Comments on: openvpn and a Windows client http://www.top-web-solutions.com/openvpn-and-a-windown-client.html cPanel Control Panel, Fantastico Autoinstaller, Apache Web server, Gentoo Linux Wed, 21 Sep 2011 08:59:49 +0000 hourly 1 http://wordpress.org/?v=3.2.1 By: Stan http://www.top-web-solutions.com/openvpn-and-a-windown-client.html/comment-page-1#comment-233 Stan Sat, 08 Dec 2007 11:33:28 +0000 http://top-web-solutions.com/openvpn-and-a-windown-client/#comment-233 Actually, the Samba should be used for copy-ing the certificates only. Let's say you have a folder /home/docs/, which you use with your samba. Copy the client.key, client.crt and ca.crt files this directory: cp /etc/openvpn/vpn-name-nere/ca.crt /home/docs/ then do not forget to chmod it: chmod 777 /home/docs/ca.crt Do this for all 3 files. Then open your file server from your Windows computer with windows Explorer: \\samba-hostname\docs and copy the files to the appropriate Windows folder. As for the interface addresses -- yes, I have created a new private network just to keep my ifconfig tidy :) The 192.168.0.0 network is on your physical adapters (eth0 or 1), while the VPN creates a new virtual device, which has the 10.8.0.0 address. When your Windows machine connects to your VPN, both will be in a virtual network with 10.8.0.0 range. As I said, this is just to keep my ifconfig tidy and easy to read. You can use any private subnet here (like 172.0.0.0 for example). Both configurations do not interfere in any way. Actually, the Samba should be used for copy-ing the certificates only. Let’s say you have a folder /home/docs/, which you use with your samba. Copy the client.key, client.crt and ca.crt files this directory:

cp /etc/openvpn/vpn-name-nere/ca.crt /home/docs/

then do not forget to chmod it:

chmod 777 /home/docs/ca.crt

Do this for all 3 files.

Then open your file server from your Windows computer with windows Explorer:

\\samba-hostname\docs

and copy the files to the appropriate Windows folder.

As for the interface addresses — yes, I have created a new private network just to keep my ifconfig tidy :) The 192.168.0.0 network is on your physical adapters (eth0 or 1), while the VPN creates a new virtual device, which has the 10.8.0.0 address. When your Windows machine connects to your VPN, both will be in a virtual network with 10.8.0.0 range. As I said, this is just to keep my ifconfig tidy and easy to read. You can use any private subnet here (like 172.0.0.0 for example). Both configurations do not interfere in any way.

]]> By: Carl-Erik http://www.top-web-solutions.com/openvpn-and-a-windown-client.html/comment-page-1#comment-232 Carl-Erik Sat, 08 Dec 2007 10:22:25 +0000 http://top-web-solutions.com/openvpn-and-a-windown-client/#comment-232 There isn't actually anything in the samba guide concerning vpn certificates, so I have no idea what to do with them. Mayby you should add an addendum to the SAMBA guide, or make a new SMB guide - this time with VPN certificates. You should also take some time explaining the server directive. Does the vpn users now get addresses in the 10.0... range, or is there another way to specify this? In the other guide you use the 192.168.* local range, so this guide is not consistent with the other. If I understand correctly (that VPN users get private class A (10.0....) addresses), then you should state that the smb.conf also should reflect this and also allow users on the tun0 interface as well as the 10.0... range. There isn’t actually anything in the samba guide concerning vpn certificates, so I have no idea what to do with them. Mayby you should add an addendum to the SAMBA guide, or make a new SMB guide – this time with VPN certificates.

You should also take some time explaining the server directive. Does the vpn users now get addresses in the 10.0… range, or is there another way to specify this? In the other guide you use the 192.168.* local range, so this guide is not consistent with the other. If I understand correctly (that VPN users get private class A (10.0….) addresses), then you should state that the smb.conf also should reflect this and also allow users on the tun0 interface as well as the 10.0… range.

]]>