ok, this should be all you need.
you'll need to tweak openvpn.conf to point to the ssl certificates (wherever you end up putting them) and then simply run 'openvpn --config /path/to/openvpn.conf'
you should be 10.42.3.2 and my end will be 10.42.3.1
-brian
On 8/8/2012 12:27 PM, Sampsa Laine wrote:
Thanks dude. Send me the connection details.
Sampsa
On 8 Aug 2012, at 19:27, Brian Hechinger wrote:
Yeah, everything IP goes over VPN.
Ok, you win. I'll setup the bridge. :)
-brian
On 8/8/2012 12:26 PM, Sampsa Laine wrote:
Well I was thinking something simpler:
You set up a VPN server on your end to listen to connections.
I connect to your VPN server.
Let's say I get IP 10.0.01, your bridge is on 10.0.0.2.
I then just point my bridge at 10.0.0.2:4711, you point yours at the 10.0.0.1:4711.
UDP goes over VPN?
Sampsa
On 8 Aug 2012, at 19:16, Brian Hechinger wrote:
Yeah, that's an option, but here is what I was thinking.
You connect via openvpn to me. I redirect a port on my IP to go to yours.
For example, my server is 208.85.173.157. My end of the vpn tunnel is 10.42.3.1 and your end of the vpn tunnel is 10.42.3.2.
I had a nat rule that takes tcp port 9022 from 208.85.173.157 and redirects it to 10.42.3.2 port 22.
What this would allow you to do is ssh to 208.85.173.157:9022 and get directly connected to whatever is running openvpn on your end.
In theory.
In reality, it's not working for some reason. :(
It really should, but I haven't touched ipf/ipnat on this box in so long I might have something setup incorrectly (i used to do exactly this).
-brian
On 8/8/2012 12:12 PM, Sampsa Laine wrote:
Dude, there is no server. Let me explain :)
My ISP offers non-public IPs, so that's NAT one one - no way to forward a port.
Then I got a router, doing the local NATing, NAT two. Sure i could forward a port, but it ain't gonna help as the packets will never get to me from the ISP.
So I figure I connect out to you via OpenVPN, get a static IP x.x.x.x and then point my bridge at your static IP y.y.y.y (both of these are on the VPN), and you do vice versa.
Sound reasonable?
On 8 Aug 2012, at 19:09, Brian Hechinger wrote:
It might come to that but what I'm attempting to do now is make you a bit more autonomous. If all goes according to plan (and so far it isn't) i'll be redirecting ports on my IP directly to your server.
If this doesn't work I'll just setup the bridge for you to relay through.
-brian
On 8/8/2012 11:56 AM, Sampsa Laine wrote:
And then my assumption is that I get a static IP (non-routable, of course) for my side and we point our bridges at each other over UDP?
Sampsa
On 8 Aug 2012, at 18:31, Brian Hechinger wrote:
It doesn't really matter I don't think. The OpenVPN config file is the same no matter where you use it.
-brian
On 8/8/2012 10:50 AM, Sampsa Laine wrote:
I can run it from both an OS X box or Linux?
Which is easier to configure?
Sampsa
On 8 Aug 2012, at 16:55, Brian Hechinger wrote:
I should have some time today. Let me take a quick look at it and see. I can simulate your setup so I can test it here before passing it off to you
-brian
On 8/8/2012 9:19 AM, Sampsa Laine wrote:
Brian,
When would be a good time to set up this OpenVPN thing for you?
Let me know.
Sampsa
On 6 Aug 2012, at 23:43, Sampsa Laine wrote:
I'm game - never set it up on a Linux box before, though
On 6 Aug 2012, at 23:13, Brian Hechinger wrote:
A possible option would be to setup an OpenVPN tunnel somewhere to go through. Maybe not pretty, but it'll work.
If you want to try that email me off list and we can set it up on my colo box.
-brian
On Aug 6, 2012, at 16:00, Sampsa Laine <sampsa at mac.com> wrote:
On 6 Aug 2012, at 20:07, Johnny Billquist wrote:
Ah well, I could go on... Suffice to say that it's not because I'm opposed to the features that a TCP connection, or DNS resolution would give, but I prioritize something that I feel confident is working to features. And doing a proper solution with all these aspects is more work than I have cared to put into it. The bridge program is a hack.
As Paul mention, pthreads would probably be a good start if you want to do something more intelligent. You need to start thinking asynchronously.
My desire for this is basically because my ISP is NAT'd to hell - I have no way of getting UDP packets back to my network, as the ISP gives me a non-routable address.
Why go with this ISP? Well it's about 3x faster than the DSL I can get in the sticks over a 3G signal, with unlimited bandwidth and usage.
But sucks for HECnet..
Sampsa
Yeah, everything IP goes over VPN.
Ok, you win. I'll setup the bridge. :)
-brian
On 8/8/2012 12:26 PM, Sampsa Laine wrote:
Well I was thinking something simpler:
You set up a VPN server on your end to listen to connections.
I connect to your VPN server.
Let's say I get IP 10.0.01, your bridge is on 10.0.0.2.
I then just point my bridge at 10.0.0.2:4711, you point yours at the 10.0.0.1:4711.
UDP goes over VPN?
Sampsa
On 8 Aug 2012, at 19:16, Brian Hechinger wrote:
Yeah, that's an option, but here is what I was thinking.
You connect via openvpn to me. I redirect a port on my IP to go to yours.
For example, my server is 208.85.173.157. My end of the vpn tunnel is 10.42.3.1 and your end of the vpn tunnel is 10.42.3.2.
I had a nat rule that takes tcp port 9022 from 208.85.173.157 and redirects it to 10.42.3.2 port 22.
What this would allow you to do is ssh to 208.85.173.157:9022 and get directly connected to whatever is running openvpn on your end.
In theory.
In reality, it's not working for some reason. :(
It really should, but I haven't touched ipf/ipnat on this box in so long I might have something setup incorrectly (i used to do exactly this).
-brian
On 8/8/2012 12:12 PM, Sampsa Laine wrote:
Dude, there is no server. Let me explain :)
My ISP offers non-public IPs, so that's NAT one one - no way to forward a port.
Then I got a router, doing the local NATing, NAT two. Sure i could forward a port, but it ain't gonna help as the packets will never get to me from the ISP.
So I figure I connect out to you via OpenVPN, get a static IP x.x.x.x and then point my bridge at your static IP y.y.y.y (both of these are on the VPN), and you do vice versa.
Sound reasonable?
On 8 Aug 2012, at 19:09, Brian Hechinger wrote:
It might come to that but what I'm attempting to do now is make you a bit more autonomous. If all goes according to plan (and so far it isn't) i'll be redirecting ports on my IP directly to your server.
If this doesn't work I'll just setup the bridge for you to relay through.
-brian
On 8/8/2012 11:56 AM, Sampsa Laine wrote:
And then my assumption is that I get a static IP (non-routable, of course) for my side and we point our bridges at each other over UDP?
Sampsa
On 8 Aug 2012, at 18:31, Brian Hechinger wrote:
It doesn't really matter I don't think. The OpenVPN config file is the same no matter where you use it.
-brian
On 8/8/2012 10:50 AM, Sampsa Laine wrote:
I can run it from both an OS X box or Linux?
Which is easier to configure?
Sampsa
On 8 Aug 2012, at 16:55, Brian Hechinger wrote:
I should have some time today. Let me take a quick look at it and see. I can simulate your setup so I can test it here before passing it off to you
-brian
On 8/8/2012 9:19 AM, Sampsa Laine wrote:
Brian,
When would be a good time to set up this OpenVPN thing for you?
Let me know.
Sampsa
On 6 Aug 2012, at 23:43, Sampsa Laine wrote:
I'm game - never set it up on a Linux box before, though
On 6 Aug 2012, at 23:13, Brian Hechinger wrote:
A possible option would be to setup an OpenVPN tunnel somewhere to go through. Maybe not pretty, but it'll work.
If you want to try that email me off list and we can set it up on my colo box.
-brian
On Aug 6, 2012, at 16:00, Sampsa Laine <sampsa at mac.com> wrote:
On 6 Aug 2012, at 20:07, Johnny Billquist wrote:
Ah well, I could go on... Suffice to say that it's not because I'm opposed to the features that a TCP connection, or DNS resolution would give, but I prioritize something that I feel confident is working to features. And doing a proper solution with all these aspects is more work than I have cared to put into it. The bridge program is a hack.
As Paul mention, pthreads would probably be a good start if you want to do something more intelligent. You need to start thinking asynchronously.
My desire for this is basically because my ISP is NAT'd to hell - I have no way of getting UDP packets back to my network, as the ISP gives me a non-routable address.
Why go with this ISP? Well it's about 3x faster than the DSL I can get in the sticks over a 3G signal, with unlimited bandwidth and usage.
But sucks for HECnet..
Sampsa
Yeah, that's an option, but here is what I was thinking.
You connect via openvpn to me. I redirect a port on my IP to go to yours.
For example, my server is 208.85.173.157. My end of the vpn tunnel is 10.42.3.1 and your end of the vpn tunnel is 10.42.3.2.
I had a nat rule that takes tcp port 9022 from 208.85.173.157 and redirects it to 10.42.3.2 port 22.
What this would allow you to do is ssh to 208.85.173.157:9022 and get directly connected to whatever is running openvpn on your end.
In theory.
In reality, it's not working for some reason. :(
It really should, but I haven't touched ipf/ipnat on this box in so long I might have something setup incorrectly (i used to do exactly this).
-brian
On 8/8/2012 12:12 PM, Sampsa Laine wrote:
Dude, there is no server. Let me explain :)
My ISP offers non-public IPs, so that's NAT one one - no way to forward a port.
Then I got a router, doing the local NATing, NAT two. Sure i could forward a port, but it ain't gonna help as the packets will never get to me from the ISP.
So I figure I connect out to you via OpenVPN, get a static IP x.x.x.x and then point my bridge at your static IP y.y.y.y (both of these are on the VPN), and you do vice versa.
Sound reasonable?
On 8 Aug 2012, at 19:09, Brian Hechinger wrote:
It might come to that but what I'm attempting to do now is make you a bit more autonomous. If all goes according to plan (and so far it isn't) i'll be redirecting ports on my IP directly to your server.
If this doesn't work I'll just setup the bridge for you to relay through.
-brian
On 8/8/2012 11:56 AM, Sampsa Laine wrote:
And then my assumption is that I get a static IP (non-routable, of course) for my side and we point our bridges at each other over UDP?
Sampsa
On 8 Aug 2012, at 18:31, Brian Hechinger wrote:
It doesn't really matter I don't think. The OpenVPN config file is the same no matter where you use it.
-brian
On 8/8/2012 10:50 AM, Sampsa Laine wrote:
I can run it from both an OS X box or Linux?
Which is easier to configure?
Sampsa
On 8 Aug 2012, at 16:55, Brian Hechinger wrote:
I should have some time today. Let me take a quick look at it and see. I can simulate your setup so I can test it here before passing it off to you
-brian
On 8/8/2012 9:19 AM, Sampsa Laine wrote:
Brian,
When would be a good time to set up this OpenVPN thing for you?
Let me know.
Sampsa
On 6 Aug 2012, at 23:43, Sampsa Laine wrote:
I'm game - never set it up on a Linux box before, though
On 6 Aug 2012, at 23:13, Brian Hechinger wrote:
A possible option would be to setup an OpenVPN tunnel somewhere to go through. Maybe not pretty, but it'll work.
If you want to try that email me off list and we can set it up on my colo box.
-brian
On Aug 6, 2012, at 16:00, Sampsa Laine <sampsa at mac.com> wrote:
On 6 Aug 2012, at 20:07, Johnny Billquist wrote:
Ah well, I could go on... Suffice to say that it's not because I'm opposed to the features that a TCP connection, or DNS resolution would give, but I prioritize something that I feel confident is working to features. And doing a proper solution with all these aspects is more work than I have cared to put into it. The bridge program is a hack.
As Paul mention, pthreads would probably be a good start if you want to do something more intelligent. You need to start thinking asynchronously.
My desire for this is basically because my ISP is NAT'd to hell - I have no way of getting UDP packets back to my network, as the ISP gives me a non-routable address.
Why go with this ISP? Well it's about 3x faster than the DSL I can get in the sticks over a 3G signal, with unlimited bandwidth and usage.
But sucks for HECnet..
Sampsa
It might come to that but what I'm attempting to do now is make you a bit more autonomous. If all goes according to plan (and so far it isn't) i'll be redirecting ports on my IP directly to your server.
If this doesn't work I'll just setup the bridge for you to relay through.
-brian
On 8/8/2012 11:56 AM, Sampsa Laine wrote:
And then my assumption is that I get a static IP (non-routable, of course) for my side and we point our bridges at each other over UDP?
Sampsa
On 8 Aug 2012, at 18:31, Brian Hechinger wrote:
It doesn't really matter I don't think. The OpenVPN config file is the same no matter where you use it.
-brian
On 8/8/2012 10:50 AM, Sampsa Laine wrote:
I can run it from both an OS X box or Linux?
Which is easier to configure?
Sampsa
On 8 Aug 2012, at 16:55, Brian Hechinger wrote:
I should have some time today. Let me take a quick look at it and see. I can simulate your setup so I can test it here before passing it off to you
-brian
On 8/8/2012 9:19 AM, Sampsa Laine wrote:
Brian,
When would be a good time to set up this OpenVPN thing for you?
Let me know.
Sampsa
On 6 Aug 2012, at 23:43, Sampsa Laine wrote:
I'm game - never set it up on a Linux box before, though
On 6 Aug 2012, at 23:13, Brian Hechinger wrote:
A possible option would be to setup an OpenVPN tunnel somewhere to go through. Maybe not pretty, but it'll work.
If you want to try that email me off list and we can set it up on my colo box.
-brian
On Aug 6, 2012, at 16:00, Sampsa Laine <sampsa at mac.com> wrote:
On 6 Aug 2012, at 20:07, Johnny Billquist wrote:
Ah well, I could go on... Suffice to say that it's not because I'm opposed to the features that a TCP connection, or DNS resolution would give, but I prioritize something that I feel confident is working to features. And doing a proper solution with all these aspects is more work than I have cared to put into it. The bridge program is a hack.
As Paul mention, pthreads would probably be a good start if you want to do something more intelligent. You need to start thinking asynchronously.
My desire for this is basically because my ISP is NAT'd to hell - I have no way of getting UDP packets back to my network, as the ISP gives me a non-routable address.
Why go with this ISP? Well it's about 3x faster than the DSL I can get in the sticks over a 3G signal, with unlimited bandwidth and usage.
But sucks for HECnet..
Sampsa
It doesn't really matter I don't think. The OpenVPN config file is the same no matter where you use it.
-brian
On 8/8/2012 10:50 AM, Sampsa Laine wrote:
I can run it from both an OS X box or Linux?
Which is easier to configure?
Sampsa
On 8 Aug 2012, at 16:55, Brian Hechinger wrote:
I should have some time today. Let me take a quick look at it and see. I can simulate your setup so I can test it here before passing it off to you
-brian
On 8/8/2012 9:19 AM, Sampsa Laine wrote:
Brian,
When would be a good time to set up this OpenVPN thing for you?
Let me know.
Sampsa
On 6 Aug 2012, at 23:43, Sampsa Laine wrote:
I'm game - never set it up on a Linux box before, though
On 6 Aug 2012, at 23:13, Brian Hechinger wrote:
A possible option would be to setup an OpenVPN tunnel somewhere to go through. Maybe not pretty, but it'll work.
If you want to try that email me off list and we can set it up on my colo box.
-brian
On Aug 6, 2012, at 16:00, Sampsa Laine <sampsa at mac.com> wrote:
On 6 Aug 2012, at 20:07, Johnny Billquist wrote:
Ah well, I could go on... Suffice to say that it's not because I'm opposed to the features that a TCP connection, or DNS resolution would give, but I prioritize something that I feel confident is working to features. And doing a proper solution with all these aspects is more work than I have cared to put into it. The bridge program is a hack.
As Paul mention, pthreads would probably be a good start if you want to do something more intelligent. You need to start thinking asynchronously.
My desire for this is basically because my ISP is NAT'd to hell - I have no way of getting UDP packets back to my network, as the ISP gives me a non-routable address.
Why go with this ISP? Well it's about 3x faster than the DSL I can get in the sticks over a 3G signal, with unlimited bandwidth and usage.
But sucks for HECnet..
Sampsa
I should have some time today. Let me take a quick look at it and see. I can simulate your setup so I can test it here before passing it off to you
-brian
On 8/8/2012 9:19 AM, Sampsa Laine wrote:
Brian,
When would be a good time to set up this OpenVPN thing for you?
Let me know.
Sampsa
On 6 Aug 2012, at 23:43, Sampsa Laine wrote:
I'm game - never set it up on a Linux box before, though
On 6 Aug 2012, at 23:13, Brian Hechinger wrote:
A possible option would be to setup an OpenVPN tunnel somewhere to go through. Maybe not pretty, but it'll work.
If you want to try that email me off list and we can set it up on my colo box.
-brian
On Aug 6, 2012, at 16:00, Sampsa Laine <sampsa at mac.com> wrote:
On 6 Aug 2012, at 20:07, Johnny Billquist wrote:
Ah well, I could go on... Suffice to say that it's not because I'm opposed to the features that a TCP connection, or DNS resolution would give, but I prioritize something that I feel confident is working to features. And doing a proper solution with all these aspects is more work than I have cared to put into it. The bridge program is a hack.
As Paul mention, pthreads would probably be a good start if you want to do something more intelligent. You need to start thinking asynchronously.
My desire for this is basically because my ISP is NAT'd to hell - I have no way of getting UDP packets back to my network, as the ISP gives me a non-routable address.
Why go with this ISP? Well it's about 3x faster than the DSL I can get in the sticks over a 3G signal, with unlimited bandwidth and usage.
But sucks for HECnet..
Sampsa
You can also use a pair of VDE plugs tunneled over SSH. That's what I use to hook simulators running in my laptop over an iPhohe tethered connection. It's a little bit convoluted to set up, but it works wonderfully.
Jordi Guillaumes i Pons
jg at jordi.guillaumes.name
HECnet: BITXOV::JGUILLAUMES
Hello!
Sounds interesting. Can you point me to something?
Sure! I wrote about it in my blog.
http://ancientbits.blogspot.com.es/2012/06/simh-39-using-vde-for-fun-and.ht…
-----
Gregg C Levine gregg.drwho8 at gmail.com
"This signature fought the Time Wars, time and again."
On Tue, Aug 7, 2012 at 4:06 PM, Jordi Guillaumes i Pons
<jg at jordi.guillaumes.name> wrote:
El 06/08/2012, a les 22:18, Paul_Koning at Dell.com va escriure:
Ethernet tunneling over TCP seems reasonable enough, even though the TCP connection/ack machinery is pure overhead for this application. SSL could be used if security is needed -- is that important?
For people who have port number limitations (censoring ISPs) I wonder if tunneling over HTTP should be defined. :-), sort of.
You can also use a pair of VDE plugs tunneled over SSH. That's what I use to hook simulators running in my laptop over an iPhohe tethered connection. It's a little bit convoluted to set up, but it works wonderfully.
Jordi Guillaumes i Pons
jg at jordi.guillaumes.name
HECnet: BITXOV::JGUILLAUMES
Hello!
Sounds interesting. Can you point me to something?
-----
Gregg C Levine gregg.drwho8 at gmail.com
"This signature fought the Time Wars, time and again."
El 06/08/2012, a les 22:18, Paul_Koning at Dell.com va escriure:
Ethernet tunneling over TCP seems reasonable enough, even though the TCP connection/ack machinery is pure overhead for this application. SSL could be used if security is needed -- is that important?
For people who have port number limitations (censoring ISPs) I wonder if tunneling over HTTP should be defined. :-), sort of.
You can also use a pair of VDE plugs tunneled over SSH. That's what I use to hook simulators running in my laptop over an iPhohe tethered connection. It's a little bit convoluted to set up, but it works wonderfully.
Jordi Guillaumes i Pons
jg at jordi.guillaumes.name
HECnet: BITXOV::JGUILLAUMES
