I have successfully managed to connect to my home router with OpenVPN through a fairly restrictive firewall (that blocks UDP and ports except 443 and 80) by setting it to listen on port 443 and using TCP. To protect the router against DoS and overflow attacks, I have enabled the tls-auth option. This works fine from an open internet address, but from behind the firewall I can no longer connect. In the log, it just sits waiting: [code]TCPv4_CLIENT link remote: [AF_INET]XX.XX.XX.XX:443[/code] According to the documentation ([url]http://openvpn.net/index.php/open-source/documentation/security-overview.html[/url], [quote]The actual IP packets, after being encrypted and signed with an HMAC, are tunnelled over UDP without any reliability layer. [/quote] So if I understand correctly, when using tls-auth, the the initial handshake packets are sent over UDP, even if the tunnel itself is specified to use TCP. The firewall is blocking UDP, and so a connection cannot be initiated with the tls-auth option. Can anyone confirm whether this is indeed the case, and whether there is a way around it?

Using tls-auth through firewall

RussellH

I have successfully managed to connect to my home router with OpenVPN through a fairly restrictive firewall (that blocks UDP and ports except 443 and 80) by setting it to listen on port 443 and using TCP. To protect the router against DoS and overflow attacks, I have enabled the tls-auth option. This works fine from an open internet address, but from behind the firewall I can no longer connect. In the log, it just sits waiting:

TCPv4_CLIENT link remote: [AF_INET]XX.XX.XX.XX:443

According to the documentation (http://openvpn.net/index.php/open-source/documentation/security-overview.html,

The actual IP packets, after being encrypted and signed with an HMAC, are tunnelled over UDP without any reliability layer.

So if I understand correctly, when using tls-auth, the the initial handshake packets are sent over UDP, even if the tunnel itself is specified to use TCP. The firewall is blocking UDP, and so a connection cannot be initiated with the tls-auth option.

Can anyone confirm whether this is indeed the case, and whether there is a way around it?