LinuxQuestions.org
Support LQ: Use code LQ3 and save $3 on Domain Registration
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices

Reply
 
Search this Thread
Old 08-14-2013, 06:00 AM   #31
NotAComputerGuy
Member
 
Registered: Jun 2012
Distribution: Linux Mint - Debian Edition
Posts: 328

Original Poster
Rep: Reputation: 7

Firerat, I'm really sorry to be such a newbie, but could you be a little more explicit in how I would use that? I've copied that into a file, made it executable and placed it in /etc/openvpn/ but I'm unsure what I do with it? Or should I just run it? Will that 'fix' openvpn until it updates? What did you mean by to get it to write add -i?

Thank you for your time and effort, I'm sorry for being quite confused

Last edited by NotAComputerGuy; 08-14-2013 at 06:03 AM.
 
Old 08-14-2013, 07:34 AM   #32
Firerat
Senior Member
 
Registered: Oct 2008
Distribution: Debian Jessie / sid
Posts: 1,471

Rep: Reputation: 444Reputation: 444Reputation: 444Reputation: 444Reputation: 444
Quote:
Originally Posted by NotAComputerGuy View Post
Firerat, I'm really sorry to be such a newbie, but could you be a little more explicit in how I would use that? I've copied that into a file, made it executable and placed it in /etc/openvpn/ but I'm unsure what I do with it? Or should I just run it? Will that 'fix' openvpn until it updates? What did you mean by to get it to write add -i?

Thank you for your time and effort, I'm sorry for being quite confused
Sorry, my fault

it is just a sed, ( stream editor )

just copy and paste it 'as is'

you will see the /etc/init.d/openvpn, only a modified version.

if you do "sed -i -e ....." instead of "sed -e ....." it will edit 'inline', i.e. save the changes. ( in this case you will need root )
actually, probably better to make it do a backup
"sed -i.backup -e ....."
The original will be saved as openvpn.backup


edit the "patch_script" replacing all of the YOUR.GATEWAY.IP.HERE, and add the -i.backup
to 'execute' it, just do
Code:
sh /path/to/patch_script
what it is actually doing is

adding the below, just above the line "start_vpn () {"
Code:
fix_ssh () {
ip rule add fwmark 65 table novpn
ip route add default via YOUR.GATEWAY.IP.HERE dev eth0 table novpn
ip route flush cache
iptables -t mangle -A OUTPUT -p tcp --sport 22 -j MARK --set-mark 65
iptables -A INPUT -i tun0 -p tcp -m tcp --dport 22 -j DROP
}
undo_fix_ssh () {
iptables -D INPUT -i tun0 -p tcp -m tcp --dport 22 -j DROP
iptables -t mangle -D OUTPUT -p tcp --sport 22 -j MARK --set-mark 65
ip route del default via YOUR.GATEWAY.IP.HERE dev eth0 table novpn
ip rule del fwmark 65 table novpn
ip route flush cache
}
it is also adding "&& fix_ssh" and "&& undo_fix_ssh" to the end of start_vpn and stop_vpn lines
so whenever the openvpn runs its start_vpn function it then runs the fix_ssh function ( unless start_vpn fails ), and the undo part runs when stop_vpn as run

Technically it is a 'fudge', because it will blindly run for every VPN,
I assumed you only have the one client configured

it is also a bit dumb in that it will keep adding the {undo_}fix_ssh functions
you could fix that with

Code:
#!/bin/bash
grep -q fix_ssh /etc/init.d/openvpn || sed ........
so the sed only runs if grep didn't find fix_ssh

Hope that makes sense
 
1 members found this post helpful.
Old 08-15-2013, 09:11 AM   #33
NotAComputerGuy
Member
 
Registered: Jun 2012
Distribution: Linux Mint - Debian Edition
Posts: 328

Original Poster
Rep: Reputation: 7
Yes it made sense. Kind of. I think. Apologies.

I have an executable file located in /etc/openvpn/ (should it be called patch_script, is that where that came in? I couldn't find it mentioned before).

The file contains the following:
Code:
#!/bin/bash
grep -q fix_ssh /etc/init.d/openvpn || sed -i.backup -e '/start_vpn ()/ i fix_ssh () {\
ip rule add fwmark 65 table novpn\
ip route add default via 192.168.0.1 dev eth0 table novpn\
ip route flush cache\
iptables -t mangle -A OUTPUT -p tcp --sport 22 -j MARK --set-mark 65\
iptables -A INPUT -i tun0 -p tcp -m tcp --dport 22 -j DROP\
}\
undo_fix_ssh () {\
iptables -D INPUT -i tun0 -p tcp -m tcp --dport 22 -j DROP\
iptables -t mangle -D OUTPUT -p tcp --sport 22 -j MARK --set-mark 65\
ip route del default via 192.168.0.1 dev eth0 table novpn\
ip rule del fwmark 65 table novpn\
ip route flush cache\
}'\
   -e 's/start_vpn$/& \&\& fix_ssh/' \
   -e 's/stop_vpn$/& \&\& undo_fix_ssh/' \
/etc/init.d/openvpn
Which as root I run with "sh scriptname". I'm sorry if I seem to be taking this slowly. Thanks to yourselves the system works pretty well at the moment, anxious not to break it, but also very aware if I don't do anything then the next reboot it will loose all it's settings.
 
Old 08-15-2013, 10:37 AM   #34
Firerat
Senior Member
 
Registered: Oct 2008
Distribution: Debian Jessie / sid
Posts: 1,471

Rep: Reputation: 444Reputation: 444Reputation: 444Reputation: 444Reputation: 444
Quote:
Originally Posted by NotAComputerGuy View Post
Yes it made sense. Kind of. I think. Apologies.

I have an executable file located in /etc/openvpn/ (should it be called patch_script, is that where that came in? I couldn't find it mentioned before).

Which as root I run with "sh scriptname". I'm sorry if I seem to be taking this slowly. Thanks to yourselves the system works pretty well at the moment, anxious not to break it, but also very aware if I don't do anything then the next reboot it will loose all it's settings.
Its me, I'm really bad at naming things

patch_script = Script_to_patch_etc_init.d_openvpn
so yeah "sh Script_to_patch_etc_init.d_openvpn"

To be honest I may have 'overcomplicated' it, I don't think it will make any difference if the VPN is running or not..
I just like to undo things
 
1 members found this post helpful.
Old 08-15-2013, 03:26 PM   #35
NotAComputerGuy
Member
 
Registered: Jun 2012
Distribution: Linux Mint - Debian Edition
Posts: 328

Original Poster
Rep: Reputation: 7
I managed to get it to run. Just out of interest, how come it wouldn't work with sudo (sh: 0: Can't open script), but would if I su'd into root? Just curiosity more than anything.

I'll test it tomorrow to ensure it all worked and let you know if it all works.

Thanks you
 
Old 08-15-2013, 07:31 PM   #36
Firerat
Senior Member
 
Registered: Oct 2008
Distribution: Debian Jessie / sid
Posts: 1,471

Rep: Reputation: 444Reputation: 444Reputation: 444Reputation: 444Reputation: 444
Honestly .. I have no idea..
about the only difference I can think of is that I have sh symlinked to bash instead of dash ( as I do LFS builds now and again )
But it should not present any problem to dash ( in sh mode or full dash )
It is basically a oneliner ( a long oneliner, but nothing 'complicated' )
 
1 members found this post helpful.
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Help with Ubuntu server remote ssh and local network ssh issues using putty. scottpops Linux - Server 8 05-17-2012 05:07 PM
sudden loss of ability to access network (can ssh in but not ssh out) lenafabr Red Hat 5 10-31-2008 08:33 AM
Cannot SSH from outside the network hradtke Linux - Networking 4 08-30-2006 02:33 AM
SSH - How can i alllow someone SSH to my network from Internet - please help me b:z Linux - Networking 4 04-05-2005 07:21 AM
can't telnet/ssh across network paul.nel Linux - Networking 4 11-14-2003 03:15 AM


All times are GMT -5. The time now is 12:26 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration