HTTP Proxy problem

sorset

Hello
I am running openvpn server on mikrotik but I have problem with connect through HTTP Proxy.
Since openvpn is blocked in our country , I should connect through HTTP proxy , and if not or use SOCKS proxy , it will be timed out while connecting.
My problem is when I try to connect , openvpn successfully connects but I cant ping any hosts , except openvpn server and http proxy IP.
I tried several http proxy servers , like squid , 3proxy,... on linux and windows but I found just one server that is running on 443 port and I can ping other servers through it.
I'm really confused. whats wrong?

maikcat

first, openvpn implementation in mikrotik sucks BIG TIME!

second, post config used on mikrotik and clients,

third, post the output of netstat -nr on your client.

Michael.

sorset

Thank you for reply.
I know , running openvpn on mikotik isn't robust , but thats easy 😃
here is mikrotik config

And client configuration (running on windows)

client
dev tap
remote x.x.x.x 443

proto tcp
topology subnet
mlock
nice -19
fast-io

redirect-gateway
proto tcp-client
tls-client
ca ..\\..\\data\\config\\2k.cert
auth-user-pass
auth-nocache

http-proxy x.x.x.x 443 ..\\..\\data\\config\\account-information.txt "basic"

netstat output when using that working proxy

===========================================================================
Interface List
 34...00 ff 20 f4 a3 c3 ......TAP-Win32 Adapter OAS
 31...00 ff 01 f6 81 49 ......TAP-Win32 Adapter V9
 14...cc 52 af 94 0e ec ......Broadcom 4313GN 802.11b/g/n 1x1 Wi-Fi Adapter
 12...2c 27 d7 ba b9 f4 ......Realtek PCIe GBE Family Controller
 29...08 00 27 00 14 e6 ......VirtualBox Host-Only Ethernet Adapter
 33...44 45 53 54 4f 53 ......Kerio Virtual Network Adapter
  1...........................Software Loopback Interface 1
 23...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
 22...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
 24...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
 20...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
 25...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #4
 21...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #5
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0       172.21.0.1      172.21.0.19     30
   87.236.208.122  255.255.255.255      192.168.1.1      192.168.1.3     25
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
       172.21.0.0    255.255.255.0         On-link       172.21.0.19    286
      172.21.0.19  255.255.255.255         On-link       172.21.0.19    286
     172.21.0.255  255.255.255.255         On-link       172.21.0.19    286
      192.168.1.0    255.255.255.0         On-link       192.168.1.3    281
      192.168.1.3  255.255.255.255         On-link       192.168.1.3    281
    192.168.1.255  255.255.255.255         On-link       192.168.1.3    281
     192.168.56.0    255.255.255.0         On-link      192.168.56.1    276
     192.168.56.1  255.255.255.255         On-link      192.168.56.1    276
   192.168.56.255  255.255.255.255         On-link      192.168.56.1    276
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link      192.168.56.1    276
        224.0.0.0        240.0.0.0         On-link       172.21.0.19    286
        224.0.0.0        240.0.0.0         On-link       192.168.1.3    281
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link      192.168.56.1    276
  255.255.255.255  255.255.255.255         On-link       172.21.0.19    286
  255.255.255.255  255.255.255.255         On-link       192.168.1.3    281
===========================================================================
Persistent Routes:
  None

IPv6 Route Table
===========================================================================
Active Routes:
 If Metric Network Destination      Gateway
  1    306 ::1/128                  On-link
 29    276 fe80::/64                On-link
 31    286 fe80::/64                On-link
 31    286 fe80::983c:5d36:d6a5:2097/128
                                    On-link
 29    276 fe80::fc13:339d:8fd4:776d/128
                                    On-link
  1    306 ff00::/8                 On-link
 29    276 ff00::/8                 On-link
 31    286 ff00::/8                 On-link
===========================================================================
Persistent Routes:
 If Metric Network Destination      Gateway
  0 4294967295 2620:9b::/96             On-link
===========================================================================

And finally netstat with another proxies

===========================================================================
Interface List
 34...00 ff 20 f4 a3 c3 ......TAP-Win32 Adapter OAS
 31...00 ff 01 f6 81 49 ......TAP-Win32 Adapter V9
 14...cc 52 af 94 0e ec ......Broadcom 4313GN 802.11b/g/n 1x1 Wi-Fi Adapter
 12...2c 27 d7 ba b9 f4 ......Realtek PCIe GBE Family Controller
 29...08 00 27 00 14 e6 ......VirtualBox Host-Only Ethernet Adapter
 33...44 45 53 54 4f 53 ......Kerio Virtual Network Adapter
  1...........................Software Loopback Interface 1
 23...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
 22...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
 24...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
 20...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
 25...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #4
 21...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #5
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0       172.21.0.1       172.21.0.7     30
      93.174.94.4  255.255.255.255      192.168.1.1      192.168.1.3     25
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
       172.21.0.0    255.255.255.0         On-link        172.21.0.7    286
       172.21.0.7  255.255.255.255         On-link        172.21.0.7    286
     172.21.0.255  255.255.255.255         On-link        172.21.0.7    286
      192.168.1.0    255.255.255.0         On-link       192.168.1.3    281
      192.168.1.3  255.255.255.255         On-link       192.168.1.3    281
    192.168.1.255  255.255.255.255         On-link       192.168.1.3    281
     192.168.56.0    255.255.255.0         On-link      192.168.56.1    276
     192.168.56.1  255.255.255.255         On-link      192.168.56.1    276
   192.168.56.255  255.255.255.255         On-link      192.168.56.1    276
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link      192.168.56.1    276
        224.0.0.0        240.0.0.0         On-link        172.21.0.7    286
        224.0.0.0        240.0.0.0         On-link       192.168.1.3    281
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link      192.168.56.1    276
  255.255.255.255  255.255.255.255         On-link        172.21.0.7    286
  255.255.255.255  255.255.255.255         On-link       192.168.1.3    281
===========================================================================
Persistent Routes:
  None

IPv6 Route Table
===========================================================================
Active Routes:
 If Metric Network Destination      Gateway
  1    306 ::1/128                  On-link
 29    276 fe80::/64                On-link
 31    286 fe80::/64                On-link
 31    286 fe80::983c:5d36:d6a5:2097/128
                                    On-link
 29    276 fe80::fc13:339d:8fd4:776d/128
                                    On-link
  1    306 ff00::/8                 On-link
 29    276 ff00::/8                 On-link
 31    286 ff00::/8                 On-link
===========================================================================
Persistent Routes:
 If Metric Network Destination      Gateway
  0 4294967295 2620:9b::/96             On-link
===========================================================================

maikcat

first dont use redirect-gateway on your client use

redirect-gateway def1

also mikrotik nedds to perform NAT on traffic originating from vpn to internet..

if you used a linux server for openvpn the best approach was to push redirect gateway
to your clients from your server...

Michael.

sorset

Thank you.
But I think openvpn , client and server sides are properly configured . because when I use that special proxy , I dont have any problems. but most of proxies dont work for me.(connet but ping will be timed out)
An intresting thing is , I have a proxy server , through squid running on centos 5. last week it was working , but after a while , it no longer worked and I cant use it for openvpn! I'm sure that I dont have made any changes at centos or squid!!!
Note that , in our country government uses DPI method for censorship.so its not in normal conditions.
there is one thing that cause time out in ping. but what can be?