secret has been deprecated
static key mode (non-TLS) is no longer considered "good and secure enough" for today's requirements. Use TLS mode instead. If deploying a PKI CA is considered "too complicated", using --peer-fingerprint makes TLS mode about as easy as using --secret.https://github.com/OpenVPN/openvpn/blob/release/2.6/Changes.rst
Config VyOS:
set interfaces openvpn vtun5001 local-address 203.0.113.1 set interfaces openvpn vtun5001 mode 'site-to-site' set interfaces openvpn vtun5001 remote-address '192.0.2.5' set interfaces openvpn vtun5001 shared-secret-key 'ovpn_test' set pki openvpn shared-secret ovpn_test key '9caf354e0f313b3a671d01e62ea2b512346a651dd30a9e51d6c45dc1031f1b0931eabdf7a0ddcbe1a147ff882ccce35dcb5e1d4d6ddb5e909ca012a8d8e16fe50dd332005dff9a836a2852f36e84e27bad07993a8094c56fb0553866ef74c6c5cc6ddb8f4673d3ff300c48068b944bd8ba1100d41f91d156bcd2629ff39837ddcb34d93147a4aabc7e6ad95d5800c82c8ab60ba302d6625a3b26fbfe183fd6c06d884be44edde344fd0ac91a33064529e010eba0c0f495fa44519fd98adb97452a27fb3340bc20efadd68c9538aa4a238c9f58f542e3571ec78790fdd03e678e18631b82edb9358a2c55ce581d68b71881cad0d0419d4cc58c13641f84281260' set pki openvpn shared-secret ovpn_test version '1'
In T5022#143112, @syncer wrote:@Viacheslav can you see what auth modes supported by keepalive
also I think we don't need to configure bothset high-availablilty vrrp global notification_email [email protected] set high-availablilty vrrp global notification_email_from [email protected]or that is destination and from ?
Also bug with ifb interface
vyos@r14# set interfaces input ifb0 [edit] vyos@r14# set interfaces ethernet eth0 redirect 'ifb0'
Cherry-pick for 1.3.3 https://github.com/vyos/vyos-1x/pull/1838
The thing is we have default values (for example memory) only for the first container:
##################################################
{'name': {'multitool': {'description': 'Network multitool container',
'image': 'wbitt/network-multitool:fedora',
'memory': '512',
'network': {'cntr-net': {}},
'port': {'http': {'destination': '80',
'protocol': 'tcp',
'source': '80'}},
'restart': 'on-failure',
'shared_memory': '64'},
'nrpe': {'allow_host_networks': {},
'image': 'incitem/almalinux9:nrpe',
'protocol': 'tcp'},
'radius': {'allow_host_networks': {},
'image': 'dchidell/radius-web',
'protocol': 'tcp',
'volume': {'clients': {'destination': '/etc/raddb/clients.conf',
'mode': 'rw',
'source': '/config/containers/radius/clients'},
'users': {'destination': '/etc/raddb/users',
'mode': 'rw',
'source': '/config/containers/radius/users'}}}},
'network': {'cntr-net': {'description': 'VyOS Container Network',
'prefix': ['172.253.253.0/24']}},
'registry': ['docker.io', 'quay.io']}
##################################################PR for 1.3 https://github.com/vyos/vyos-1x/pull/1833
Without a hash, it can be useless.
For example, the client initiates a TCP session:
PR https://github.com/vyos/vyos-1x/pull/1827
set service pppoe-server authentication mode 'noauth' set service pppoe-server client-ip-pool name foo gateway-address '192.0.2.1' set service pppoe-server client-ip-pool name foo subnet '192.0.2.0/24' set service pppoe-server interface eth1
Check
vyos@r14# cat /run/accel-pppd/pppoe.conf | grep "\[auth" -A 2 [auth] noauth=1
@mas90 Will be present in the next rolling release.
Could you check when it will available? After 20230215
PR https://github.com/vyos/vyos-1x/pull/1825
set system option keyboard-layout uk
In T4971#142523, @fernandolcx wrote:service { + pppoe-server { + authentication { + mode radius + radius { + server 172.31.255.2 { + key 123456 + } + } + } + interface eth1 { + } + } }when I commit, throws me:
Traceback (most recent call last): File "/usr/libexec/vyos/conf_mode/service_pppoe-server.py", line 114, in <module> verify(c) File "/usr/libexec/vyos/conf_mode/service_pppoe-server.py", line 60, in verify verify_accel_ppp_base_service(pppoe) File "/usr/lib/python3/dist-packages/vyos/configverify.py", line 424, in verify_accel_ppp_base_service for _, v in config['client_ip_pool']['name'].items(): KeyError: 'client_ip_pool'
Some debugging, the authentication with user vyosunpriv
Don't see any issue with 1.3
vyos@r1:~$ monitor bandwidth-test initiate 192.168.122.14 ------------------------------------------------------------ Client connecting to 192.168.122.14, TCP port 5001 TCP window size: 85.0 KByte (default) ------------------------------------------------------------ [ 3] local 192.168.122.11 port 58042 connected with 192.168.122.14 port 5001 [ ID] Interval Transfer Bandwidth [ 3] 0.0-10.0 sec 6.37 GBytes 5.47 Gbits/sec vyos@r1:~$ vyos@r1:~$ show version
PR for 1.3 https://github.com/vyos/vyos-1x/pull/1813
PR for 1.3 https://github.com/vyos/vyos-1x/pull/1812