September 3, 201312 yr Looks like a few people have asked and there's not really a good way to do it but I'll ask anyway. I want to keep my subsonic server from being behind the vpn which is located at localhost:4040. Is there anyway from keeping it's traffic routed through the vpn connection? Ya, I have essentially the same question. Wanting to exclude the plex port. Anyone? Thanks, Steve Btw: plugin works great with privateinternetaccess. Thanks! +1 to exclude the Plex Port, and any other ports desired for that matter. There's gotta be a way. ;-) With OpenVPN Client activated, unRAID webgui, plex and other services are not accessible remotely. I use a separate OpenVPN Server (smoothwall) to access my local lan from remote locations to administer other PC's, and can not access unRAID (tower) at all. I actually have to VNC to another PC on the local lan to turn on/off OpenVPN Client on unRAID. Hopefully a permanent solution to exclude ports will be possible. Thank you. Also using Private Internet Access with no issues other than what is already mentioned above.
September 3, 201312 yr Author +1 to exclude the Plex Port, and any other ports desired for that matter. There's gotta be a way. ;-) using iptables, then we might easily fix this, without I have now idea right now. //Peter
September 5, 201312 yr +1 to exclude the Plex Port, and any other ports desired for that matter. There's gotta be a way. ;-) With OpenVPN Client activated, unRAID webgui, plex and other services are not accessible remotely. I use a separate OpenVPN Server (smoothwall) to access my local lan from remote locations to administer other PC's, and can not access unRAID (tower) at all. I actually have to VNC to another PC on the local lan to turn on/off OpenVPN Client on unRAID. Hopefully a permanent solution to exclude ports will be possible. Thank you. Also using Private Internet Access with no issues other than what is already mentioned above. I have a similar problem, I too access my local network from the exterior with a vpn server running on my router. However, once I establish the vpn connection on the unraid box, I cannot access any services running on the box. I guess cause the routing table changes once connected. I thought adding a static route on the unraid box would work, ie /sbin/route add -net 10.9.0.0 netmask 255.255.255.0 gw 192.168.1.1 eth0 Assuming your local network is 192.168.1.0 and the VPN subnet on the router's vpn server config is 10.9.0.0. Another question I have is concerning Plex and connecting via the VPN, I always get a message saying that I cannot access the Plex server from VPN, is there anything I need to configure in Plex to be able to connect from the exterior via the VPN? Keep in mind, I do not have Plex running on my unRAID box, but rather on a ubuntu VM.
September 6, 201312 yr I'm at a loss right now trying to directly access unRAID Main Menu (and other ported services) and Plex Media Server while the unRAID OpenVPN client is active. I guess one solution would be to setup a Plex Server on a separate PC to avoid this issue and just administer unRAID via another PC on the network (VNC), but this is not a practical solution for everyone.
September 6, 201312 yr I don't know if it's just me, but you recent updated plg contains a syntax error: 388 if [ $tmpinterface = "yes" }; then EDIT: A similar syntax error here: 389 /sbin/ifconfig $dev_tun | grep 'inet addr:' | cut -d: -f2 | awk '{ print $1}f [ $tmpinterface = "yes" }; then'
September 7, 201312 yr It's not starting for me at boot time from the zip on the OP, I started from scratch and removed all folder related to the plugin. Then I went to update plg via the gui and I get the following error: Options error: Unrecognized option or missing parameter(s) in [CMD-LINE]:1: config (2.3.2) Use --help for more information. Plugin / Build Local Version Online Version OpenVPN Plugin Version 2.7.19 2.7.19 OpenVPN Software Build OpenVPN 2.3.2 2.3.2 EDIT: nevermind I seem to have worked it out I am getting the same error, can you give me any tips?
September 7, 201312 yr +1 to exclude the Plex Port, and any other ports desired for that matter. There's gotta be a way. ;-) With OpenVPN Client activated, unRAID webgui, plex and other services are not accessible remotely. I use a separate OpenVPN Server (smoothwall) to access my local lan from remote locations to administer other PC's, and can not access unRAID (tower) at all. I actually have to VNC to another PC on the local lan to turn on/off OpenVPN Client on unRAID. Hopefully a permanent solution to exclude ports will be possible. Thank you. Also using Private Internet Access with no issues other than what is already mentioned above. I have a similar problem, I too access my local network from the exterior with a vpn server running on my router. However, once I establish the vpn connection on the unraid box, I cannot access any services running on the box. I guess cause the routing table changes once connected. I thought adding a static route on the unraid box would work, ie /sbin/route add -net 10.9.0.0 netmask 255.255.255.0 gw 192.168.1.1 eth0 Assuming your local network is 192.168.1.0 and the VPN subnet on the router's vpn server config is 10.9.0.0. Another question I have is concerning Plex and connecting via the VPN, I always get a message saying that I cannot access the Plex server from VPN, is there anything I need to configure in Plex to be able to connect from the exterior via the VPN? Keep in mind, I do not have Plex running on my unRAID box, but rather on a ubuntu VM. Did this work: /sbin/route add -net 10.9.0.0 netmask 255.255.255.0 gw 192.168.1.1 eth0 ? I'm assuming no, because you said "I thought". For those of you that have mentioned using OpenVPN on the "edge" router, does that have the ability to exclude certain ports? I need to be able to remote in to certain ports like Plex, Teamviewer, whatever.
September 7, 201312 yr Did this work: /sbin/route add -net 10.9.0.0 netmask 255.255.255.0 gw 192.168.1.1 eth0 ? I'm assuming no, because you said "I thought". For those of you that have mentioned using OpenVPN on the "edge" router, does that have the ability to exclude certain ports? I need to be able to remote in to certain ports like Plex, Teamviewer, whatever. Yes, assuming you change those IPs for yours, it will work. It does for me, I am able to access unRAID remotely on the 10.9.0.0 subnet. Keep in mind, in addition to the VPN client running on unraid, I have a VPN server running on the router which I connect to. It's a static route so, it dies after every reboot, not sure how to make it persistent but adding this in your .ovpn file should to it every time you bring up the vpn connection: up /boot/openvpn/add_route.sh where add_route.sh has the route command. What I'm not sure about is whether that's the correct route to add, I believe so but am no networking expert. I don't have a problem with accessing unRAID within my LAN just remotely, I'd like a better way as opposed to setting a static route, perhaps something at the router level, dunno
September 7, 201312 yr Did this work: /sbin/route add -net 10.9.0.0 netmask 255.255.255.0 gw 192.168.1.1 eth0 ? I'm assuming no, because you said "I thought". For those of you that have mentioned using OpenVPN on the "edge" router, does that have the ability to exclude certain ports? I need to be able to remote in to certain ports like Plex, Teamviewer, whatever. Yes, assuming you change those IPs for yours, it will work. It does for me, I am able to access unRAID remotely on the 10.9.0.0 subnet. It's a static route so, it dies after every reboot, not sure how to make it persistent but adding this in your .ovpn file should to it every time you bring up the vpn connection: up /boot/openvpn/add_route.sh where add_route.sh has the route command. What I'm not sure about is whether that's the correct route to add, I believe so but am no networking expert. I don't have a problem with accessing unRAID within my LAN just remotely, I'd like a better way as opposed to setting a static route, perhaps something at the router level, dunno Very new to OpenVPN. Only signed up this morning... (Private Internet Access) How do I get the value to replace 10.9.0.0 with? I understand the other bits (I think!)
September 9, 201312 yr Do you also have a VPN server running on your external IP as well? No. I use OpenVPN to connect to 'Private Internet Access'. But would still like to be able to connect to services running externally (e.g. transmission on http://mystaticip:8082)
September 9, 201312 yr Then the "10.9.0.0" subnet I was talking about may not apply to you, that would be the VPN subnet of your VPN server and since you're not running one, I believe if you would be simply a matter port forwarding to your service via your firewall. If you still cannot access your unRAID box remotely you may need to alter your VPN client config. The directive: route-nopull may need to be put your client config which I believe prevents the openvpn-client from pulling server routes, however I never used it.
September 9, 201312 yr Then the "10.9.0.0" subnet I was talking about may not apply to you, that would be the VPN subnet of your VPN server and since you're not running one, I believe if you would be simply a matter port forwarding to your service via your firewall. If you still cannot access your unRAID box remotely you may need to alter your VPN client config. The directive: route-nopull may need to be put your client config which I believe prevents the openvpn-client from pulling server routes, however I never used it. OpenVPN client output: Mon Sep 9 10:02:25 2013 OpenVPN 2.3.2 i486-slackware-linux-gnu [sSL (OpenSSL)] [LZO] [EPOLL] [eurephia] [MH] [iPv6] built on Jun 22 2013 Mon Sep 9 10:02:25 2013 WARNING: file '/boot/config/plugins/openvpn/password.txt' is group or others accessible Mon Sep 9 10:02:26 2013 UDPv4 link local: [undef] Mon Sep 9 10:02:26 2013 UDPv4 link remote: [AF_INET]myipaddress:1194 Mon Sep 9 10:02:26 2013 [server] Peer Connection Initiated with [AF_INET]myipaddress:1194 Mon Sep 9 10:02:28 2013 Options error: option 'redirect-gateway' cannot be used in this context ([PUSH-OPTIONS]) Mon Sep 9 10:02:28 2013 Options error: option 'dhcp-option' cannot be used in this context ([PUSH-OPTIONS]) Mon Sep 9 10:02:28 2013 Options error: option 'dhcp-option' cannot be used in this context ([PUSH-OPTIONS]) Mon Sep 9 10:02:28 2013 Options error: option 'route' cannot be used in this context ([PUSH-OPTIONS]) Mon Sep 9 10:02:28 2013 TUN/TAP device tun5 opened Mon Sep 9 10:02:28 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0 Mon Sep 9 10:02:28 2013 /usr/sbin/ip link set dev tun5 up mtu 1500 Mon Sep 9 10:02:28 2013 /usr/sbin/ip addr add dev tun5 local 10.141.1.6 peer 10.141.1.5 Mon Sep 9 10:02:28 2013 Initialization Sequence Completed Despite the options error it seems as though Plex and the unRAID webGui services are accessible remotely, albeit from my iphone via 3G. Seems like a good solution so far. We eventually test from remote location. Thank you very much for this solution. It is greatly appreciated.
September 9, 201312 yr Then the "10.9.0.0" subnet I was talking about may not apply to you, that would be the VPN subnet of your VPN server and since you're not running one, I believe if you would be simply a matter port forwarding to your service via your firewall. If you still cannot access your unRAID box remotely you may need to alter your VPN client config. The directive: route-nopull may need to be put your client config which I believe prevents the openvpn-client from pulling server routes, however I never used it. OpenVPN client output: Mon Sep 9 10:02:25 2013 OpenVPN 2.3.2 i486-slackware-linux-gnu [sSL (OpenSSL)] [LZO] [EPOLL] [eurephia] [MH] [iPv6] built on Jun 22 2013 Mon Sep 9 10:02:25 2013 WARNING: file '/boot/config/plugins/openvpn/password.txt' is group or others accessible Mon Sep 9 10:02:26 2013 UDPv4 link local: [undef] Mon Sep 9 10:02:26 2013 UDPv4 link remote: [AF_INET]myipaddress:1194 Mon Sep 9 10:02:26 2013 [server] Peer Connection Initiated with [AF_INET]myipaddress:1194 Mon Sep 9 10:02:28 2013 Options error: option 'redirect-gateway' cannot be used in this context ([PUSH-OPTIONS]) Mon Sep 9 10:02:28 2013 Options error: option 'dhcp-option' cannot be used in this context ([PUSH-OPTIONS]) Mon Sep 9 10:02:28 2013 Options error: option 'dhcp-option' cannot be used in this context ([PUSH-OPTIONS]) Mon Sep 9 10:02:28 2013 Options error: option 'route' cannot be used in this context ([PUSH-OPTIONS]) Mon Sep 9 10:02:28 2013 TUN/TAP device tun5 opened Mon Sep 9 10:02:28 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0 Mon Sep 9 10:02:28 2013 /usr/sbin/ip link set dev tun5 up mtu 1500 Mon Sep 9 10:02:28 2013 /usr/sbin/ip addr add dev tun5 local 10.141.1.6 peer 10.141.1.5 Mon Sep 9 10:02:28 2013 Initialization Sequence Completed Despite the options error it seems as though Plex and the unRAID webGui services are accessible remotely, albeit from my iphone via 3G. Seems like a good solution so far. We eventually test from remote location. Thank you very much for this solution. It is greatly appreciated. I am getting the same error. But seems to be working. Thanks
September 9, 201312 yr I don't think the last solution is working. Just noticed that the OpenVPN Clients' WAN IP is that same as my ISP's WAN IP assigned to my internet router (Big NO-NO). When I remove or comment out route-nopull then the VPN provider's IP address shows as the WAN IP. Should have realized this when I removed the ip address from the log before posting.
September 9, 201312 yr I don't think the last solution is working. Just noticed that the OpenVPN Clients' WAN IP is that same as my ISP's WAN IP assigned to my internet router (Big NO-NO). When I remove or comment out route-nopull then the VPN provider's IP address shows as the WAN IP. Should have realized this when I removed the ip address from the log before posting. Thanks for pointing that out - I probably would never have noticed! But exactly the same for me.
September 9, 201312 yr Basically when I started testing this route-nopull solution I checked my smoothwall f/w and noticed the f/w logs showed an IP Address range belonging to Newshosting that should not be there, btw, and after further investigation I found that the wrong WAN IP was allocated to OpenVPN Client. Always a good reason to check why an error shows up in the logs. Looking at different possibilities... ex: http://serverfault.com/questions/122188/openvpn-make-redirect-gateway-optional I am wondering however if this can be a direct issue with OpenVPN Client itself? Time will tell.
September 11, 201312 yr A quick update concerning the inability to remotely access unRAID webGui (for administrative purposes) while OpenVPN Client is active. The solution I linked in my last post doesn't seem to apply AFAIK, but I got to thinking that perhaps I can use Putty by setting up SSH Tunnels (ex: adding source ports and destination ip address + ports) to at least be able to administer unRAID and other installed services. This approached worked just fine but the remaining issue for the moment is that Plex Media Server is still inaccessible to remote Plex clients. A work in progress....
September 11, 201312 yr trying this option by adding to the .ovpn config file: --------------------------------------------------------- client dev tun5 proto udp remote us-california.privateinternetaccess.com 1194 route no-pull route XX.XX.115.64 255.255.255.192 vpn_gateway resolv-retry infinite nobind persist-key persist-remote-ip persist-tun ca ca.crt tls-client remote-cert-tls server comp-lzo verb 1 reneg-sec 0 auth-user-pass /boot/config/plugins/openvpn/password.txt auth-nocache status /tmp/openvpn/openvpn-status.log --------------------------------------------------------- With the following result in OpenVPN Client webGui output: --------------------------------------------------------- Wed Sep 11 09:59:47 2013 OpenVPN 2.3.2 i486-slackware-linux-gnu [sSL (OpenSSL)] [LZO] [EPOLL] [eurephia] [MH] [iPv6] built on Jun 22 2013 Wed Sep 11 09:59:47 2013 WARNING: file '/boot/config/plugins/openvpn/password.txt' is group or others accessible Wed Sep 11 09:59:47 2013 UDPv4 link local: [undef] Wed Sep 11 09:59:47 2013 UDPv4 link remote: [AF_INET]XX.XX.115.104:1194 Wed Sep 11 09:59:47 2013 [server] Peer Connection Initiated with [AF_INET]XX.XX.115.104:1194 Wed Sep 11 09:59:50 2013 RESOLVE: Cannot resolve host address: no-pull: Name or service not known Wed Sep 11 09:59:50 2013 OpenVPN ROUTE: failed to parse/resolve route for host/network: no-pull Wed Sep 11 09:59:50 2013 TUN/TAP device tun5 opened Wed Sep 11 09:59:50 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0 Wed Sep 11 09:59:50 2013 /usr/sbin/ip link set dev tun5 up mtu 1500 Wed Sep 11 09:59:50 2013 /usr/sbin/ip addr add dev tun5 local 10.140.201.6 peer 10.140.201.5 Wed Sep 11 09:59:50 2013 Initialization Sequence Completed -------------------------------------------------------- then tried this in the .ovpn config file: -------------------------------------------------------- client dev tun5 proto udp remote us-california.privateinternetaccess.com 1194 route no-pull #route XX.XX.115.64 255.255.255.192 vpn_gateway push "route XX.XX.115.64 255.255.255.192" resolv-retry infinite nobind persist-key persist-remote-ip persist-tun ca ca.crt tls-client remote-cert-tls server comp-lzo verb 1 reneg-sec 0 auth-user-pass /boot/config/plugins/openvpn/password.txt auth-nocache status /tmp/openvpn/openvpn-status.log --------------------------------------------------------- With the following result in OpenVPN Client webGui output: --------------------------------------------------------- Wed Sep 11 10:07:34 2013 OpenVPN 2.3.2 i486-slackware-linux-gnu [sSL (OpenSSL)] [LZO] [EPOLL] [eurephia] [MH] [iPv6] built on Jun 22 2013 Wed Sep 11 10:07:34 2013 WARNING: file '/boot/config/plugins/openvpn/password.txt' is group or others accessible Wed Sep 11 10:07:34 2013 UDPv4 link local: [undef] Wed Sep 11 10:07:34 2013 UDPv4 link remote: [AF_INET]XX.XX.113.201:1194 Wed Sep 11 10:07:34 2013 [server] Peer Connection Initiated with [AF_INET]XX.XX.113.201:1194 Wed Sep 11 10:07:37 2013 RESOLVE: Cannot resolve host address: no-pull: Name or service not known Wed Sep 11 10:07:37 2013 OpenVPN ROUTE: failed to parse/resolve route for host/network: no-pull Wed Sep 11 10:07:37 2013 TUN/TAP device --------------------------------------------------------- In both tests the WAN IP addressed assigned was in fact that of the VPN Service Provider and not that of the ISP. However still not able to access unRAID services remotely... obviously.
September 11, 201312 yr how do I direct just bittorrent traffic over my VPN??? Can I not just white list the address 10.0.0.0/8 with this address being any IP address signed by my VPN (they are normal 10.X.X.X)? And then bind transmission to the exact address 10.1.1.99 my VPN gives me? Would this not work???
September 12, 201312 yr +1 to exclude the Plex Port, and any other ports desired for that matter. There's gotta be a way. ;-) using iptables, then we might easily fix this, without I have now idea right now. //Peter With iptables I'm trying this but not quite working yet: ---------------------------------- The steps for a split access # echo 200 novpn >> /etc/iproute2/rt_tables # ip route add 192.168.200.0/24 dev eth0 src 192.168.200.100 table novpn # ip route add default via 192.168.200.254 table novpn # ip route add 192.168.200.0/24 dev eth0 src 192.168.200.100 # ip rule add from 192.168.200.100 table novpn where "192.168.200.0/24" is your LAN, "192.168.200.100" is your RPI's IP address and "192.168.200.254" is your gateway The following will show your newly created routing table # ip route list table novpn ---------------------------------------------- found above here: https://www.privateinternetaccess.com/forum/index.php?p=/discussion/1147/a-simple-raspberry-pi-setup-split-access#Item_1
September 12, 201312 yr www.mullvad.com is a VPN that allows multiple port forwarding, so using them my problem would be gone. I could then open a route back for transmission, Couchpotate, sickbeard and the trasmission GUI. Think I will drop privateinternetaccess VPN as its rubbish and it is taking to much of my time trying to figure out a way to route via the non-VPN'ed network.
September 12, 201312 yr You mean: mullvad.net In my opinion AFAIK having issues with splitting the VPN connection is not the VPN provider's (privateinternetaccess.com) fault but rather a function of OpenVPN Client/Server.
Archived
This topic is now archived and is closed to further replies.