Hi all,
I connect to my hosted VPN using port 1194 UDP most of the time and all works fine.
However, it happens that I am behind a very restrictive firewall that will only let TCP connections over ports 80 and 443 go through.
I'd like to have the option of connecting to my OpenVPN server via TCP port 443 whenever needed alongside with the regular UDP 1194.
I am aware that TCP over TCP is messy but these highly restrictive networks don't leave me left with many other options.
So I did
cp /etc/openvpn/server.conf /etc/openvpn/servertcp.conf
Then I edited servertcp.conf to change the port to 443 and protocol to TCP. I didn't change anything else.
I can connect to the VPN and get an IP address but I can't ping any IP or resolve any hostname using port TCP 443 while UDP 1194 is working fine.
If I edit server.conf to be TCP 443 and servertcp.conf to be UDP 1194 then connecting over TCP to port 443 works fine but connecting to UDP 1194 gets the no-ping no-resolution issue.
Lastly, if I put back UDP 1994 in server.conf and TCP 443 in servertcp.conf and then remove servertcp.conf, then I can't connect to TCP 443 anymore (connection is refused, as expected).
It seems the config files are fine as they are both working individually. OpenVPN is not ignoring the second .conf file either when both are present as it starts listening on the corresponding ports. But somehow it is getting confused when more than one .conf file is present.
Could someone point me in the right direction? I am using CentOS 6.4 x64 and OpenVPN 2.2.2
Thanks!
openvpn:/etc/openvpn # grep -vE '^#|^;|^$' server.conf
port 1194
proto udp
dev tun
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key # This file should be kept secret
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
server 10.10.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
verb 3
mute 20
push "redirect-gateway def1"
openvpn:/etc/openvpn # grep -vE '^#|^;|^$' servertcp.conf
port 443
proto tcp
dev tun
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key # This file should be kept secret
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
server 10.10.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
verb 3
mute 20
push "redirect-gateway def1"
In case this is relevant, here is my iptables. It is voluntarily set to ACCEPT policy to take it out of the equation until I figure things out:
openvpn:/etc/openvpn # iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
fail2ban-SSH tcp -- anywhere anywhere tcp dpt:ssh
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh state NEW,ESTABLISHED
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain fail2ban-SSH (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere
openvpn:/etc/openvpn # iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- 10.10.0.0/24 anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
