<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
		>
<channel>
	<title>Comments on: Allow limited user account to add routes</title>
	<atom:link href="http://itknowledgeexchange.techtarget.com/itanswers/allow-limited-user-account-to-add-routes/feed/" rel="self" type="application/rss+xml" />
	<link>http://itknowledgeexchange.techtarget.com/itanswers/allow-limited-user-account-to-add-routes/</link>
	<description></description>
	<lastBuildDate>Wed, 19 Jun 2013 18:52:24 +0000</lastBuildDate>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	
	<item>
		<title>By: veazer</title>
		<link>http://itknowledgeexchange.techtarget.com/itanswers/allow-limited-user-account-to-add-routes/#comment-71090</link>
		<dc:creator>veazer</dc:creator>
		<pubDate>Wed, 02 Dec 2009 04:22:30 +0000</pubDate>
		<guid isPermaLink="false">#comment-71090</guid>
		<description><![CDATA[No, the routes are created by the openvpn service after all credentials and what not have been passed successfully. Here&#039;s a log to UltraVPN (free service) using an admin account:

Difference shown in bold.

OpenVPN 2.1_rc18 i686-pc-mingw32 [SSL] [LZO2] [PKCS11] built on Jun  7 2009
WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
NOTE: OpenVPN 2.1 requires &#039;--script-security 2&#039; or higher to call user-defined scripts or executables
LZO compression initialized
Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Local Options hash (VER=V4): &#039;69109d17&#039;
Expected Remote Options hash (VER=V4): &#039;c0103fa8&#039;
Attempting to establish TCP connection with 87.98.164.142:443
TCP connection established with 87.98.164.142:443
Socket Buffers: R=[8192-&gt;8192] S=[8192-&gt;8192]
TCPv4_CLIENT link local: [undef]
TCPv4_CLIENT link remote: 87.98.164.142:443
TLS: Initial packet from 87.98.164.142:443, sid=17e6c66f d7510814
WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
VERIFY OK: depth=1, /C=FR/ST=NA/L=BISHKEK/O=OpenVPN-TEST/CN=ludwig/emailAddress=me@myhost.mydomain
VERIFY OK: depth=0, /C=FR/ST=NA/O=OpenVPN-TEST/CN=ludwig/emailAddress=me@myhost.mydomain
Data Channel Encrypt: Cipher &#039;BF-CBC&#039; initialized with 128 bit key
Data Channel Encrypt: Using 160 bit message hash &#039;SHA1&#039; for HMAC authentication
Data Channel Decrypt: Cipher &#039;BF-CBC&#039; initialized with 128 bit key
Data Channel Decrypt: Using 160 bit message hash &#039;SHA1&#039; for HMAC authentication
Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
[ludwig] Peer Connection Initiated with 87.98.164.142:443
SENT CONTROL [ludwig]: &#039;PUSH_REQUEST&#039; (status=1)
PUSH: Received control message: &#039;PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route 10.7.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.7.230.138 10.7.230.137&#039;
OPTIONS IMPORT: timers and/or timeouts modified
OPTIONS IMPORT: --ifconfig/up options modified
OPTIONS IMPORT: route options modified
OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
ROUTE default_gateway=10.121.232.1
TAP-WIN32 device [OpenVPN] opened: \.Global{4B38798E-297E-4477-8ED0-07D3A2D17280}.tap
TAP-Win32 Driver Version 9.4 
TAP-Win32 MTU=1500
Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.7.230.138/255.255.255.252 on interface {4B38798E-297E-4477-8ED0-07D3A2D17280} [DHCP-serv: 10.7.230.137, lease-time: 31536000]
&lt;b&gt;Successful ARP Flush on interface [3] {4B38798E-297E-4477-8ED0-07D3A2D17280}
&lt;/b&gt;TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
C:WINDOWSsystem32route.exe ADD 87.98.164.142 MASK 255.255.255.255 10.121.232.1
&lt;b&gt;Route addition via IPAPI succeeded [adaptive]
&lt;/b&gt;C:WINDOWSsystem32route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.7.230.137
&lt;b&gt;Route addition via IPAPI succeeded [adaptive]
&lt;/b&gt;C:WINDOWSsystem32route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.7.230.137
&lt;b&gt;Route addition via IPAPI succeeded [adaptive]
&lt;/b&gt;C:WINDOWSsystem32route.exe ADD 10.7.0.1 MASK 255.255.255.255 10.7.230.137
&lt;b&gt;Route addition via IPAPI succeeded [adaptive]
&lt;/b&gt;Initialization Sequence Completed

And again as a limited user:
OpenVPN 2.1_rc18 i686-pc-mingw32 [SSL] [LZO2] [PKCS11] built on Jun  7 2009
WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
NOTE: OpenVPN 2.1 requires &#039;--script-security 2&#039; or higher to call user-defined scripts or executables
LZO compression initialized
Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Local Options hash (VER=V4): &#039;69109d17&#039;
Expected Remote Options hash (VER=V4): &#039;c0103fa8&#039;
Attempting to establish TCP connection with 87.98.164.142:443
TCP connection established with 87.98.164.142:443
Socket Buffers: R=[8192-&gt;8192] S=[8192-&gt;8192]
TCPv4_CLIENT link local: [undef]
TCPv4_CLIENT link remote: 87.98.164.142:443
TLS: Initial packet from 87.98.164.142:443, sid=10c2ba52 88d2f821
WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
VERIFY OK: depth=1, /C=FR/ST=NA/L=BISHKEK/O=OpenVPN-TEST/CN=ludwig/emailAddress=me@myhost.mydomain
VERIFY OK: depth=0, /C=FR/ST=NA/O=OpenVPN-TEST/CN=ludwig/emailAddress=me@myhost.mydomain
Data Channel Encrypt: Cipher &#039;BF-CBC&#039; initialized with 128 bit key
Data Channel Encrypt: Using 160 bit message hash &#039;SHA1&#039; for HMAC authentication
Data Channel Decrypt: Cipher &#039;BF-CBC&#039; initialized with 128 bit key
Data Channel Decrypt: Using 160 bit message hash &#039;SHA1&#039; for HMAC authentication
Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
[ludwig] Peer Connection Initiated with 87.98.164.142:443
SENT CONTROL [ludwig]: &#039;PUSH_REQUEST&#039; (status=1)
PUSH: Received control message: &#039;PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route 10.7.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.7.230.138 10.7.230.137&#039;
OPTIONS IMPORT: timers and/or timeouts modified
OPTIONS IMPORT: --ifconfig/up options modified
OPTIONS IMPORT: route options modified
OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
ROUTE default_gateway=10.121.232.1
TAP-WIN32 device [OpenVPN] opened: \.Global{4B38798E-297E-4477-8ED0-07D3A2D17280}.tap
TAP-Win32 Driver Version 9.4 
TAP-Win32 MTU=1500
Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.7.230.138/255.255.255.252 on interface {4B38798E-297E-4477-8ED0-07D3A2D17280} [DHCP-serv: 10.7.230.137, lease-time: 31536000]
&lt;b&gt;NOTE: FlushIpNetTable failed on interface [3] {4B38798E-297E-4477-8ED0-07D3A2D17280} (status=6) : The handle is invalid.  
&lt;/b&gt;TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
C:WINDOWSsystem32route.exe ADD 87.98.164.142 MASK 255.255.255.255 10.121.232.1
&lt;b&gt;ROUTE: route addition failed using CreateIpForwardEntry: Network access is denied.   [status=65 if_index=65541]
Route addition via IPAPI failed [adaptive]
Route addition fallback to route.exe
&lt;/b&gt;C:WINDOWSsystem32route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.7.230.137
&lt;b&gt;ROUTE: route addition failed using CreateIpForwardEntry: Network access is denied.   [status=65 if_index=3]
Route addition via IPAPI failed [adaptive]
Route addition fallback to route.exe
&lt;/b&gt;C:WINDOWSsystem32route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.7.230.137
&lt;b&gt;ROUTE: route addition failed using CreateIpForwardEntry: Network access is denied.   [status=65 if_index=3]
Route addition via IPAPI failed [adaptive]
Route addition fallback to route.exe
&lt;/b&gt;C:WINDOWSsystem32route.exe ADD 10.7.0.1 MASK 255.255.255.255 10.7.230.137
&lt;b&gt;ROUTE: route addition failed using CreateIpForwardEntry: Network access is denied.   [status=65 if_index=3]
Route addition via IPAPI failed [adaptive]
Route addition fallback to route.exe
&lt;/b&gt;Initialization Sequence Completed]]></description>
		<content:encoded><![CDATA[<p>No, the routes are created by the openvpn service after all credentials and what not have been passed successfully. Here&#8217;s a log to UltraVPN (free service) using an admin account:</p>
<p>Difference shown in bold.</p>
<p>OpenVPN 2.1_rc18 i686-pc-mingw32 [SSL] [LZO2] [PKCS11] built on Jun  7 2009<br />
WARNING: No server certificate verification method has been enabled.  See <a href="http://openvpn.net/howto.html#mitm" rel="nofollow">http://openvpn.net/howto.html#mitm</a> for more info.<br />
NOTE: OpenVPN 2.1 requires &#8216;&#8211;script-security 2&#8242; or higher to call user-defined scripts or executables<br />
LZO compression initialized<br />
Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]<br />
Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]<br />
Local Options hash (VER=V4): &#8217;69109d17&#8242;<br />
Expected Remote Options hash (VER=V4): &#8216;c0103fa8&#8242;<br />
Attempting to establish TCP connection with 87.98.164.142:443<br />
TCP connection established with 87.98.164.142:443<br />
Socket Buffers: R=[8192-&gt;8192] S=[8192-&gt;8192]<br />
TCPv4_CLIENT link local: [undef]<br />
TCPv4_CLIENT link remote: 87.98.164.142:443<br />
TLS: Initial packet from 87.98.164.142:443, sid=17e6c66f d7510814<br />
WARNING: this configuration may cache passwords in memory &#8212; use the auth-nocache option to prevent this<br />
VERIFY OK: depth=1, /C=FR/ST=NA/L=BISHKEK/O=OpenVPN-TEST/CN=ludwig/emailAddress=me@myhost.mydomain<br />
VERIFY OK: depth=0, /C=FR/ST=NA/O=OpenVPN-TEST/CN=ludwig/emailAddress=me@myhost.mydomain<br />
Data Channel Encrypt: Cipher &#8216;BF-CBC&#8217; initialized with 128 bit key<br />
Data Channel Encrypt: Using 160 bit message hash &#8216;SHA1&#8242; for HMAC authentication<br />
Data Channel Decrypt: Cipher &#8216;BF-CBC&#8217; initialized with 128 bit key<br />
Data Channel Decrypt: Using 160 bit message hash &#8216;SHA1&#8242; for HMAC authentication<br />
Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA<br />
[ludwig] Peer Connection Initiated with 87.98.164.142:443<br />
SENT CONTROL [ludwig]: &#8216;PUSH_REQUEST&#8217; (status=1)<br />
PUSH: Received control message: &#8216;PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route 10.7.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.7.230.138 10.7.230.137&#8242;<br />
OPTIONS IMPORT: timers and/or timeouts modified<br />
OPTIONS IMPORT: &#8211;ifconfig/up options modified<br />
OPTIONS IMPORT: route options modified<br />
OPTIONS IMPORT: &#8211;ip-win32 and/or &#8211;dhcp-option options modified<br />
ROUTE default_gateway=10.121.232.1<br />
TAP-WIN32 device [OpenVPN] opened: \.Global{4B38798E-297E-4477-8ED0-07D3A2D17280}.tap<br />
TAP-Win32 Driver Version 9.4<br />
TAP-Win32 MTU=1500<br />
Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.7.230.138/255.255.255.252 on interface {4B38798E-297E-4477-8ED0-07D3A2D17280} [DHCP-serv: 10.7.230.137, lease-time: 31536000]<br />
<b>Successful ARP Flush on interface [3] {4B38798E-297E-4477-8ED0-07D3A2D17280}<br />
</b>TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up<br />
C:WINDOWSsystem32route.exe ADD 87.98.164.142 MASK 255.255.255.255 10.121.232.1<br />
<b>Route addition via IPAPI succeeded [adaptive]<br />
</b>C:WINDOWSsystem32route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.7.230.137<br />
<b>Route addition via IPAPI succeeded [adaptive]<br />
</b>C:WINDOWSsystem32route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.7.230.137<br />
<b>Route addition via IPAPI succeeded [adaptive]<br />
</b>C:WINDOWSsystem32route.exe ADD 10.7.0.1 MASK 255.255.255.255 10.7.230.137<br />
<b>Route addition via IPAPI succeeded [adaptive]<br />
</b>Initialization Sequence Completed</p>
<p>And again as a limited user:<br />
OpenVPN 2.1_rc18 i686-pc-mingw32 [SSL] [LZO2] [PKCS11] built on Jun  7 2009<br />
WARNING: No server certificate verification method has been enabled.  See <a href="http://openvpn.net/howto.html#mitm" rel="nofollow">http://openvpn.net/howto.html#mitm</a> for more info.<br />
NOTE: OpenVPN 2.1 requires &#8216;&#8211;script-security 2&#8242; or higher to call user-defined scripts or executables<br />
LZO compression initialized<br />
Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]<br />
Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]<br />
Local Options hash (VER=V4): &#8217;69109d17&#8242;<br />
Expected Remote Options hash (VER=V4): &#8216;c0103fa8&#8242;<br />
Attempting to establish TCP connection with 87.98.164.142:443<br />
TCP connection established with 87.98.164.142:443<br />
Socket Buffers: R=[8192-&gt;8192] S=[8192-&gt;8192]<br />
TCPv4_CLIENT link local: [undef]<br />
TCPv4_CLIENT link remote: 87.98.164.142:443<br />
TLS: Initial packet from 87.98.164.142:443, sid=10c2ba52 88d2f821<br />
WARNING: this configuration may cache passwords in memory &#8212; use the auth-nocache option to prevent this<br />
VERIFY OK: depth=1, /C=FR/ST=NA/L=BISHKEK/O=OpenVPN-TEST/CN=ludwig/emailAddress=me@myhost.mydomain<br />
VERIFY OK: depth=0, /C=FR/ST=NA/O=OpenVPN-TEST/CN=ludwig/emailAddress=me@myhost.mydomain<br />
Data Channel Encrypt: Cipher &#8216;BF-CBC&#8217; initialized with 128 bit key<br />
Data Channel Encrypt: Using 160 bit message hash &#8216;SHA1&#8242; for HMAC authentication<br />
Data Channel Decrypt: Cipher &#8216;BF-CBC&#8217; initialized with 128 bit key<br />
Data Channel Decrypt: Using 160 bit message hash &#8216;SHA1&#8242; for HMAC authentication<br />
Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA<br />
[ludwig] Peer Connection Initiated with 87.98.164.142:443<br />
SENT CONTROL [ludwig]: &#8216;PUSH_REQUEST&#8217; (status=1)<br />
PUSH: Received control message: &#8216;PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route 10.7.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.7.230.138 10.7.230.137&#8242;<br />
OPTIONS IMPORT: timers and/or timeouts modified<br />
OPTIONS IMPORT: &#8211;ifconfig/up options modified<br />
OPTIONS IMPORT: route options modified<br />
OPTIONS IMPORT: &#8211;ip-win32 and/or &#8211;dhcp-option options modified<br />
ROUTE default_gateway=10.121.232.1<br />
TAP-WIN32 device [OpenVPN] opened: \.Global{4B38798E-297E-4477-8ED0-07D3A2D17280}.tap<br />
TAP-Win32 Driver Version 9.4<br />
TAP-Win32 MTU=1500<br />
Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.7.230.138/255.255.255.252 on interface {4B38798E-297E-4477-8ED0-07D3A2D17280} [DHCP-serv: 10.7.230.137, lease-time: 31536000]<br />
<b>NOTE: FlushIpNetTable failed on interface [3] {4B38798E-297E-4477-8ED0-07D3A2D17280} (status=6) : The handle is invalid.<br />
</b>TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up<br />
C:WINDOWSsystem32route.exe ADD 87.98.164.142 MASK 255.255.255.255 10.121.232.1<br />
<b>ROUTE: route addition failed using CreateIpForwardEntry: Network access is denied.   [status=65 if_index=65541]<br />
Route addition via IPAPI failed [adaptive]<br />
Route addition fallback to route.exe<br />
</b>C:WINDOWSsystem32route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.7.230.137<br />
<b>ROUTE: route addition failed using CreateIpForwardEntry: Network access is denied.   [status=65 if_index=3]<br />
Route addition via IPAPI failed [adaptive]<br />
Route addition fallback to route.exe<br />
</b>C:WINDOWSsystem32route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.7.230.137<br />
<b>ROUTE: route addition failed using CreateIpForwardEntry: Network access is denied.   [status=65 if_index=3]<br />
Route addition via IPAPI failed [adaptive]<br />
Route addition fallback to route.exe<br />
</b>C:WINDOWSsystem32route.exe ADD 10.7.0.1 MASK 255.255.255.255 10.7.230.137<br />
<b>ROUTE: route addition failed using CreateIpForwardEntry: Network access is denied.   [status=65 if_index=3]<br />
Route addition via IPAPI failed [adaptive]<br />
Route addition fallback to route.exe<br />
</b>Initialization Sequence Completed</p>
]]></content:encoded>
	</item>
</channel>
</rss>

<!-- Performance optimized by W3 Total Cache. Learn more: http://www.w3-edge.com/wordpress-plugins/

Page Caching using memcached
Database Caching 6/9 queries in 0.012 seconds using memcached
Object Caching 268/271 objects using memcached

Served from: itknowledgeexchange.techtarget.com @ 2013-06-19 19:12:52 -->