network. I use the AWS one for general browsing, as it has a much faster connection to the internet than my home network. The home VPN is to connect to some internal services behind my firewall.

Here's what I'd like to do: (PHOTO)

1. Connect ONLY to AWS.
2. Set up a tunnel between my home VPN and the AWS VPN (always connected).
3. Route ALL internet traffic only through the AWS VPN.
4. Route ONLY INTERNAL IP's (10.x.x.x) through the tunnel to my HOME VPN.

I use strongswan IKEv2 with key/user/pass authentication. I'd ideally like to stick with it if possible, but can switch if this proves to be easier using a different base.

Hello,

I setup successfully a GRE tunnel between a Mikrotik (remote) and a Fortigate (local). The Fortigate is however sitting on a dynamic IP internet provider.

The config looks like this:

config system gre-tunnel
edit "gre-to-sed"
set interface "internet"
set remote-gw 11.22.11.22
set local-gw 22.33.22.33
next
end

Is there a way to get the local-gw to be a "dns-name" or to grab the outfacing IP address? In the Mikrotik that's not an issue as it accepted well the dns-name

Would folks be interested in a service, specifically for home labbers, that provided you with an IPv4 and IPv6 subnet routed to your home network over an encrypted tunnel?

You'd be able to use a router as the tunnel endpoint and assign public static IPs to your servers and devices that you want accessible on the Internet.

If there is interest I may look into offering this as a service. I see a need for it with ISPs moving away from static IPs and moving toward CGNAT, while others haven't touched IPv6 yet.

We have (multiple times) tried to follow the instructions here: https://www.sonicwall.com/support/knowledge-base/how-can-i-access-remote-sites-over-ssl-vpn-with-tunnel-all-mode-disabled/170505816275584/

However, what happens is not only can we not get to the specific site that is IP locked via the Apache virtual host settings, we can't get to a damn thing on the box via the VPN. Is there more to it than what is listed in the instructions?

How to use wireguard to restrict access to a corporate application hosted in AWS and behind a application load balancer, but with split tunnel for regular browsing?

Application load balancer does not have a static IP or elastic IP so we can not simply use allowed IPs to connect from a wireguard server.

I have a windows PC with SoftEther VPN. I also have a VPS. How exactly would I turn the VPS in to a VPN so all the windows traffic is tunneled through it? This would result in my Windows PC having the IP address of the VPS.

Note: I currently "rent" a dedicated IP from a third party service and use SoftEther to tunnel all the traffic through it. However I would like to learn to do this myself and have control over everything.