Wireguard can not connect to Qnap NAS - wireguard

Port 51820 already mapped in my router. Points to my Qnap NAS ip.
My Linux client configuration set in /etc/wireguard/wg0.conf
[Interface]
Address = 198.18.7.2/32
SaveConfig = true
ListenPort = 37636
FwMark = 0xca6c
PrivateKey = <client key>
[Peer]
PublicKey = <qnap key>
AllowedIPs = 0.0.0.0/0
Endpoint = <mydyndns>:51820
PersistentKeepalive = 10
When I try to connect
╭─ender#ender-PC ~
╰─$ sudo wg-quick up wg0
[#] ip link add wg0 type wireguard
[#] wg setconf wg0 /dev/fd/63
[#] ip -4 address add 198.18.7.2/32 dev wg0
[#] ip link set mtu 1420 up dev wg0
[#] ip -4 route add 0.0.0.0/0 dev wg0 table 51820
[#] ip -4 rule add not fwmark 51820 table 51820
[#] ip -4 rule add table main suppress_prefixlength 0
[#] sysctl -q net.ipv4.conf.all.src_valid_mark=1
[#] iptables-restore -n
╭─ender#ender-PC ~
╰─$ ping 1.1.1.1
PING 1.1.1.1 (1.1.1.1) 56(84) bytes of data.
^C
--- 1.1.1.1 ping statistics ---
8 packets transmitted, 0 received, 100% packet loss, time 7168ms
Qnap "server" configuration
Publick key of the client has been added.
I've also tried to connect from the Android app and does not work.
I've been able to check the logs in the Linux client wg0: Handshake for peer 3 (<nasIP>:51820) did not complete after 5 seconds, retrying (try 2) which are the same logs as in the Android app. The issue seems to be pointing in the NAS side.
PS: I have already another VPN working (QBelt, which is a proprietary of Qnap) and is reachable from outside.
QTS version 5.0.0.1837

Hope I come with good, if partial news: I managed to fix OpenVPN through a TeamViewer on a Pi4 linked to the NAS's LAN. Also set up L2TP/IPSec as a second connection solution.
Diagnostic on what went wrong during QTS4->5 update (1828 20211020): NAT still properly set on the routeur, but somehow the OpenVPN server was affected to the secondary LAN. So yes, NAT was pointing to the wrong IP address… There is no telling if the glitch came from QVPN or the network & virtual switch.
Please note the list of issues and changes is impressive. Not surprising for a major release, but still… Next step: I'll set up a WireGuard connection. More later…

I may have missed QTS version on your configuration. Do you mind giving us a few details? Wireguard means a fairly recent version, but which one is important.
I recently updated a new NAS to QTS 5, and a perfectly working OpenvPN server stopped working altogether. Worked like a charm in version 4, being overzealous in updating the server was (sadly predictably) a mistake. Concrete result is, I now get an infinite timeout on port 1194, which ends up with "TLS handshake failed".
Same situation after dropping the OpenVPN configuration on the NAS and recreating it from scratch. So the answer to your problem may be as simple as having to wait for QNAP to fix either QVPN or LAN management on QTS 5.
Unfortunately I cannot access the NAS remotely anymore, so I can't corroborate your feedback that Qbelt is not affected. I will have a TeamViewer set up on the LAN tomorrow ta get access to the NAS again, and I'll give it a try.

This looks like an error on the keys.
Can you please try to recreate public and private server and client keys, ensure the public server key and private client key are in the client configuration files, and public client keys is in the server configuration table?
On a side note, you shouldn't use RFC 2544 IP, even if QNAP tutorial is using them.

the ip of the nas was not correctly set in the port forwarding mapping...

Related

How to test postgres database connection on host?

I used pg_isready -h localhost which gives output as localhost:5432 - accepting connections
But when i used my host-ip instead of localhost ,it gives output as
pg_isready -h 18.191.7.185
output is 18.191.7.185:5432 - no response
My localhost isn't my ip-address?
No, it isn't. Verify with
ping localhost
which will show you the IP address that localhost resolves to.
The “loopback interface” is a special network interface that only contains your computer.
The cause of the problem is probably that the PostgreSQL parameter listen_addresses, which specifies the network interfaces on which PostgreSQL is listening, is set to the default value localhost.
Change the value to * and restart PostgreSQL, and it should work.
A second possibility is that you have restrictive firewall settings on your machine. Actually, reading your question again, that is probably your problem, since you are receiving no response rather that an error saying that nothing is listening on that port.

How to connect to laravel forge database via SSH tunnel using HeidiSQL

I'm trying to do the above. HeidiSQL has a load of settings and I have a load of possible values, but I'm not sure exactly what goes where. Here are the different places I can put values
Settings screen
SSH screen
And the values I have are as follows:
The IP address of the database (v)
The port the database uses (w)
The database username and password (x)
My ssh private key (y)
The port I'm going to use on my computer (z)
I've tried many combinations, but generally get the response:
PLink exited unexpected. Command line was: C:\Program Files\PuTTY\plink.exe -ssh [ip address] -P [database port] -i [private key location] -N -L [my port]:[id address]:[database port]
Thank you for your time.
I've now found the answer to this.
The information required was as follows and this is where it goes. Be really careful that you have actually put in all these values.
Settings:
Hostname (A2) - the name of this database It might be fine for this to be 127.0.0.1
User (A5) - Database username
Password (A6) - Database password
Port (A7) - The port the mySQL will be found at (e.g. 3306)
SSH:
SSH Host (B2) + Port (B3) - Your database IP and port number (ie 23.5.4.3 22)
Username (B4) - The username for your SSH login
Plink timeout (B6) - You may need to increase this (to perhaps 15)
Private key - Location of your private key file. Note that sometimes you might have a passphrase. If this is the case you'll probably have to use pageant which is downloaded with Putty
Local port - Which port you want your computer to use for SSH tunnel. eg 3306
These are some articles I found useful.
An article on similar topic
if you are stuck you could try and ssh in without heidi
Info about pageant
It seems the problem with Plink has been solved, can you give it a chance again?

ESXi 6.5 Refusing Connections on 2nd Management Interface

I need to remotely migrate the management interface on an ESXi 6.5 host. Ideally, I would create the new interface, confirm it works and then delete the old.
I have successfully created the new interface using these commands:
esxcli network ip netstack add -N VMManagement
esxcli network ip interface add -i vmk0 -M 00:50:56:67:89:10 -N VMManagement -p mgmt-vm
esxcli network ip interface ipv4 set -i vmk0 -P 1 -t dhcp
esxcli network ip interface tag add -i vmk0 -t Management
Here is the outputs of esxcli network ip interface ipv4 address list -i vmk0 -N VMManagement
Name IPv4 Address IPv4 Netmask IPv4 Broadcast Address Type
Gateway DHCP DNS
---- ------------ ------------- -------------- ------------ ----------- --------
vmk0 10.0.4.27 255.255.255.0 10.0.4.255 DHCP 10.0.4.1 true
I can ping vmk0 but it refuses ports 22 and 443. I am able to access ssh/https on the default management interface. I am testing from a host in 10.0.4.0/24 to eliminate routing/firewall variables.
I have tried completely disabling the ESXi firewall as well as running services.sh restart.
Any ideas?
I was able to make this work by putting both management interfaces in the default netstack. Initially, I didn't think a single netstack could handle multiple gateways, but this turned out not to be the case.
That said, if anyone does know how to get multiple management interfaces running on separate netstacks, please chime in, as that will be a better answer to this question.

Client-server in C and ethernet connection

I'm trying to develop a little client-server application in c. For that, I took a source code : http://www.iprelax.fr/outils/c_prog5.php
It's working in local without changing the ip address or the port. I tried with 2 computers (mac os and ubuntu). They are connected with an ethernet cable and we defined a static ip addresses 10.0.0.10 and 10.0.0.20 on this interface (eth0). In the client, we changed the line :
char *msg, *htoname = "127.0.0.1";
with the server ip address but it doesn't work, there is no error.
We tried to change the port number but still the same problem.
We saw anything with the netstat and netcat commands.
How to run the application between 2 computers ?
Thank you for your help
When going between two machines, generally a firewall blocks incoming connections i.e. your server machine should allow client to connect to itself.
If your server is on Ubuntu, you are using Linux IP tables. Either add a rule to allow the server port for incoming connections or disable IP tables entirely.
vi /etc/sysconfig/iptables
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 5800 -j ACCEPT
The answer to this question list it in detail
using ip tables on stack overflow

What can be the reasons of connection refused errors?

I'm trying to write a server program in C,
using another client, I get this error when I try to connect through port 2080 for example.
connection refused
What can be the reasons of this error?
There could be many reasons, but the most common are:
The port is not open on the destination machine.
The port is open on the destination machine, but its backlog of pending connections is full.
A firewall between the client and server is blocking access (also check local firewalls).
After checking for firewalls and that the port is open, use telnet to connect to the ip/port to test connectivity. This removes any potential issues from your application.
The error means the OS of the listening socket recognized the inbound connection request but chose to intentionally reject it.
Assuming an intermediate firewall is not getting in the way, there are only two reasons (that I know of) for the OS to reject an inbound connection request. One reason has already been mentioned several times - the listening port being connected to is not open.
There is another reason that has not been mentioned yet - the listening port is actually open and actively being used, but its backlog of queued inbound connection requests has reached its maximum so there is no room available for the inbound connection request to be queued at that moment. The server code has not called accept() enough times yet to finish clearing out available slots for new queue items.
Wait a moment or so and try the connection again. Unfortunately, there is no way to differentiate between "the port is not open at all" and "the port is open but too busy right now". They both use the same generic error code.
If you try to open a TCP connection to another host and see the error "Connection refused," it means that
You sent a TCP SYN packet to the other host.
Then you received a TCP RST packet in reply.
RST is a bit on the TCP packet which indicates that the connection should be reset. Usually it means that the other host has received your connection attempt and is actively refusing your TCP connection, but sometimes an intervening firewall may block your TCP SYN packet and send a TCP RST back to you.
See https://www.rfc-editor.org/rfc/rfc793 page 69:
SYN-RECEIVED STATE
If the RST bit is set
If this connection was initiated with a passive OPEN (i.e., came
from the LISTEN state), then return this connection to LISTEN state
and return. The user need not be informed. If this connection was
initiated with an active OPEN (i.e., came from SYN-SENT state) then
the connection was refused, signal the user "connection refused". In
either case, all segments on the retransmission queue should be
removed. And in the active OPEN case, enter the CLOSED state and
delete the TCB, and return.
Connection refused means that the port you are trying to connect to is not actually open.
So either you are connecting to the wrong IP address, or to the wrong port, or the server is listening on the wrong port, or is not actually running.
A common mistake is not specifying the port number when binding or connecting in network byte order...
Check at the server side that it is listening at the port 2080.
First try to confirm it on the server machine by issuing telnet to that port:
telnet localhost 2080
If it is listening, it is able to respond.
1.Check your server status.
2.Check the port status.
For example 3306 netstat -nupl|grep 3306.
3.Check your firewalls.
For example add 3306
vim /etc/sysconfig/iptables
# add
-A INPUT -p tcp -m state --state NEW -m tcp --dport 3306 -j ACCEPT
Although it does not seem to be the case for your situation, sometimes a connection refused error can also indicate that there is an ip address conflict on your network. You can search for possible ip conflicts by running:
arp-scan -I eth0 -l | grep <ipaddress>
and
arping <ipaddress>
This AskUbuntu question has some more information also.
I get the same problem with my work computer.
The problem is that when you enter localhost it goes to proxy's address not local address you should bypass it follow this steps
Chrome => Settings => Change proxy settings => LAN Settings => check Bypass proxy server for local addresses.
In Ubuntu, Try
sudo ufw allow <port_number>
to allow firewall access to both of your server and db.
From the standpoint of a Checkpoint firewall, you will see a message from the firewall if you actually choose Reject as an Action thereby exposing to a propective attacker the presence of a firewall in front of the server. The firewall will silently drop all connections that doesn't match the policy. Connection refused almost always comes from the server
In my case, it happens when the site is blocked in my country and I don't use VPN.
For example when I try to access vimeo.com from Indonesia which is blocked.
Check if your application is bind with the port where you are sending the request
Check if the application is accepting connections from the host you are sending the request, maybe you forgot to allow all the incoming connections 0.0.0.0 and by default, it's only allowing connections from 127.0.0.1
I had the same message with a totally different cause: the wsock32.dll was not found. The ::socket(PF_INET, SOCK_STREAM, 0); call kept returning an INVALID_SOCKET but the reason was that the winsock dll was not loaded.
In the end I launched Sysinternals' process monitor and noticed that it searched for the dll 'everywhere' but didn't find it.
Silent failures are great!

Resources