Restart Network Service on CentOS 8 or RHEL 8

This tutorial will help you to Start/Stop and Restart the network services on a CentOS 8 or RHEL 8 Linux system. Here are the two methods available. We prefer method 1 to use.

Method 1 – Using NetworkManager Service

Use the followings commands to start/stop network service on your CentOS/RHEL 8 Linux system.

sudo systemctl start NetworkManager.service
sudo systemctl stop NetworkManager.service

Use the followings commands to restart network service on your CentOS/RHEL 8 Linux system.

sudo systemctl restart NetworkManager.service

Method 2 – Using nmcli Tool

The nmcli is the command-line utility for the managing NetworkManager on CentOS/RHEL 8 Linux system. You can simply use this utility to stop/start network service on your CentOS 8 or RHEL 8 system.

WARNING – Do not run nmcli networking off for the remotely connected systems. This will disable the NetworkManager network connections on the machine and you will lose connection.

sudo nmcli networking off
sudo nmcli networking on

The above command will disable/enable the network connections on CentOS 8 or RHEL 8 Linux system.

Continue reading Restart Network Service on CentOS 8 or RHEL 8

Set up OpenVPN Server In 5 Minutes on Centos8 Linux

 am a new Ubuntu Linux server user. How do I setup an OpenVPN Server on Ubuntu Linux version 18.04/20.04 LTS or 20.10 server to shield my browsing activity from bad guys on public Wi-Fi, and more?

OpenVPN is a full-featured SSL VPN (virtual private network). It implements OSI layer 2 or 3 secure network extension using the SSL/TLS protocol. It is an open source software and distributed under the GNU GPL. A VPN allows you to connect securely to an insecure public network such as wifi network at the airport or hotel. VPN is also required to access your corporate or enterprise or home server resources. You can bypass geo-blocked site and increase your privacy or safety online. This tutorial provides step-by-step instructions for configuring an OpenVPN “road warrior” server on Ubuntu Linux 18.04/20.04 LTS (20.10) version including ufw/iptables firewall configuration. The steps are as follows:

1. Find and note down your public IP address
2. Download openvpn-install.sh script
3. Run openvpn-install.sh to install OpenVPN server

Find your public IP address:

Use any one of the following command to find out your IPv4 public address. If your internface name is eth0 or eth1, enter:
$ ip addr show eth0
OR
$ ip addr show eth1

OR
$ ip a

[root@radius ~]# ip a

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000

    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

    inet 127.0.0.1/8 scope host lo

       valid_lft forever preferred_lft forever

    inet6 ::1/128 scope host

       valid_lft forever preferred_lft forever

2: enp5s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000

    link/ether 74:56:3c:37:b4:2c brd ff:ff:ff:ff:ff:ff

    inet 192.168.33.6/24 brd 192.168.33.255 scope global noprefixroute enp5s0

       valid_lft forever preferred_lft forever

    inet 59.152.XXX.XXX/29 brd 59.152.107.151 scope global noprefixroute enp5s0

       valid_lft forever preferred_lft forever

    inet 192.168.33.7/24 brd 192.168.33.255 scope global secondary noprefixroute enp5s0

       valid_lft forever preferred_lft forever

3: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 100

    link/none

    inet 10.8.0.1/24 brd 10.8.0.255 scope global tun0

       valid_lft forever preferred_lft forever

    inet6 fe80::334f:6f01:66fc:20b6/64 scope link stable-privacy

       valid_lft forever preferred_lft forever

[root@radius ~]#

Note down the public IPv4 address

59.152.XXX.XXX/29

Download openvpn-install.sh script to set up OpenVPN server in 5 minutes on Ubuntu

Type the following wget command or curl command:
$ wget https://git.io/vpn -O openvpn-install.sh

wget grabbing the script:

[root@radius ~]# wget https://git.io/vpn -O openvpn-install.sh

--2024-01-03 06:04:21--  https://git.io/vpn

Resolving git.io (git.io)... 140.82.114.21

Connecting to git.io (git.io)|140.82.114.21|:443... connected.

HTTP request sent, awaiting response... 301 Moved Permanently

Location: https://raw.github.com/Nyr/openvpn-install/master/openvpn-install.sh [following]

--2024-01-03 06:04:23--  https://raw.github.com/Nyr/openvpn-install/master/openvpn-install.sh

Resolving raw.github.com (raw.github.com)... 185.199.108.133, 185.199.110.133, 185.199.111.133, ...

Connecting to raw.github.com (raw.github.com)|185.199.108.133|:443... connected.

HTTP request sent, awaiting response... 301 Moved Permanently

Location: https://raw.githubusercontent.com/Nyr/openvpn-install/master/openvpn-install.sh [following]

--2024-01-03 06:04:23--  https://raw.githubusercontent.com/Nyr/openvpn-install/master/openvpn-install.sh

Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 185.199.110.133, 185.199.109.133, 185.199.111.133, ...

Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|185.199.110.133|:443... connected.

HTTP request sent, awaiting response... 200 OK

Length: 23714 (23K) [text/plain]

Saving to: ‘openvpn-install.sh’

openvpn-install.sh                                          100%[========================================================================================================================================>]  23.16K  --.-KB/s    in 0.008s

2024-01-03 06:04:24 (2.69 MB/s) - ‘openvpn-install.sh’ saved [23714/23714]

[root@radius ~]#

We can verify script using a text editor such as nano command or vim command:
$ vi openvpn-install.sh

Running openvpn-install.sh to install OpenVPN server

Type the following command:
$ sudo chmod +x openvpn-install.sh
$ sudo bash openvpn-install.sh
Make sure you provide needed information:

[root@radius ~]# ./openvpn-install.sh

Welcome to this OpenVPN road warrior installer!

Which IPv4 address should be used?

     1) 192.168.33.6

     2) 59.152.107.147

     3) 192.168.33.7

IPv4 address [1]: 2

Which protocol should OpenVPN use?

   1) UDP (recommended)

   2) TCP

Protocol [1]: 1

What port should OpenVPN listen to?

Port [1194]: 1194

Select a DNS server for the clients:

   1) Current system resolvers

   2) Google

   3) 1.1.1.1

   4) OpenDNS

   5) Quad9

   6) AdGuard

DNS server [1]: 3

Enter a name for the first client:

Name [client]: nextgen

OpenVPN installation is ready to begin.

Press any key to continue...

Notice

------

'init-pki' complete; you may now create a CA or requests.

Your newly created PKI dir is:

* /etc/openvpn/server/easy-rsa/pki

Using Easy-RSA configuration:

* undefined

No Easy-RSA 'vars' configuration file exists!

Using SSL:

* openssl OpenSSL 1.1.1k  FIPS 25 Mar 2021

.................................+++++

..........+++++

Notice

------

CA creation complete. Your new CA certificate is at:

* /etc/openvpn/server/easy-rsa/pki/ca.crt

No Easy-RSA 'vars' configuration file exists!

Using SSL:

* openssl OpenSSL 1.1.1k  FIPS 25 Mar 2021

Generating a RSA private key

.......................+++++

.....................................................................................................................+++++

writing new private key to '/etc/openvpn/server/easy-rsa/pki/44ea2e7f/temp.1.1'

-----

Notice

------

Private-Key and Public-Certificate-Request files created.

Your files are:

* req: /etc/openvpn/server/easy-rsa/pki/reqs/server.req

* key: /etc/openvpn/server/easy-rsa/pki/private/server.key

Using configuration from /etc/openvpn/server/easy-rsa/pki/openssl-easyrsa.cnf

Check that the request matches the signature

Signature ok

The Subject's Distinguished Name is as follows

commonName            :ASN.1 12:'server'

Certificate is to be certified until Dec 31 11:06:09 2033 GMT (3650 days)

Write out database with 1 new entries

Data Base Updated

Notice

------

Certificate created at:

* /etc/openvpn/server/easy-rsa/pki/issued/server.crt

Notice

------

Inline file created:

* /etc/openvpn/server/easy-rsa/pki/inline/server.inline

No Easy-RSA 'vars' configuration file exists!

Using SSL:

* openssl OpenSSL 1.1.1k  FIPS 25 Mar 2021

Generating a RSA private key

..............................................................................................................+++++

.....................+++++

writing new private key to '/etc/openvpn/server/easy-rsa/pki/7b06327f/temp.1.1'

-----

Notice

------

Private-Key and Public-Certificate-Request files created.

Your files are:

* req: /etc/openvpn/server/easy-rsa/pki/reqs/nextgen.req

* key: /etc/openvpn/server/easy-rsa/pki/private/nextgen.key

Using configuration from /etc/openvpn/server/easy-rsa/pki/openssl-easyrsa.cnf

Check that the request matches the signature

Signature ok

The Subject's Distinguished Name is as follows

commonName            :ASN.1 12:'nextgen'

Certificate is to be certified until Dec 31 11:06:10 2033 GMT (3650 days)

Write out database with 1 new entries

Data Base Updated

Notice

------

Certificate created at:

* /etc/openvpn/server/easy-rsa/pki/issued/nextgen.crt

Notice

------

Inline file created:

* /etc/openvpn/server/easy-rsa/pki/inline/nextgen.inline

No Easy-RSA 'vars' configuration file exists!

Using SSL:

* openssl OpenSSL 1.1.1k  FIPS 25 Mar 2021

Using configuration from /etc/openvpn/server/easy-rsa/pki/openssl-easyrsa.cnf

Notice

------

An updated CRL has been created:

* /etc/openvpn/server/easy-rsa/pki/crl.pem

Created symlink /etc/systemd/system/multi-user.target.wants/openvpn-iptables.service → /etc/systemd/system/openvpn-iptables.service.

Created symlink /etc/systemd/system/multi-user.target.wants/openvpn-server@server.service → /usr/lib/systemd/system/openvpn-server@.service.

Finished!

The client configuration is available in: /root/nextgen.ovpn

New clients can be added by running this script again.

[root@radius ~]#

 

Start/stop/restart OpenVPN server on Centos 8

Run the following systemctl command to stop the OpenVPN service:
$ sudo systemctl stop openvpn-server@server.service
Want to start it again? Try:
$ sudo systemctl start openvpn-server@server.service
The command to restart the OpenVPN service:
$ sudo systemctl restart openvpn-server@server.service
View status of your OpenVPN systemd based service:
$ sudo systemctl status openvpn-server@server.service

● openvpn-server@server.service - OpenVPN service for server
   Loaded: loaded (/usr/lib/systemd/system/openvpn-server@.service; enabled; vendor preset: disabled)
   Active: active (running) since Wed 2024-01-03 06:06:10 EST; 25min ago
     Docs: man:openvpn(8)
           https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
           https://community.openvpn.net/openvpn/wiki/HOWTO
 Main PID: 16020 (openvpn)
   Status: "Initialization Sequence Completed"
    Tasks: 1 (limit: 47953)
   Memory: 1.2M
   CGroup: /system.slice/system-openvpn\x2dserver.slice/openvpn-server@server.service
           └─16020 /usr/sbin/openvpn --status /run/openvpn-server/status-server.log --status-version 2 --suppress-timestamps --cipher AES-256-GCM --ncp-ciphers AES-256-GCM:AES-128-GCM:AES-256-CBC:AES-128-CBC:BF-CBC --config server.conf

Jan 03 06:07:55 radius.zoomonline.com.bd openvpn[16020]: 59.152.105.235:64346 WARNING: 'keysize' is used inconsistently, local='keysize 256', remote='keysize 128'
Jan 03 06:07:55 radius.zoomonline.com.bd openvpn[16020]: 59.152.105.235:64346 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
Jan 03 06:07:55 radius.zoomonline.com.bd openvpn[16020]: 59.152.105.235:64346 [nextgen] Peer Connection Initiated with [AF_INET]59.152.105.235:64346
Jan 03 06:07:55 radius.zoomonline.com.bd openvpn[16020]: nextgen/59.152.105.235:64346 MULTI_sva: pool returned IPv4=10.8.0.2, IPv6=(Not enabled)
Jan 03 06:07:55 radius.zoomonline.com.bd openvpn[16020]: nextgen/59.152.105.235:64346 MULTI: Learn: 10.8.0.2 -> nextgen/59.152.105.235:64346
Jan 03 06:07:55 radius.zoomonline.com.bd openvpn[16020]: nextgen/59.152.105.235:64346 MULTI: primary virtual IP for nextgen/59.152.105.235:64346: 10.8.0.2
Jan 03 06:07:55 radius.zoomonline.com.bd openvpn[16020]: nextgen/59.152.105.235:64346 PUSH: Received control message: 'PUSH_REQUEST'
Jan 03 06:07:55 radius.zoomonline.com.bd openvpn[16020]: nextgen/59.152.105.235:64346 SENT CONTROL [nextgen]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 1.1.1.1,dhcp-option DNS 1.0.0.1,block-outside-dns,route-gateway >
Jan 03 06:07:55 radius.zoomonline.com.bd openvpn[16020]: nextgen/59.152.105.235:64346 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Jan 03 06:07:55 radius.zoomonline.com.bd openvpn[16020]: nextgen/59.152.105.235:64346 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key

Conclusion

And there you have it, OpenVPN server installed in five minutes to increase your privacy. Please see OpenVPN project and road warrior installer Linux script.

Continue reading Set up OpenVPN Server In 5 Minutes on Centos8 Linux

WAY TO VIEW WIREGUARD LOGS

 

IPTABLES

Similar to tcpdump, the LOG target of iptables allows you to log each packet that’s sent to and from WireGuard. Most Linux systems use iptables, or its newer sibling nftables, to define their firewall.

If you’re using iptables, you can run the following commands to add iptables rules that will log the header info of IPv4 packets carrying WireGuard encrypted content (where 51820 is the ListenPort in your WireGuard config):

# iptables -I INPUT -p udp --dport 51820 -j LOG --log-prefix 'wireguard iptables: ' --log-level 7
# iptables -I OUTPUT -p udp --sport 51820 -j LOG --log-prefix 'wireguard iptables: ' --log-level 7

If you’re using IPv6 networking, replace iptables with ip6tables; or if you’re using both IPv4 and IPv6, run both variants.

Once you do that, you’ll be able to see WireGuard packets logged to the kernel message buffer. If your system is set up with rsyslogd, journald, or a similar logging daemon, you can use it to see this logging. With rsyslogd, check the /var/log/kern.log or /var/log/messages file. With journald, run journalctl -ek.

To capture this logging to its own file, you can “tail” these messages via the dmesg command’s -w (follow) flag:

# touch /var/log/wireguard-iptables.log
# dmesg -wT | grep 'wireguard iptables:' >> /var/log/wireguard-iptables.log

This will allow you to track the remote IP addresses that are connecting to your local WireGuard interface. A WireGuard handshake and short encrypted HTTP request and response will look like this:

[Sat Mar  6 20:45:15 2021] wireguard iptables: IN=eth0 OUT= MAC=06:24:d3:09:8d:9b:06:01:1a:2a:77:f7:08:00 SRC=203.0.113.2 DST=198.51.100.1 LEN=176 TOS=0x08 PREC=0x80 TTL=64 ID=39062 PROTO=UDP SPT=51820 DPT=51820 LEN=156
[Sat Mar  6 20:45:15 2021] wireguard iptables: IN= OUT=eth0 SRC=198.51.100.1 DST=203.0.113.2 LEN=120 TOS=0x08 PREC=0x80 TTL=64 ID=48534 PROTO=UDP SPT=51820 DPT=51820 LEN=100
[Sat Mar  6 20:45:15 2021] wireguard iptables: IN=eth0 OUT= MAC=06:24:d3:09:8d:9b:06:01:1a:2a:77:f7:08:00 SRC=203.0.113.2 DST=198.51.100.1 LEN=124 TOS=0x00 PREC=0x00 TTL=64 ID=39063 PROTO=UDP SPT=51820 DPT=51820 LEN=104
[Sat Mar  6 20:45:15 2021] wireguard iptables: IN= OUT=eth0 SRC=198.51.100.1 DST=203.0.113.2 LEN=124 TOS=0x00 PREC=0x00 TTL=64 ID=48535 PROTO=UDP SPT=51820 DPT=51820 LEN=104
[Sat Mar  6 20:45:15 2021] wireguard iptables: IN=eth0 OUT= MAC=06:24:d3:09:8d:9b:06:01:1a:2a:77:f7:08:00 SRC=203.0.113.2 DST=198.51.100.1 LEN=124 TOS=0x00 PREC=0x00 TTL=64 ID=39064 PROTO=UDP SPT=51820 DPT=51820 LEN=104
[Sat Mar  6 20:45:15 2021] wireguard iptables: IN=eth0 OUT= MAC=06:24:d3:09:8d:9b:06:01:1a:2a:77:f7:08:00 SRC=203.0.113.2 DST=198.51.100.1 LEN=204 TOS=0x00 PREC=0x00 TTL=64 ID=39065 PROTO=UDP SPT=51820 DPT=51820 LEN=184
[Sat Mar  6 20:45:15 2021] wireguard iptables: IN= OUT=eth0 SRC=198.51.100.1 DST=203.0.113.2 LEN=124 TOS=0x00 PREC=0x00 TTL=64 ID=48536 PROTO=UDP SPT=51820 DPT=51820 LEN=104
[Sat Mar  6 20:45:15 2021] wireguard iptables: IN= OUT=eth0 SRC=198.51.100.1 DST=203.0.113.2 LEN=268 TOS=0x00 PREC=0x00 TTL=64 ID=48537 PROTO=UDP SPT=51820 DPT=51820 LEN=248
[Sat Mar  6 20:45:15 2021] wireguard iptables: IN= OUT=eth0 SRC=198.51.100.1 DST=203.0.113.2 LEN=412 TOS=0x00 PREC=0x00 TTL=64 ID=48538 PROTO=UDP SPT=51820 DPT=51820 LEN=392
[Sat Mar  6 20:45:15 2021] wireguard iptables: IN=eth0 OUT= MAC=06:24:d3:09:8d:9b:06:01:1a:2a:77:f7:08:00 SRC=203.0.113.2 DST=198.51.100.1 LEN=124 TOS=0x00 PREC=0x00 TTL=64 ID=39066 PROTO=UDP SPT=51820 DPT=51820 LEN=104
[Sat Mar  6 20:45:15 2021] wireguard iptables: IN=eth0 OUT= MAC=06:24:d3:09:8d:9b:06:01:1a:2a:77:f7:08:00 SRC=203.0.113.2 DST=198.51.100.1 LEN=124 TOS=0x00 PREC=0x00 TTL=64 ID=39067 PROTO=UDP SPT=51820 DPT=51820 LEN=104
[Sat Mar  6 20:45:15 2021] wireguard iptables: IN= OUT=eth0 SRC=198.51.100.1 DST=203.0.113.2 LEN=124 TOS=0x00 PREC=0x00 TTL=64 ID=48539 PROTO=UDP SPT=51820 DPT=51820 LEN=104
[Sat Mar  6 20:45:25 2021] wireguard iptables: IN=eth0 OUT= MAC=06:24:d3:09:8d:9b:06:01:1a:2a:77:f7:08:00 SRC=203.0.113.2 DST=198.51.100.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=39108 PROTO=UDP SPT=51820 DPT=51820 LEN=40

In the above output, 198.51.100.1 is the IP address of the ethernet interface on the local host, and 203.0.113.2 is the IP address of the remote WireGuard endpoint (the remote endpoint is also listening on port 51820, but the above iptables rules would capture similar output even if the remote endpoint was on some other port).

You can also use iptables to log the packets that are sent inside the WireGuard tunnel. Run the following commands to log packet headers sent through the tunnel to and from the system itself (where wg0 is the name of your WireGuard interface):

# iptables -I INPUT -i wg0 -j LOG --log-prefix 'tunnel wireguard iptables: ' --log-level 7
# iptables -I OUTPUT -o wg0 -j LOG --log-prefix 'tunnel wireguard iptables: ' --log-level 7

And run the following commands to log packer headers sent through the tunnel to and from other hosts (if the system is operating as a router for other hosts on its network):

# iptables -I FORWARD -i wg0 -j LOG --log-prefix 'tunnel wireguard iptables: ' --log-level 7
# iptables -I FORWARD -o wg0 -j LOG --log-prefix 'tunnel wireguard iptables: ' --log-level 7

This will allow you to track exactly what is being sent through your WireGuard virtual private network. The short HTTP request and response from above will look like this when logging the packets within the tunnel:

[Sat Mar  6 20:45:15 2021] tunnel wireguard iptables: IN=wg0 OUT= MAC= SRC=10.0.0.2 DST=10.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=25937 DF PROTO=TCP SPT=34770 DPT=8080 WINDOW=62167 RES=0x00 SYN URGP=0
[Sat Mar  6 20:45:15 2021] tunnel wireguard iptables: IN= OUT=wg0 SRC=10.0.0.1 DST=10.0.0.2 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=TCP SPT=8080 DPT=34770 WINDOW=62083 RES=0x00 ACK SYN URGP=0
[Sat Mar  6 20:45:15 2021] tunnel wireguard iptables: IN=wg0 OUT= MAC= SRC=10.0.0.2 DST=10.0.0.1 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=25938 DF PROTO=TCP SPT=34770 DPT=8080 WINDOW=972 RES=0x00 ACK URGP=0
[Sat Mar  6 20:45:15 2021] tunnel wireguard iptables: IN=wg0 OUT= MAC= SRC=10.0.0.2 DST=10.0.0.1 LEN=129 TOS=0x00 PREC=0x00 TTL=64 ID=25939 DF PROTO=TCP SPT=34770 DPT=8080 WINDOW=972 RES=0x00 ACK PSH URGP=0
[Sat Mar  6 20:45:15 2021] tunnel wireguard iptables: IN= OUT=wg0 SRC=10.0.0.1 DST=10.0.0.2 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=2583 DF PROTO=TCP SPT=8080 DPT=34770 WINDOW=969 RES=0x00 ACK URGP=0
[Sat Mar  6 20:45:15 2021] tunnel wireguard iptables: IN= OUT=wg0 SRC=10.0.0.1 DST=10.0.0.2 LEN=206 TOS=0x00 PREC=0x00 TTL=64 ID=2584 DF PROTO=TCP SPT=8080 DPT=34770 WINDOW=969 RES=0x00 ACK PSH URGP=0
[Sat Mar  6 20:45:15 2021] tunnel wireguard iptables: IN= OUT=wg0 SRC=10.0.0.1 DST=10.0.0.2 LEN=349 TOS=0x00 PREC=0x00 TTL=64 ID=2585 DF PROTO=TCP SPT=8080 DPT=34770 WINDOW=969 RES=0x00 ACK PSH FIN URGP=0
[Sat Mar  6 20:45:15 2021] tunnel wireguard iptables: IN=wg0 OUT= MAC= SRC=10.0.0.2 DST=10.0.0.1 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=25940 DF PROTO=TCP SPT=34770 DPT=8080 WINDOW=970 RES=0x00 ACK URGP=0
[Sat Mar  6 20:45:15 2021] tunnel wireguard iptables: IN=wg0 OUT= MAC= SRC=10.0.0.2 DST=10.0.0.1 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=25941 DF PROTO=TCP SPT=34770 DPT=8080 WINDOW=966 RES=0x00 ACK FIN URGP=0
[Sat Mar  6 20:45:15 2021] tunnel wireguard iptables: IN= OUT=wg0 SRC=10.0.0.1 DST=10.0.0.2 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=2586 DF PROTO=TCP SPT=8080 DPT=34770 WINDOW=969 RES=0x00 ACK URGP=0

In the above output, the IP address of local WireGuard interface is 10.0.0.1, and the IP address of the remote WireGuard peer is 10.0.0.2. An HTTP server is running on port 8080 of the local host, which the remote host is connecting to through the WireGuard tunnel (using the ephemeral TCP port 34770 inside the tunnel).

You can use the iptables logging on UDP port 51820 (the first example) to keep track of the external IP addresses that are connecting to your WireGuard network; and the iptables logging on the wg0 interface (the last example) to track which peers are using your network (and what they’re accessing inside the network).

You can remove iptables rules by running the same command you used to add them, except replacing the -I flag (or the -A flag for appended rules) with the -D flag. For example, you can remove the last two rules added above by running the following commands:

# iptables -D FORWARD -i wg0 -j LOG --log-prefix 'tunnel wireguard iptables: ' --log-level 7
# iptables -D FORWARD -o wg0 -j LOG --log-prefix 'tunnel wireguard iptables: ' --log-level 7

To check for active rules that you may want to remove, run iptables-save (iptables-save doesn’t actually save anything, it just dumps all active rules in a format that can be saved and restored).

Continue reading WAY TO VIEW WIREGUARD LOGS

How to install PHP 8 on CentOS 8 Linux

 This tutorial will explain how to install PHP 8 on CentOS 8 Linux and its dependent packages.

Step 1: Enableremi-release-8.rpm

Configure the Remi repository for installing PHP 8 on CentOS 8

# dnf install https://rpms.remirepo.net/enterprise/remi-release-8.rpm

Step 2: Enable EPEL repository

# dnf install epel-release

Step 3: Find the current enabled version of PHP

# dnf module list php
CentOS Stream 8 - AppStream
Name Stream Profiles Summary
php 7.2 [d] common [d], devel, minimal PHP scripting language
php 7.3 common [d], devel, minimal PHP scripting language
php 7.4 common [d], devel, minimal PHP scripting language
php 8.0 common [d], devel, minimal PHP scripting language

Remi's Modular repository for Enterprise Linux 8 - x86_64
Name Stream Profiles Summary
php remi-7.2 common [d], devel, minimal PHP scripting language
php remi-7.3 common [d], devel, minimal PHP scripting language
php remi-7.4 common [d], devel, minimal PHP scripting language
php remi-8.0 common [d], devel, minimal PHP scripting language
php remi-8.1 common [d], devel, minimal PHP scripting language

Hint: [d]efault, [e]nabled, [x]disabled, [i]nstalled

Step 4: Enable the module PHP8.1 from remi

From the above output, by default PHP 7.2 from the AppStream repo shall be installed and no other version is enabled. To install PHP 8.1 from the remi repo, enable it before installation.

# dnf module enable php:remi-8.1

# dnf module list php
CentOS Stream 8 - AppStream
Name Stream Profiles Summary
php 7.2 [d] common [d], devel, minimal PHP scripting language
php 7.3 common [d], devel, minimal PHP scripting language
php 7.4 common [d], devel, minimal PHP scripting language
php 8.0 common [d], devel, minimal PHP scripting language

Remi's Modular repository for Enterprise Linux 8 - x86_64
Name Stream Profiles Summary
php remi-7.2 common [d], devel, minimal PHP scripting language
php remi-7.3 common [d], devel, minimal PHP scripting language
php remi-7.4 common [d], devel, minimal PHP scripting language
php remi-8.0 common [d], devel, minimal PHP scripting language
php remi-8.1 [e] common [d], devel, minimal PHP scripting language

Switch to the other version?

In case, if you need to install any other version, you can reset the current module enabled and set the new using the below commands:

# dnf module reset php

# dnf module enable php:remi-8.0

Step 5: Install PHP 8 on CentOS 8

# dnf install php

Last metadata expiration check: 0:13:44 ago on Wed 16 Feb 2022 11:53:53 AM IST.
Dependencies resolved.
=============================================================================================================================================================================================================================================
Package Architecture Version Repository Size
=============================================================================================================================================================================================================================================
Installing:
php x86_64 8.1.2-1.el8.remi remi-modular 1.7 M
Installing dependencies:
apr x86_64 1.6.3-12.el8 appstream 129 k
apr-util x86_64 1.6.1-6.el8 appstream 105 k
centos-logos-httpd noarch 85.8-2.el8 baseos 75 k
httpd x86_64 2.4.37-43.module_el8.5.0+1022+b541f3b1 appstream 1.4 M
httpd-filesystem noarch 2.4.37-43.module_el8.5.0+1022+b541f3b1 appstream 39 k
httpd-tools x86_64 2.4.37-43.module_el8.5.0+1022+b541f3b1 appstream 107 k
libsodium x86_64 1.0.18-2.el8 epel 162 k
libxslt x86_64 1.1.32-6.el8 baseos 250 k
mailcap noarch 2.1.48-3.el8 baseos 39 k
mod_http2 x86_64 1.15.7-3.module_el8.4.0+778+c970deab appstream 154 k
oniguruma5php x86_64 6.9.7.1-1.el8.remi remi-safe 210 k
php-common x86_64 8.1.2-1.el8.remi remi-modular 1.2 M
Installing weak dependencies:
apr-util-bdb x86_64 1.6.1-6.el8 appstream 25 k
apr-util-openssl x86_64 1.6.1-6.el8 appstream 27 k
nginx-filesystem noarch 1:1.14.1-9.module_el8.0.0+184+e34fea82 appstream 24 k
php-cli x86_64 8.1.2-1.el8.remi remi-modular 5.3 M
php-fpm x86_64 8.1.2-1.el8.remi remi-modular 1.8 M
php-mbstring x86_64 8.1.2-1.el8.remi remi-modular 522 k
php-opcache x86_64 8.1.2-1.el8.remi remi-modular 628 k
php-pdo x86_64 8.1.2-1.el8.remi remi-modular 160 k
php-sodium x86_64 8.1.2-1.el8.remi remi-modular 100 k
php-xml x86_64 8.1.2-1.el8.remi remi-modular 250 k
Enabling module streams:
httpd 2.4
nginx 1.14

Transaction Summary
=============================================================================================================================================================================================================================================
Install 23 Packages

Step 6: Verify the PHP installation

# php -v
PHP 8.1.2 (cli) (built: Jan 18 2022 23:52:03) (NTS gcc x86_64)
Copyright (c) The PHP Group
Zend Engine v4.1.2, Copyright (c) Zend Technologies
with Zend OPcache v8.1.2, Copyright (c), by Zend Technologies

Enjoy and comment if any issue arrised...

Continue reading How to install PHP 8 on CentOS 8 Linux

CentOS 8 Set Up OpenVPN Server In 5 Minutes

 The steps are as follows:

Please note that {root@centos8:~ }$ is my shell prompt and is not part of actual commands. In other words, you need to copy and paste command after my shell prompt.

Step 1 – Update your system

Run the dnf command or yum command to install CentOS 8 security updates:
{root@centos8:~ }$ sudo dnf updateOR
{root@centos8:~ }$ sudo yum update
Next, install tar on CentOS and also install wget on CentOS 8
{root@centos8:~ }$ sudo yum install tar wget

Step 2 – Find and note down your server’s IPv4 or IPv6 address

Use the ip command as follows:
{root@centos8:~ }$ ip a{root@centos8:~ }$ ip a show eth0

We can try the following dig command/host command to find out your public IP address from Linux command line:
{root@centos8:~ }$ dig +short myip.opendns.com @resolver1.opendns.comOR
{root@centos8:~ }$ dig -4 TXT +short o-o.myaddr.l.google.com @ns1.google.com | awk -F'"' '{ print $2 }'
Sample outputs:

172.105.120.133

Please note down 172.105.120.133 IP address. You need to replace this one with your actual IPv4.

A note about your IPv4 and IPv6 address

Most cloud servers have two types of IP address:

1. Public static IP address directly assigned to your box and routed from the Internet. For example, Linode, Digital Ocean, and others give you direct public IPv4/IPv6 address.
2. Private static IP address directly attached to your server and your server is behind NAT with public IP address. For example, AWS EC2/Lightsail, Google Cloud and others provide you this kind of NAT public IP address.

The script will automatically detect your networking setup. All you have to do is provide a correct IPv4 or IPv6 address when asked for it. Hence, we used the above command to determine our IP address in advance.

Step 3 – Download and run centos-8-vpn.sh script

I am going to use the wget command:
{root@centos8:~ }$ wget https://raw.githubusercontent.com/Angristan/openvpn-install/master/openvpn-install.sh -O centos-8-vpn.sh
Make sure you set up permissions using the chmod command:
{root@centos8:~ }$ chmod +x centos-8-vpn.sh
One can view the script using a text editor such as vim/vi too :
{root@centos8:~ }$ vim centos-8-vpn.sh

Installing OpenVPN server on CentOS 8 Linux using the centos-8-vpn.sh

Now all you have to do is run shell script on Linux:
{root@centos8:~ }$ sudo ./centos-8-vpn.sh
Sample session from my Linode cloud server with direct public IPv4 address:

Sample session from AWS/Lightsail where my cloud server is behind NAT:

Desktop or Mobile client configuration

When VPN server configuration done, we can create a desktop/mobile client VPN configuration file. You will be prompted as follows:

Do you want to protect the VPN configuration file with a password?

How do I start/stop/restart OpenVPN server on CentOS 8 ?

#--- Stop the server ---#
{root@centos8:~ }$ sudo systemctl stop openvpn-server@server.service
#--- Start the server ---#
{root@centos8:~ }$ sudo systemctl start openvpn-server@server.service
#--- Restart the server ---#
{root@centos8:~ }$ sudo systemctl restart openvpn-server@server.service
#--- Get the server status ---#
{root@centos8:~ }$ sudo systemctl status openvpn-server@server.service

Step 4 – Connect an OpenVPN server using IOS/Android/Linux/MS-Windows client

On server your will find a client configuration file called ~/DesktopVPNClient.ovpn. All you have to do is copy this file to your local desktop using the scp command:
{root@centos8:~ }$ scp vivek@172.105.120.136:~/DesktopVPNClient.ovpn .
Next, provide this file to your OpenVPN client for connection purposes:

1. Download Apple iOS client from Apple App store
2. Grab Android client from Google Play store
3. Apple MacOS (OS X) client
4. Microsoft Windows 8/10 client

OpenVPN Linux desktop client configuration

First, install the openvpn client for your desktop, enter:
{root@centos8-client:~ }$ sudo yum install openvpn
For Debian/Ubuntu Linux try the apt command/apt-get command:
{root@debian-client:~ }$ sudo apt install openvpn
Next, copy DesktopVPNClient.ovpn as follows:
{root@centos8-client:~ }$ sudo cp DesktopVPNClient.ovpn /etc/openvpn/client.conf
Test connectivity from the CLI:
{root@centos8-client:~ }$ sudo openvpn --client --config /etc/openvpn/desktop.conf
Our Linux desktop system will automatically connect when computer restart using openvpn script/service:
{root@centos8-client:~ }$ sudo systemctl start openvpn@client

Step 5 – Verify/test the connectivity

Execute the following commands after connecting to OpenVPN server from your Linux desktop client:
#Ping to the OpenVPN server gateway
{root@centos8-client:~ }$ ping 10.8.0.1
#Make sure routing setup working
{root@centos8-client:~ }$ ip route
#Must return public IP address of OpenVPN server
{root@centos8-client:~ }$ dig TXT +short o-o.myaddr.l.google.com @ns1.google.com

Step 6 – How to add or remove OpenVPN client

Log in to your CentOS 8 Linux server and run the script again:
{v@centos8:~ }$ sudo ./centos-8-vpn.sh
You will see option as follows:

Welcome to OpenVPN-install!
The git repository is available at: https://github.com/angristan/openvpn-install

It looks like OpenVPN is already installed.

What do you want to do?
   1) Add a new user
   2) Revoke existing user
   3) Remove OpenVPN
   4) Exit
Select an option [1-4]: 

Choose an option as per your needs.

Continue reading CentOS 8 Set Up OpenVPN Server In 5 Minutes