<note important> On March 19, the current VPN configuration will stop working. New certificates with the configuration and IP address can be found in the “VPN Files” folder in Nextcloud. </ Note>

Allows access to the internal network from anywhere trough Internet. When connected to the VPN you hay an internal IP address that allows secure access to all the CITIUS services. However Internet access is filtered so that only the internal network and a few chosen external sites are accessible. You can check which sites in the VPN white list

You have to register filling the requests and problem reporting form. This form is only available to CITIUS users.

The necessary configuration files are located in the VPN folder in your home. Former activations had the files sent by mail, if that was your case and would rather prefer to have the files in your home you can request so.

The installation guides tell you when and how to use those files.

• CentOS 6 User Guide
• Generic GNU/Linux (without Network Manager) User Guide
• Mac OS X 10.8/10.9/10.10 User Guide
• Ubuntu 12.04/14.04 User Guide
• Windows 7/8/8.1/10 User Guide
• Android 4.x/5.x User Guide

In the configuration, check that the VPN server address is 193.144.83.110 (or vpn.citius.usc.es). When using the name check if it matches the ip address.

To do so, open a terminal window and enter ping vpn.citius.usc.es and check that the answers are from that ip address. If it is not, then use the address instead of the name in the configuration.

To change the configuration in Windows, right click the systray icon and choose “Edit configuration…”. In the text editor, change remote vpn.citius.usc.es to remote 193.144.83.110. Remove the whole line verify-x509-name “vpn.citius.usc.es” name. Save and close the editor.

Check that you can open a session in the CiTIUS web with your username and password. If you can, then double check the password in the VPN configuration. Once you are sure the problem is not your username/password if it isn't working yet then it may be an outdated certificate's fault. Get in touch with the admins to make them check it.

After this service was launched the list of ports that an EDUROAM network has to have open has been standardized. We use port 22 UDP for the VPN service and sadly that port was not in the list. The same thing happens when connecting from other networks like the SERGAS, which have that port filtered.

To work around that problem we redirect port 1194 UDP(which is open in EDUROAM) to 22 UDP. So if you are having trouble change the connection port to 1194 and try again.

To change the configuration in Windows, right click the systray icon and choose “Edit configuration…”. In the text editor, change 22 udp to 1194 udp (all lowecase). Save and close the editor.

Certain combinations of SSH clients and servers can have traffic between them blocked by Internet providers when negotiating the connection encryption. To check if the problem applies to your case, try to connect with the -v parameter. You should see messages like these:

$ ssh -v jorge.suarez@172.16.54.31
OpenSSH_5.9p1 Debian-5ubuntu1, OpenSSL 1.0.1 14 Mar 2012
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to 172.16.54.31 [172.16.54.31] port 22.
debug1: Connection established.
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3p1 Debian-3ubuntu7
debug1: match: OpenSSH_5.3p1 Debian-3ubuntu7 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.9p1 Debian-5ubuntu1
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP

and then keeps waiting for one minute until the server closes the connection. You can avoid this problem forcing the preferred encryption methods in the SSH client configuration file. For example:

$ echo "Ciphers aes256-ctr,aes192-ctr,aes128-ctr,aes128-cbc,3des-cbc" > ~/.ssh/config

If this doesn't resolve the issue then you mast configure other encryption methods. Try shortening the list o changing the its order.

It is necessary to run OpenVPN GUI as administrator. If not, everything seems ok but routes are not correctly established an connections fail.

It's a file compressed with 7-zip, that is also protected with password citius. We use to send the configuration files by email in that format to avoid them being rejected by mail servers. Usually mail servers don't allow .exe files attached.