Hi All,
Recently Iranian government started new filtering (Censorship) system, So all my openvpn clients inside iran stop working, for example:
Server Config:
local X.Y.Z.W
port 55555
proto udp
dev tun
fast-io
tun-mtu 1500
mssfix 1400
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
plugin /etc/openvpn/radiusplugin.so /etc/openvpn/radiusplugin-UDP.cnf
client-cert-not-required
username-as-common-name
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 10.8.0.1"
push "dhcp-option DNS 8.8.8.8"
keepalive 10 180
comp-lzo
persist-key
persist-tun
status UDP-STATS.log
cipher AES-256-CBC
auth SHA1
verb 3
log /var/log/openvpn/udp.log
Client Config:
client
dev tun
proto udp
remote X.Y.Z.W 55555
resolv-retry infinite
nobind
tun-mtu 1500
mssfix 1400
persist-key
persist-tun
comp-lzo
keepalive 10 180
verb 14
auth-user-pass auth.cfg
cipher AES-256-CBC
auth SHA1
route-delay 5
script-security 2
<ca>
-----BEGIN CERTIFICATE-----
{MY CA}
-----END CERTIFICATE-----
</ca>
Client Log:
Mon Feb 25 18:23:21 2013 us=383777 OpenVPN 2.3.0 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Feb 14 2013
Enter Management Password:
Mon Feb 25 18:23:21 2013 us=385778 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25341
Mon Feb 25 18:23:21 2013 us=385778 Need hold release from management interface, waiting...
Mon Feb 25 18:23:21 2013 us=861837 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25341
Mon Feb 25 18:23:21 2013 us=963850 MANAGEMENT: CMD 'state on'
Mon Feb 25 18:23:21 2013 us=963850 MANAGEMENT: CMD 'log all on'
Mon Feb 25 18:23:21 2013 us=970851 MANAGEMENT: CMD 'hold off'
Mon Feb 25 18:23:21 2013 us=970851 MANAGEMENT: CMD 'hold release'
Mon Feb 25 18:23:21 2013 us=971851 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Mon Feb 25 18:23:21 2013 us=971851 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Mon Feb 25 18:23:22 2013 us=107874 LZO compression initialized
Mon Feb 25 18:23:22 2013 us=107874 Control Channel MTU parms [ L:1558 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Feb 25 18:23:22 2013 us=107874 Socket Buffers: R=[65536->65536] S=[65536->65536]
Mon Feb 25 18:23:22 2013 us=107874 Data Channel MTU parms [ L:1558 D:1440 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Feb 25 18:23:22 2013 us=107874 Local Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-client'
Mon Feb 25 18:23:22 2013 us=107874 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-server'
Mon Feb 25 18:23:22 2013 us=108874 Local Options hash (VER=V4): '22188c5b'
Mon Feb 25 18:23:22 2013 us=108874 Expected Remote Options hash (VER=V4): 'a8f55717'
Mon Feb 25 18:23:22 2013 us=108874 UDPv4 link local: [undef]
Mon Feb 25 18:23:22 2013 us=108874 UDPv4 link remote: [AF_INET]X.Y.Z.W:55555
Mon Feb 25 18:23:22 2013 us=108874 MANAGEMENT: >STATE:1361804002,WAIT,,,
Mon Feb 25 18:23:22 2013 us=108874 event_wait returned 3
Mon Feb 25 18:23:22 2013 us=108874 UDPv4 WRITE [14] to [AF_INET]X.Y.Z.W:55555: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 sid=dca5587b 29e8d9cf [ ] pid=0 DATA
Mon Feb 25 18:23:22 2013 us=108874 UDPv4 write returned 14
Mon Feb 25 18:23:22 2013 us=108874 event_wait returned 2
Mon Feb 25 18:23:22 2013 us=108874 WIN32 I/O: Socket Completion non-queued error: Invalid argument (WSAEINVAL) (errno=10022)
Mon Feb 25 18:23:22 2013 us=108874 UDPv4 read returned -1
Mon Feb 25 18:23:22 2013 us=108874 UDPv4 READ [0] from [undef]: DATA UNDEF len=-1
Mon Feb 25 18:23:22 2013 us=108874 event_wait returned 1
Mon Feb 25 18:23:22 2013 us=284891 event_wait returned 1
Mon Feb 25 18:23:22 2013 us=284891 UDPv4 read returned 26
Mon Feb 25 18:23:22 2013 us=284891 UDPv4 READ [26] from [AF_INET]X.Y.Z.W:55555: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 sid=98f46eb0 03ee1fa5 [ 0 sid=dca5587b 29e8d9cf ] pid=0 DATA
Mon Feb 25 18:23:22 2013 us=284891 MANAGEMENT: >STATE:1361804002,AUTH,,,
Mon Feb 25 18:23:22 2013 us=284891 TLS: Initial packet from [AF_INET]X.Y.Z.W:55555, sid=98f46eb0 03ee1fa5
Mon Feb 25 18:23:22 2013 us=284891 event_wait returned 2
Mon Feb 25 18:23:22 2013 us=284891 UDPv4 WRITE [22] to [AF_INET]X.Y.Z.W:55555: P_ACK_V1 kid=0 sid=dca5587b 29e8d9cf [ 0 sid=98f46eb0 03ee1fa5 ]
Mon Feb 25 18:23:22 2013 us=284891 UDPv4 write returned 22
Mon Feb 25 18:23:22 2013 us=284891 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Mon Feb 25 18:23:22 2013 us=284891 event_wait returned 2
Mon Feb 25 18:23:22 2013 us=284891 UDPv4 WRITE [114] to [AF_INET]X.Y.Z.W:55555: P_CONTROL_V1 kid=0 sid=dca5587b 29e8d9cf [ ] pid=1 DATA 16030100 de010000 da030151 2b7ae26a 794234d6 1a218777 33c68d66 1ed1c2f[more...]
Mon Feb 25 18:23:22 2013 us=285892 UDPv4 write returned 114
Mon Feb 25 18:23:22 2013 us=285892 event_wait returned 2
Mon Feb 25 18:23:22 2013 us=285892 UDPv4 WRITE [114] to [AF_INET]X.Y.Z.W:55555: P_CONTROL_V1 kid=0 sid=dca5587b 29e8d9cf [ ] pid=2 DATA 009a0099 00450044 c00ec004 002f0096 00410007 c011c007 c00cc002 0005000[more...]
Mon Feb 25 18:23:22 2013 us=285892 UDPv4 write returned 114
Mon Feb 25 18:23:22 2013 us=285892 event_wait returned 2
Mon Feb 25 18:23:22 2013 us=285892 UDPv4 WRITE [41] to [AF_INET]X.Y.Z.W:55555: P_CONTROL_V1 kid=0 sid=dca5587b 29e8d9cf [ ] pid=3 DATA 00050012 00130001 00020003 000f0010 00110023 0000000f 000101
Mon Feb 25 18:23:22 2013 us=285892 UDPv4 write returned 41
Mon Feb 25 18:23:22 2013 us=285892 event_wait returned 1
Mon Feb 25 18:23:23 2013 us=426037 event_wait returned 0
Mon Feb 25 18:23:23 2013 us=426037 event_wait returned 1
Mon Feb 25 18:23:24 2013 us=566182 event_wait returned 0
Mon Feb 25 18:23:24 2013 us=566182 event_wait returned 2
Mon Feb 25 18:23:24 2013 us=566182 UDPv4 WRITE [114] to [AF_INET]X.Y.Z.W:55555: P_CONTROL_V1 kid=0 sid=dca5587b 29e8d9cf [ ] pid=1 DATA 16030100 de010000 da030151 2b7ae26a 794234d6 1a218777 33c68d66 1ed1c2f[more...]
Mon Feb 25 18:23:24 2013 us=566182 UDPv4 write returned 114
Mon Feb 25 18:23:24 2013 us=566182 event_wait returned 1
Mon Feb 25 18:23:24 2013 us=641192 event_wait returned 1
Mon Feb 25 18:23:24 2013 us=641192 UDPv4 read returned 14
Mon Feb 25 18:23:24 2013 us=641192 UDPv4 READ [14] from [AF_INET]X.Y.Z.W:55555: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 sid=98f46eb0 03ee1fa5 [ ] pid=0 DATA
Mon Feb 25 18:23:24 2013 us=641192 event_wait returned 2
Mon Feb 25 18:23:24 2013 us=641192 UDPv4 WRITE [22] to [AF_INET]X.Y.Z.W:55555: P_ACK_V1 kid=0 sid=dca5587b 29e8d9cf [ 0 sid=98f46eb0 03ee1fa5 ]
Mon Feb 25 18:23:24 2013 us=641192 UDPv4 write returned 22
Mon Feb 25 18:23:24 2013 us=641192 event_wait returned 1
Mon Feb 25 18:23:25 2013 us=781342 event_wait returned 0
Mon Feb 25 18:23:25 2013 us=781342 event_wait returned 2
Mon Feb 25 18:23:25 2013 us=781342 UDPv4 WRITE [114] to [AF_INET]X.Y.Z.W:55555: P_CONTROL_V1 kid=0 sid=dca5587b 29e8d9cf [ ] pid=2 DATA 009a0099 00450044 c00ec004 002f0096 00410007 c011c007 c00cc002 0005000[more...]
Mon Feb 25 18:23:25 2013 us=781342 UDPv4 write returned 114
Mon Feb 25 18:23:25 2013 us=781342 event_wait returned 1
Mon Feb 25 18:23:26 2013 us=921482 event_wait returned 0
Mon Feb 25 18:23:26 2013 us=921482 event_wait returned 2
Mon Feb 25 18:23:26 2013 us=921482 UDPv4 WRITE [41] to [AF_INET]X.Y.Z.W:55555: P_CONTROL_V1 kid=0 sid=dca5587b 29e8d9cf [ ] pid=3 DATA 00050012 00130001 00020003 000f0010 00110023 0000000f 000101
Mon Feb 25 18:23:26 2013 us=921482 UDPv4 write returned 41
Mon Feb 25 18:23:26 2013 us=921482 event_wait returned 1
Mon Feb 25 18:23:27 2013 us=880605 event_wait returned 1
Mon Feb 25 18:23:27 2013 us=880605 UDPv4 read returned 14
Mon Feb 25 18:23:27 2013 us=880605 UDPv4 READ [14] from [AF_INET]X.Y.Z.W:55555: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 sid=98f46eb0 03ee1fa5 [ ] pid=0 DATA
Mon Feb 25 18:23:27 2013 us=880605 event_wait returned 2
Mon Feb 25 18:23:27 2013 us=880605 UDPv4 WRITE [22] to [AF_INET]X.Y.Z.W:55555: P_ACK_V1 kid=0 sid=dca5587b 29e8d9cf [ 0 sid=98f46eb0 03ee1fa5 ]
Mon Feb 25 18:23:27 2013 us=880605 UDPv4 write returned 22
Mon Feb 25 18:23:27 2013 us=881605 event_wait returned 1
Mon Feb 25 18:23:29 2013 us=21750 event_wait returned 0
Mon Feb 25 18:23:29 2013 us=21750 event_wait returned 2
Mon Feb 25 18:23:29 2013 us=21750 UDPv4 WRITE [114] to [AF_INET]X.Y.Z.W:55555: P_CONTROL_V1 kid=0 sid=dca5587b 29e8d9cf [ ] pid=1 DATA 16030100 de010000 da030151 2b7ae26a 794234d6 1a218777 33c68d66 1ed1c2f[more...]
Mon Feb 25 18:23:29 2013 us=21750 UDPv4 write returned 114
Mon Feb 25 18:23:29 2013 us=21750 event_wait returned 2
Mon Feb 25 18:23:29 2013 us=21750 UDPv4 WRITE [114] to [AF_INET]X.Y.Z.W:55555: P_CONTROL_V1 kid=0 sid=dca5587b 29e8d9cf [ ] pid=2 DATA 009a0099 00450044 c00ec004 002f0096 00410007 c011c007 c00cc002 0005000[more...]
Mon Feb 25 18:23:29 2013 us=21750 UDPv4 write returned 114
Mon Feb 25 18:23:29 2013 us=21750 event_wait returned 1
Mon Feb 25 18:23:30 2013 us=161895 event_wait returned 0
Mon Feb 25 18:23:30 2013 us=161895 event_wait returned 2
Mon Feb 25 18:23:30 2013 us=161895 UDPv4 WRITE [41] to [AF_INET]X.Y.Z.W:55555: P_CONTROL_V1 kid=0 sid=dca5587b 29e8d9cf [ ] pid=3 DATA 00050012 00130001 00020003 000f0010 00110023 0000000f 000101
Mon Feb 25 18:23:30 2013 us=161895 UDPv4 write returned 41
Mon Feb 25 18:23:30 2013 us=161895 event_wait returned 1
Mon Feb 25 18:23:30 2013 us=336918 event_wait returned 1
Mon Feb 25 18:23:30 2013 us=336918 UDPv4 read returned 22
Mon Feb 25 18:23:30 2013 us=336918 UDPv4 READ [22] from [AF_INET]X.Y.Z.W:55555: P_ACK_V1 kid=0 sid=98f46eb0 03ee1fa5 [ 3 sid=dca5587b 29e8d9cf ]
Mon Feb 25 18:23:30 2013 us=336918 event_wait returned 1
Mon Feb 25 18:23:31 2013 us=477063 event_wait returned 0
Mon Feb 25 18:23:31 2013 us=477063 event_wait returned 1
Mon Feb 25 18:23:32 2013 us=617208 event_wait returned 0
Mon Feb 25 18:23:32 2013 us=617208 event_wait returned 1
Mon Feb 25 18:23:33 2013 us=671342 event_wait returned 0
Mon Feb 25 18:23:33 2013 us=671342 event_wait returned 1
Mon Feb 25 18:23:34 2013 us=725477 event_wait returned 0
Mon Feb 25 18:23:34 2013 us=725477 event_wait returned 1
Mon Feb 25 18:23:35 2013 us=779611 event_wait returned 0
Mon Feb 25 18:23:35 2013 us=779611 event_wait returned 1
Mon Feb 25 18:23:36 2013 us=406691 event_wait returned 1
Mon Feb 25 18:23:36 2013 us=406691 UDPv4 read returned 14
Mon Feb 25 18:23:36 2013 us=406691 UDPv4 READ [14] from [AF_INET]X.Y.Z.W:55555: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 sid=98f46eb0 03ee1fa5 [ ] pid=0 DATA
Mon Feb 25 18:23:36 2013 us=406691 event_wait returned 2
Mon Feb 25 18:23:36 2013 us=406691 UDPv4 WRITE [22] to [AF_INET]X.Y.Z.W:55555: P_ACK_V1 kid=0 sid=dca5587b 29e8d9cf [ 0 sid=98f46eb0 03ee1fa5 ]
Mon Feb 25 18:23:36 2013 us=407692 UDPv4 write returned 22
Mon Feb 25 18:23:36 2013 us=407692 event_wait returned 1
Mon Feb 25 18:23:37 2013 us=461826 event_wait returned 0
Mon Feb 25 18:23:37 2013 us=461826 event_wait returned 2
Mon Feb 25 18:23:37 2013 us=461826 UDPv4 WRITE [114] to [AF_INET]X.Y.Z.W:55555: P_CONTROL_V1 kid=0 sid=dca5587b 29e8d9cf [ ] pid=1 DATA 16030100 de010000 da030151 2b7ae26a 794234d6 1a218777 33c68d66 1ed1c2f[more...]
Mon Feb 25 18:23:37 2013 us=461826 UDPv4 write returned 114
Mon Feb 25 18:23:37 2013 us=461826 event_wait returned 1
Mon Feb 25 18:23:38 2013 us=515960 event_wait returned 0
Mon Feb 25 18:23:38 2013 us=515960 event_wait returned 2
Mon Feb 25 18:23:38 2013 us=515960 UDPv4 WRITE [114] to [AF_INET]X.Y.Z.W:55555: P_CONTROL_V1 kid=0 sid=dca5587b 29e8d9cf [ ] pid=2 DATA 009a0099 00450044 c00ec004 002f0096 00410007 c011c007 c00cc002 0005000[more...]
Mon Feb 25 18:23:38 2013 us=515960 UDPv4 write returned 114
Mon Feb 25 18:23:38 2013 us=515960 event_wait returned 1
Mon Feb 25 18:23:39 2013 us=570094 event_wait returned 0
Mon Feb 25 18:23:39 2013 us=570094 event_wait returned 1
Mon Feb 25 18:23:40 2013 us=624229 event_wait returned 0
Mon Feb 25 18:23:40 2013 us=624229 event_wait returned 1
Mon Feb 25 18:23:41 2013 us=678363 event_wait returned 0
Mon Feb 25 18:23:41 2013 us=678363 event_wait returned 1
Mon Feb 25 18:23:42 2013 us=732498 event_wait returned 0
Mon Feb 25 18:23:42 2013 us=732498 event_wait returned 1
Mon Feb 25 18:23:43 2013 us=552608 event_wait returned 1
Mon Feb 25 18:23:43 2013 us=553603 TCP/UDP: Closing socket
Mon Feb 25 18:23:43 2013 us=553603 SIGTERM[hard,] received, process exiting
Mon Feb 25 18:23:43 2013 us=553603 MANAGEMENT: >STATE:1361804023,EXITING,SIGTERM,,
Mon Feb 25 18:23:43 2013 us=554603 PKCS#11: pkcs11h_terminate entry
Mon Feb 25 18:23:43 2013 us=554603 PKCS#11: Removing providers
Mon Feb 25 18:23:43 2013 us=554603 PKCS#11: Releasing sessions
Mon Feb 25 18:23:43 2013 us=554603 PKCS#11: Terminating slotevent
Mon Feb 25 18:23:43 2013 us=554603 PKCS#11: _pkcs11h_slotevent_terminate entry
Mon Feb 25 18:23:43 2013 us=554603 PKCS#11: _pkcs11h_slotevent_terminate return
Mon Feb 25 18:23:43 2013 us=554603 PKCS#11: Marking as uninitialized
It seems that when server sends "verify ok" packet back to clients the filtering firewall drops this packet so openvpn can't go ahead (clever mind!), I also test connecting to server over PPTP connection and it's worked for me, so I'm sure about something wrong in handshake session between server and clients, anybody has a solution for this one is welcome! Thanks for your assistance 😉
