openvpn VMware Appliance

KGart0n

I got the appliance up and running easy and need to configure server.conf & client.conf for clients to access from behind firewall. I found the ho to but I can't find where the current server.conf file is to edit it. I take it that the client.conf is on server to that I need to edit? Then if I download and reinstall I will get a client.conf? Or do I need to edit the client.conf after install? Where is client.conf on windows install?

KGart0n

Can Anyone Help as to why I'm not able to connect from behind a Proxy Server?

I found where to set TCP in Web Admin and have that set. Server is on 192.168.1.x
Firewall has TCP 443, TCP 943, UDP/TCP 1194 Forwarded to OpenVPN Srv. IP

In the client.ovpn I have added the http-proxy & proto tcp line below.
setenv FORWARD_COMPATIBLE 1
client
proto tcp
http-proxy 165.170.xxx.xxx 81
remote 66.xx.xx.xx
port 443
dev tun
dev-type tun
ns-cert-type server
reneg-sec 604800
sndbuf 100000
rcvbuf 100000

***When I try to connect I get errors shown below

Wed Feb 13 13:27:27 2013 OpenVPNAS 2.1.18OAS Win32-MSVC++ [SSL] [LZO2] built on May 11 2012
Wed Feb 13 13:27:27 2013 MANAGEMENT: Connected to management server at 127.0.0.1:50952
Wed Feb 13 13:27:27 2013 MANAGEMENT: CMD 'state on'
Wed Feb 13 13:27:27 2013 MANAGEMENT: CMD 'echo on'
Wed Feb 13 13:27:27 2013 MANAGEMENT: CMD 'bytecount 1'
Wed Feb 13 13:27:27 2013 MANAGEMENT: CMD 'hold off'
Wed Feb 13 13:27:27 2013 MANAGEMENT: CMD 'hold release'
Wed Feb 13 13:27:32 2013 MANAGEMENT: CMD 'username "Auth" "openvpn"'
Wed Feb 13 13:27:32 2013 MANAGEMENT: CMD 'password [...]'
Wed Feb 13 13:27:32 2013 MANAGEMENT: CMD 'remote ACCEPT'
Wed Feb 13 13:27:33 2013 NOTE: OpenVPNAS 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Feb 13 13:27:34 2013 Control Channel Authentication: tls-auth using INLINE static key file
Wed Feb 13 13:27:34 2013 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Feb 13 13:27:34 2013 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Feb 13 13:27:34 2013 Socket Buffers: R=[8192->100000] S=[64512->100000]
Wed Feb 13 13:27:34 2013 Attempting to establish TCP connection with 66.xx.xx.xx:443
Wed Feb 13 13:27:34 2013 MANAGEMENT: >STATE:1360780054,TCP_CONNECT,,,
Wed Feb 13 13:27:55 2013 TCP: connect to 66.xx.xx.xx:443 failed, will try again in 5 seconds: Connection timed out (WSAETIMEDOUT)
Wed Feb 13 13:27:55 2013 SIGUSR1[soft,init_instance] received, process restarting
Wed Feb 13 13:27:55 2013 MANAGEMENT: >STATE:1360780075,RECONNECTING,init_instance,,
Wed Feb 13 13:27:55 2013 Restart pause, 5 second(s)
Wed Feb 13 13:28:00 2013 MANAGEMENT: CMD 'http-proxy-fallback-disable'
Wed Feb 13 13:28:01 2013 MANAGEMENT: CMD 'remote ACCEPT'
Wed Feb 13 13:28:02 2013 NOTE: OpenVPNAS 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Feb 13 13:28:02 2013 Control Channel Authentication: tls-auth using INLINE static key file
Wed Feb 13 13:28:02 2013 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Feb 13 13:28:02 2013 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Feb 13 13:28:02 2013 Socket Buffers: R=[8192->100000] S=[64512->100000]
Wed Feb 13 13:28:02 2013 Attempting to establish TCP connection with 66.xx.xx.xx:443
Wed Feb 13 13:28:02 2013 MANAGEMENT: >STATE:1360780082,TCP_CONNECT,,,
Wed Feb 13 13:28:26 2013 TCP: connect to 66.xx.xx.xx:443 failed, will try again in 5 seconds: Connection timed out (WSAETIMEDOUT)
Wed Feb 13 13:28:26 2013 SIGUSR1[soft,init_instance] received, process restarting
Wed Feb 13 13:28:26 2013 MANAGEMENT: >STATE:1360780106,RECONNECTING,init_instance,,
Wed Feb 13 13:28:26 2013 Restart pause, 5 second(s)
Wed Feb 13 13:28:31 2013 MANAGEMENT: CMD 'http-proxy-fallback-disable'
Wed Feb 13 13:28:32 2013 MANAGEMENT: CMD 'remote ACCEPT'
Wed Feb 13 13:28:33 2013 NOTE: OpenVPNAS 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Feb 13 13:28:33 2013 Control Channel Authentication: tls-auth using INLINE static key file
Wed Feb 13 13:28:33 2013 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Feb 13 13:28:33 2013 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Feb 13 13:28:33 2013 Socket Buffers: R=[8192->100000] S=[64512->100000]
Wed Feb 13 13:28:33 2013 Attempting to establish TCP connection with 66.xx.xx.xx:443
Wed Feb 13 13:28:33 2013 MANAGEMENT: >STATE:1360780113,TCP_CONNECT,,,

***(From Capri Log)***

2013-02-13 13:28:06-0500 [-] Autoproxy error: ERROR_WINHTTP_AUTODETECTION_FAILED: python/threadpool:210,python/context:59,python/context:37,win/winproxy:141 (pyovpn.util.proxyerr.ProxyError)
2013-02-13 13:28:25-0500 [MyOMIClient,0,127.0.0.1] FROM OMI: u'>STATE:1360780106,RECONNECTING,init_instance,,'
2013-02-13 13:28:25-0500 [MyOMIClient,0,127.0.0.1] *** API CALL f=xmlrpc_Poll args=['sess_openvpn_66_67_14_246_p4407_VSOkBMWmlfx7Vfam_1', 10] kw={} ret=[{'timestamp': 1360780106, 'state': u'RECONNECTING', 'type': 'STATE', 'reason': u'init_instance'}]
2013-02-13 13:28:30-0500 [MyOMIClient,0,127.0.0.1] FROM OMI: u'>PROXY:NEED_NOW'
2013-02-13 13:28:30-0500 [MyOMIClient,0,127.0.0.1] TO OMI: ['http-proxy-fallback-disable']
2013-02-13 13:28:30-0500 [MyOMIClient,0,127.0.0.1] FROM OMI: u'SUCCESS: proxy-fallback command succeeded'
2013-02-13 13:28:31-0500 [MyOMIClient,0,127.0.0.1] FROM OMI: u'>PROXY:NEED_LATER,66.xx.xx.xx'
2013-02-13 13:28:31-0500 [MyOMIClient,0,127.0.0.1] FROM OMI: u'>REMOTE:66.xx.xx.xx,443,tcp-client'
2013-02-13 13:28:31-0500 [MyOMIClient,0,127.0.0.1] TO OMI: ['remote ACCEPT']
2013-02-13 13:28:31-0500 [MyOMIClient,0,127.0.0.1] FROM OMI: u'SUCCESS: remote command succeeded'
2013-02-13 13:28:32-0500 [MyOMIClient,0,127.0.0.1] FROM OMI: u'>STATE:1360780113,TCP_CONNECT,,,'
2013-02-13 13:28:32-0500 [MyOMIClient,0,127.0.0.1] *** API CALL f=xmlrpc_Poll args=['sess_openvpn_66_67_14_246_p4407_VSOkBMWmlfx7Vfam_1', 10] kw={} ret=[{'timestamp': 1360780113, 'state': u'TCP_CONNECT', 'type': 'STATE'}]
2013-02-13 13:28:33-0500 [-] Autoproxy error: ERROR_WINHTTP_AUTODETECTION_FAILED: python/threadpool:210,python/context:59,python/context:37,win/winproxy:141 (pyovpn.util.proxyerr.ProxyError)
2013-02-13 13:28:53-0500 [MyOMIClient,0,127.0.0.1] FROM OMI: u'>STATE:1360780134,RECONNECTING,init_instance,,'
2013-02-13 13:28:53-0500 [MyOMIClient,0,127.0.0.1] *** API CALL f=xmlrpc_Poll args=['sess_openvpn_66_67_14_246_p4407_VSOkBMWmlfx7Vfam_1', 10] kw={} ret=[{'timestamp': 1360780134, 'state': u'RECONNECTING', 'type': 'STATE', 'reason': u'init_instance'}]
2013-02-13 13:28:53-0500 [-] OpenVPNClient.timeout_handler
2013-02-13 13:28:53-0500 [-] TO OMI: ['exit']
2013-02-13 13:28:53-0500 [MyOMIClient,0,127.0.0.1] OMI Cancel pending deferred ['exit']
2013-02-13 13:28:53-0500 [-] OpenVPN openvpn_66_xx_xx_xxx_p4407 stop: process stopped with exit code 0
2013-02-13 13:28:53-0500 [-] *** API CALL f=xmlrpc_Poll args=['sess_TrackActiveProfiles_nvyQSXgBlOObGXLC_3', 10] kw={} ret=[{'timestamp': 1360780133, 'state': 'disconnect', 'profile_id': 'openvpn_66_67_14_246_p4407', 'type': 'PROFILE'}]
2013-02-13 13:28:53-0500 [HTTPChannel,1760,127.0.0.1] *** API CALL f=xmlrpc_Poll args=['sess_openvpn_66_67_14_246_p4407_VSOkBMWmlfx7Vfam_1', 10] kw={} ret=[{'timestamp': 1360780133, 'type': 'CONNECT_TIMEOUT'}, {'active': False, 'timestamp': 1360780133, 'type': 'ACTIVE', 'last': True}, {'timestamp': 1360780133, 'type': 'DELETE_PENDING'}]
2013-02-13 13:29:02-0500 [HTTPChannel,1762,127.0.0.1] *** API CALL f=xmlrpc_DisconnectSet args=[[]] kw={} ret=None

Can Anyone

[deleted]

Just a proxy server is very vague. Can you explain more about it and what it does? Is something in the network doing deep packet inspection?

If you are running in tcp mode, can you telnet to the openvpn ip on port 443 from a device limited by the proxy?

KGart0n

No User Accounts to access internet through proxy. But there is filtering of unwanted sites. I think there is some public list that is subscribed to for blocking. I would think 443 packages can't be opened for inspection. I was able to set the firewall that the openvpn server is behind to forward 443 to 22 and I can use putty to connect and create a tunnel listing on port 8080 and then route IE over that tunnel and access local sites & internet. Seems like everything is working and moving traffic, I just can't quite get the VPN working. I'm thinking it must have to be either a Server VPN Setting or a Client VPN Setting. Possible an AD Policy causing a VPN Client Issue, not sure waht that would be.