oriolrius.cat

Des del 2000 compartiendo sobre…

Year: 2016

OpenVPN between pfSense and Mikrotik

2016/08/22 7 comentaris

Reading time: 3 – 5 minutes

Assuming previous scenario I’m going to describe the required configurations on pfSense and Mikrotik. Certifcate creation is not part of the scope of this document, if you are not familiar about how to do that it’s a good idea to use the pfSense certificate manager to do it. My last advice is take care with certificates 90% of problems that I found in my life when I was working on VPNs are because of that. Take your time to check it before spend your time playing with other configurations.

In that scenario pfSense will play the role of the VPN server and Mikrotik will be the client, so I’m going to start describing pfSense configurations.

Create OpenVPN server on proper section:

Important things to take in account when you set up the parameters are socket has to be a TCP socket in my case I decided to use port 1201:

Next settings on the same place are about local network and tunnel IP addresses, this is required to create proper routing rules on the server and the client.

Last part to configure on this sections is extremly simple, only take care to unmark everything and check “address pool” setting.

Remember to open that port on Firewall rules.

A VPN user is required to authenticate the process, just go to “User Management” inside the “System” menu:

pfSense is configured, now it’s time to set-up the OpenVPN client on Mikrotik using Winbox. Remember to import the certificates:

Click on “PPP” this on the left menu:

Add an OVPN Client connection using the “+” button, the parameters for that connection are:

Another required thing to define on “PPP” is the profile, click on the tab “Profile” and using the button with symbol “+” create a new profile like that:

Everything is ready, now it’s time to check if the connection is OK. First go to the OVPN client on Mikrotik, remember this is on “PPP” menu option and inside tab “Interfaces”. Clicking on the interface you’ll see the status details. If it’s disconnect going to pfSense or Mikrotik logs you can see the negotiation details.

Remember usually the problem is with your certificates, but first of all you have to ensure that the negotiation tries to start.

Enjoy it and good luck.

Sniffing on Mikrotik and streaming in real-time to Wireshark

2016/08/15 No hi ha comentaris

Reading time: 2 – 2 minutes

When you have a Mikrotik in any point of your network and you want to launch a sniffer for debugging or troubleshooting, a part from original RouterOS tools, you can stream captured traffic in real-time to Wireshark and inspect packets there.

The idea is exactly the same like I explained on the entry: Sniffing traffic in a Linux box and streaming in real-time to Wireshark on Windows.

Mikrotik configuration using the web interface is like that:

We assume 10.2.0.44 is the IP address of the Wireshark box, ensure that you don’t block UDP traffic on port 37008 because the stream from Mikrotik uses that target port. And define your own filters.

About Wireshark configuration is really simple, just set up the filter to allow only traffic from sniffing stream and select the network interface where traffic comes.

Previous captures allow us to debug DNS queries to Google DNS service, this is the result when you click to the icon marked with a red circle on previous screen capture.

Setting alternative getty service on Ubuntu with systemd

2016/08/08 No hi ha comentaris

Reading time: 2 – 2 minutes

There is an a curses app called wicd-curses which uses a service called wicd, thanks to that app is possible to setup networking configuration for wired and wireless networks using a ncurses environment.

The purpose of the next cookbook is get the wicd-curses running on tty1 after the Ubuntu boots; allowing a console user configure networking settings without login in the system. After installing the wicd-curses package we have the daemon running. The first thing to do is ensure that systemd is taking take of the service:

systemctl enable wicd.service

Next we have to stop the service that launch getty on tty1 when the system boots:

systemctl disable getty@tty1.service

Now it’s time to define configuration file for our service /etc/systemd/system/wicd-boot.service:

[Unit]
Description=WICD ncurses on tty
After=wicd.service

[Service]
Type=simple
StandardInput=tty
StandardOutput=tty
RemainAfterExit=yes
ExecStart=/usr/bin/wicd-curses
Restart=always
RestartSec=2


[Install]
WantedBy=multi-user.target

Finally enable wicd-boot.service is required:

systemctl enable wicd-boot.service

Try new configuration is possible without reboot just doing:

systemctl daemon-reload
systemctl restart wicd-boot.service
# check if the service is running with
systemctl status wicd-boot.service

On other tty consoles we also have getty but not in tty1 where we have the wicd-curses interface. When we reboot the system we have the same behavior. Before finish the email I want to mention two helping references:

Arch linux forum: how autostart Interactive program at boot before tty appears
systemd man page

Extracting private and public keys from a p12 file

2016/08/01 No hi ha comentaris

Reading time: 1 – 2 minutes

PKCS#12 is a container for storing many cryptography objects as a single file. It is commonly used to bundle a private key with its X.509 certificate or to bundle all the members of a chain of trust. This is a fast and simple summary about how to extract your keys from those kind of files:

#Private key:
openssl pkcs12 -in file_name.p12 -nocerts -out private.key
#Certificates:
openssl pkcs12 -in file_name.p12 -clcerts -nokeys -out public.crt

Recurrently I have to access to a usuful guide about those kind of openssl parameters, let me refer that guide:

The Most Common OpenSSL Commands (local copy)

Update 2016/09/19
Usefull links for SSL:

Avui fa 16 anys que vaig començar a escriure el blog

2016/07/31 No hi ha comentaris

Reading time: 1 – 2 minutes

Feliç de recordar l’efemèride i de malgrat no tenir un blog molt prolífic poder explicar que he aconseguir mantenir l’hàbit d’anar compartint encara que fos en petites píldores alguns dels fets i coneixements que la vida m’ha anat permetent disfrutar. Des de l’arribada del Roc més que mai he hagut de tancar el meu “pipeline” de projectes però una cosa positiva és que t’acabes centrant en l’escència i en el que et fa disfrutar més. Per desgràcia no pots atendre moltes altres coses que sovint tornen en forma de records o pensaments, això si, t’adones que les coses que has permès que seguissin al teu costat tenen el millor gust que mai havien tingut.

Només puc dir-vos que la meva intenció és seguir buscant reconets i estones per seguir compartint-vos el que hem passa pel cap, mentrestant ús envio una abraçada molt forta.

GRÀCIES PER SEGUIR-ME!

Mikrotik as a PPTP server for Android

2016/07/27 4 comentaris

Reading time: 4 – 6 minutes

Two years ago I installed a Mikrotik Cloud Switch and lately I stoped my pfSense and I started using that switch as my network router, firewall and also as a switch. RouterOS is really powerful and allows to do a lot of things with that hardware. One of those things is set-up a VPN server based on PPTP. This is not the most secure way to create VPNs but usually the only requirement is a little bit of security on top of an IP over IP service that allows us to use local service when we’re in remote. In my case I have a lot of services in my LAN and I need some of them when I’m out of home specially I need to use them from my mobile phone.

Next steps describe how I set-up a PPTP server on my Mikrotik server allowing my Android 6 device (Huawei Mate 8) to connect to my home services through the VPN. Bellow you have a simple schema representing the schenario of the solution:

I’m only going to describe steps from the web console, of course, all those steps can be done using Winbox or the command line. To be honest I’m not used to RouterOS CLI but I think it’s not difficult to figure out the CLI commands to get the same result.

First step is set-up a pool of IP addresses to be assigned to the tunnel endpoints.

Thanks to an ARP proxy those IP addresses will be available like local IPs, this is transparent for the VPN configuration.

configuration of connection profile is done inside “Profiles” tab:

first of all create a new profile called “default-encription”:

061-profiles

and another profile called “pptp-profile”:

“Secrets” tab is where you have to manage users, in my case only two users are created:

configuration details about my user are:

Inside PPP menu there is a button with a label “PPTP server” click there…

… and copy next settings:

Don’t forget to check that your PPTP port is accessible from your public IP address. Remember it’s 1723/TCP.

Android configuration is simple, first of all go to “settings” icon. Look for a “More” section bellow network options, and you’ll find VPN managment. Add a new connection, define a name, the type and the IP address and leave the rest by default. After that when you come back to VPN list you’ll find your new VPN in the list, click there and just set-up your PPTP credentials.

If you have some trouble the only thing that you can do is go to Mikrotik logs or start sniffing to figure out where is the problem. I had to do some tests before it was working but in the end everything was so simple like I explained here.

Good luck and enjoy it.

Thanks to next blog entries to inspire me:

Remove old kernels when there is no space in /boot

2016/06/06 1 comentari

Reading time: 1 – 2 minutes

The first step is get some space in the partition “/boot” because without that it’s impossible to do anything.

So go to /boot and remove some “initrd” files as they are the biggest ones. A few of them will be enough.

After that a good point is to ensure there is no partial installation pending to finish:

apt-get -f install

Now it’s a good idea to purge all kernels except the running one:

dpkg -l 'linux-*' | sed '/^ii/!d;/'"$(uname -r | sed "s/\(.*\)-\([^0-9]\+\)/\1/")"'/d;s/^[^ ]* [^ ]* \([^ ]*\).*/\1/;/[0-9]/!d' | xargs sudo apt-get -y purge

To avoid that in future before filling the partition, it’s a good idea to install and run periodically: purge-old-kernels. Installation and example of use are:

# installation
apt-get install bikeshed
# keep three old kernels:
purge-old-kernels --keep 3
# if you want to put that in the crontab use that command
purge-old-kernels --keep 3 -qy

If you’re a Grub user don’t forget to run:

update-grub2

Personally I have a nightmare with that problem and Ubuntu, especially with version 12.04 which is installed in a lot of servers that I manage. I repeated the previous process a lot of times and in the end, I decided to document it because I always have to go to Google and find the proper steps to solve that problem.

Protecting your email with MXGuarddog

2016/06/05 No hi ha comentaris

Reading time: 2 – 2 minutes

After using VMWare ESXi for a long time as a Hypervisor for my virtual servers I decided to stop paying OVH for that service and I migrated my virtual machines to VPS servers on OVH. At the end of the day only two VPS with a cost of 3€/month are enough and I can stop a 50€/month dedicated server.

The biggest challenge that I had to solve was migrate mail server to a new server. So far today I was using pfSense a firewall for my virtual servers. They were in a virtual network; pfSense anti-spam services and mail forwarding were enough to receive “cleaned” mail in my private mail server with Postfix and Dovecot.

New configuration is just a cheap VPS (1xCPU+2GB RAM+10GB SSD) with Ubuntu 16.04 and also with Postfix and Dovecot. But I decided to rent the anti-spam, anti-malware and anti-virus service to MX Guarddog. I discovered that service just surfing on the big G. Only 0.25 cents per account per month it’s a very good price and it does all the things that I need and much more. Configuration is really simple if you know what you are doing. They have a very good and simple control panel to manage the service. This is the perfect service to get what I need.

In the control panel you can do all that you need, manage mail accounts and domains. View quarantined mails and all required configurations and tests to validate everything is ready and also maintain white and black lists. We’ll see during next days if the service gets the quality that I expect, I hope I have found a very good and cheap resource.

Ja en sumo 39; no ús perdeu qui m’ha felicitat aquest any

2016/05/09 No hi ha comentaris

Reading time: 1 – 2 minutes

Un any més sumo una unitat a la compte i ja en van 39. Els 40 s’acosten però la veritat és que no li dono més importància del que té. La vida passa i les experiències s’acumulen. Per sort hi ha coses que realment hem fan somriure, algunes les podeu veure aquí:

d’altres aquí:

i fins hi tot podeu escoltar grans felicitacions com aquest del mateix Fidel Castro XDDD

Moltíssimes gràcies a tots els que us heu recordat de mi i als que no també, una fortíssima abraçada amb molt d’amor. GRÀCIES!

13 anys del meu segon aniversari

2016/05/07 1 comentari

Reading time: < 1 minute accident bmw