Forums

Resolved
0 votes
Tonight (31/03/20-01/04/20) the following updated packages are being released:

  • app-greylisting. Update /etc/postfix/postgrey_whitelist_clients to the latest version. The current app documentation says to set up a cron job to refresh the file regularly (otherwise the distro file dates back to about 2014). Given that most people probably don't read the documentation and the file update is relatively infrequent, I will maintain it in app-greylisting.
  • app-openvpn - adds parameter nat_enabled to /etc/clearos/openvpn.conf. Change to "yes" and restart the firewall to avoid having to use a custom firewall rule if you want to NAT your OpenVPN client traffic.

* by the package name = the package is also being released to Business at the same time.

Packages available for testing

  • app-openvpn nearly - Allow the webconfig to update the nat_enabled parameter. Also add options to enable client-to-client, 'push "block-outside-dns"' and 'push "redirect-gateway def1 bypass-dhcp"' to the webconfig. I am very nearly there and will post to the thread when it is ready for testing. I hope tomorrow.
  • PlexMediaServer - to test do a:
    yum update plexmediaserver --enablerepo-clearos-contribs-testing

  • app-kopano - Removes requirement for kopano-webapp-plugin-delayeddelivery which was deprecated a while back. Only available to Kopano users. To update, do:
    yum update app-kopano --enablerepo=clearos-paid-testing

  • z-push 2.5.2 - only relevant for Kopano users. Fixes a problem with calendar invitations in iOS. Note, so far I've not tested this myself, but have made the packages available for testing. I expect to test in the coming week but I don't have any iOS devices to test with. To test, do a:
    yum update z-push --enablerepo=clearos-paid-testing

  • app-network - code merge complete. Seems to work for everything except external VLANs and a few quirks.
  • app-gateway-management - update with:
    yum update app-gateway-management* --enablerepo=clearos-*-testing

  • app-dnsthingy - This is the same update as app-gateway-management but also includes a rebranding from DNSThingy to AdamOne. Update with:
    yum update app-dnsthingy --enablerepo=clearos-*-testing

  • adamone - this is the underlying package for the above beta versions of app-gateway-management/app-dnsthingy. If you have either of the above beta's installed, you can update with:
    yum update adamone --enablerepo=clearos-contribs-testing


    • Now allows you to set up Wireless and Cellular interfaces. You will also need app-wireless to configure a NIC as an access point. Otherwise manual configuration is then needed for WiFi and Cellular devices.
    • I've tweaked it for kernel mode PPPoE (much faster and lower resoucres). For the moment we are not forcibly converting PPPoE interfaces over, but if you edit an interface it will switch to kernel mode.
    • Hides irrelevant interfaces from app-network-report such as docker0, veth* and ifb*.
    • Numerous other changes since last 2.6.0
    • Do not use the the update if you use VLAN's on external interfaces.


Unless detailed otherwise, packages available for testing can be installed with:
yum update --enablerepo=clearos-updates-testing {package-name}

Packages being worked on:

  • app-openvpn - Allow the webconfig to update the nat_enabled parameter. Also add options to enable client-to-client, 'push "block-outside-dns"' and 'push "redirect-gateway def1 bypass-dhcp"' to the webconfig
  • app-storage
  • app-sia - In theory it worked but does not. Fixes needed. I have an idea to get it working in Gateway mode but it is deathly slow.
  • app-openvpn to add three configuration parameters (client-to-client, "push block-outside-dns" and to force all traffic through the VPN). This is being worked on by an external contributor.
  • app-attack-detector to add a button beside each banned IP to you can unban it. This is being worked on by an external contributor.
  • app-network - bug #41 should now be fixed. Two more bugs to go. Team Canada are working on it.
  • nextcloud - upstream v18. The PHP 7.2 set up is now cracked.
Tuesday, March 31 2020, 03:37 PM
Like
1
Share this post:
Responses (4)
  • Accepted Answer

    Wednesday, April 01 2020, 10:48 AM - #Permalink
    Resolved
    0 votes
    app-openvpn-2.4.11-1 should be syncing to the mirrors soon for testing:
    yum update app-openvpn --disablerepo=* --enablerepo=clearos-updates-testing
    This adds the following items to the webconfig:
    Enable NAT (Gateway mode only) - This adds a firewall rule to NAT incoming VPN connections when in Gateway mode. The Windows firewall often blocks connections (e.g.pings, file shares etc) from outside its own LAN. OpenVPN connections by default appear from 10.8.0.0/24 and will often be blocked but not always (e.g TightVNC creates a global exception in the firewall, not just one for the local LAN). You can adjust the Windows firewall on every machine, or you can enable this rule. With this rule enabled all OpenVPN connections will appear to come from the ClearOS LAN IP. The advantage of this is that it is easy to set up. The disadvantage is that a LAN machine cannot identify where the connection is coming from.
    Note that in Standalone mode, connections are NAT'd anyway.

    Force All traffic through VPN - By default OpenVPN allows split tunnelling, so on the client, only traffic for the ClearOS LAN goes through the tunnel. The rest goes directly to the internet. If this is enabled all traffic except DHCP (to get a lease from the local DHCP server/router) gets forced through the tunnel. This will slow down browsing but allow you to control internet access with tools like Gateway Management.
    Technically, it adds a line to the OpenVPN config:
    push "redirect-gateway def1 bypass-dhcp"
    If you had manually set up a line:
    push "redirect-gateway def1"
    It will also take it over. If you had any other version of the line e.g.:
    push "redirect-gateway def1 block-local"
    leave this disabled and the webconfig won't touch it.

    Allow Client to Client traffic - By default, one OpenVPN client cannot talk to another. Enabling this allows them to connect to each other. This can help, for example, if you are remote to ClearOS and trying to give another remote user help by VNC or RDP. On the flip side it is a bit less secure.
    Technically it sets the parameter:
    client-to-client
    in the OpenVPN config.

    Force DNS through VPN - If you use the same domain name internally and externally, Windows can have problems resolving internal FQDN entries. This is because it fires of DNS lookups simultaneously to all its DNS servers and takes the first response. This will normally be the external DNS servers. My external DNS server resolves a wildcard to my external IP, so all LAN resources will appear as my WAN IP which is not much use to me. It all depends on the type of reply your external DNS server gives for an unknown resource. Enabling this forces all DNS lookups to ClearOS. This will slow down external lookups if enabled as they all have to go via the VPN. There is no point in enabling this if you enable "Force All traffic through VPN" but it won't harm.
    Technically it adds the line:
    push "block-outside-dns"
    to the OpenVPN server config.

    I am open to suggestions to change the field names to something better.
    The reply is currently minimized Show
  • Accepted Answer

    Friday, April 03 2020, 09:33 AM - #Permalink
    Resolved
    0 votes
    Nick Howitt wrote:

    app-openvpn-2.4.11-1 should be syncing to the mirrors soon for testing:
    yum update app-openvpn --disablerepo=* --enablerepo-clearos-updates-testing
    This adds the following items to the webconfig:
    .


    Hi Nick,

    Some small remarks

    yum update app-openvpn --disablerepo=* --enablerepo-clearos-updates-testing

    should be
    yum update app-openvpn --disablerepo=* --enablerepo=clearos-updates-testing


    Version in webapp is OpenVPN 2.4.8 instead 2.4.11 at "Power by :"
    The reply is currently minimized Show
  • Accepted Answer

    Friday, April 03 2020, 11:22 AM - #Permalink
    Resolved
    0 votes
    Hi Patrick, I keep making that typo on my own system. I've corrected the post, thanks.

    2.4.8 is correct. That is the underlying openvpn version.

    I pushed 2.4.12 earlier this morning to correct a further legacy issue with the app not restarting when it should. You'd only notice the change when doing something which triggered a network change event.
    The reply is currently minimized Show
  • Accepted Answer

    Friday, April 03 2020, 11:44 AM - #Permalink
    Resolved
    0 votes
    I've updated app-flexshare to add a cron job to purge files in /trash after 60 days. This is following a customer disk full issue and has been an out standing feature request.
    yum update app-flexshare --disablerepo=* --enablerepo=clearos-updates-testing
    The reply is currently minimized Show
Your Reply