OpenVPN through http proxy - server hostname resolution

psycorp

Hi

I've recently setup an openvpn server at home which I connect to through a http proxy. I've got this working as I wanted, barr one issue. When I specify a remote "hostname" rather than remote "ip" in the config file openvpn appears to be sending the unresolved hostname in the connect request to the http proxy, which then returns an error.

Is there any way to instruct the client to firstly resolve the hostname and then send the ip to the proxy? Judging by the man page this should be default behaviour when not using a proxy, but in this case it isn't happening.

Thanks in advance

psycorp

Yes I did read that, thanks.

Not having problems connecting hence no logfiles.

I'm asking a specific question about openvpn behaviour that I can't find an answer to in the man page.

Thanks for the reply though.

psycorp

Fine. Here you go.

Client config.

client
dev tun
proto tcp
remote ServerDomainName/IP Address 443
resolv-retry infinite
nobind
persist-key
persist-tun
http-proxy-retry
http-proxy PROXYIP 8080
ca ca.crt
cert Work-TESTPC.crt
key Work-TESTPC.key
ns-cert-type server
comp-lzo
verb 4
route-delay 2
cipher AES-128-CBC
redirect-gateway

Successful connection using openvpn server ip in remote statement

Wed Mar 05 08:05:08 2014 pkcs11_protected_authentication = DISABLED
Wed Mar 05 08:05:08 2014 pkcs11_protected_authentication = DISABLED
Wed Mar 05 08:05:08 2014 pkcs11_protected_authentication = DISABLED
Wed Mar 05 08:05:08 2014 pkcs11_protected_authentication = DISABLED
Wed Mar 05 08:05:08 2014 pkcs11_protected_authentication = DISABLED
Wed Mar 05 08:05:08 2014 pkcs11_private_mode = 00000000
Wed Mar 05 08:05:08 2014 pkcs11_private_mode = 00000000
Wed Mar 05 08:05:08 2014 pkcs11_private_mode = 00000000
Wed Mar 05 08:05:08 2014 pkcs11_private_mode = 00000000
Wed Mar 05 08:05:08 2014 pkcs11_private_mode = 00000000
Wed Mar 05 08:05:08 2014 pkcs11_private_mode = 00000000
Wed Mar 05 08:05:08 2014 pkcs11_private_mode = 00000000
Wed Mar 05 08:05:08 2014 pkcs11_private_mode = 00000000
Wed Mar 05 08:05:08 2014 pkcs11_private_mode = 00000000
Wed Mar 05 08:05:08 2014 pkcs11_private_mode = 00000000
Wed Mar 05 08:05:08 2014 pkcs11_private_mode = 00000000
Wed Mar 05 08:05:08 2014 pkcs11_private_mode = 00000000
Wed Mar 05 08:05:08 2014 pkcs11_private_mode = 00000000
Wed Mar 05 08:05:08 2014 pkcs11_private_mode = 00000000
Wed Mar 05 08:05:08 2014 pkcs11_private_mode = 00000000
Wed Mar 05 08:05:08 2014 pkcs11_private_mode = 00000000
Wed Mar 05 08:05:08 2014 pkcs11_cert_private = DISABLED
Wed Mar 05 08:05:08 2014 pkcs11_cert_private = DISABLED
Wed Mar 05 08:05:08 2014 pkcs11_cert_private = DISABLED
Wed Mar 05 08:05:08 2014 pkcs11_cert_private = DISABLED
Wed Mar 05 08:05:08 2014 pkcs11_cert_private = DISABLED
Wed Mar 05 08:05:08 2014 pkcs11_cert_private = DISABLED
Wed Mar 05 08:05:08 2014 pkcs11_cert_private = DISABLED
Wed Mar 05 08:05:08 2014 pkcs11_cert_private = DISABLED
Wed Mar 05 08:05:08 2014 pkcs11_cert_private = DISABLED
Wed Mar 05 08:05:08 2014 pkcs11_cert_private = DISABLED
Wed Mar 05 08:05:08 2014 pkcs11_cert_private = DISABLED
Wed Mar 05 08:05:08 2014 pkcs11_cert_private = DISABLED
Wed Mar 05 08:05:08 2014 pkcs11_cert_private = DISABLED
Wed Mar 05 08:05:08 2014 pkcs11_cert_private = DISABLED
Wed Mar 05 08:05:08 2014 pkcs11_cert_private = DISABLED
Wed Mar 05 08:05:08 2014 pkcs11_cert_private = DISABLED
Wed Mar 05 08:05:08 2014 pkcs11_pin_cache_period = -1
Wed Mar 05 08:05:08 2014 pkcs11_id = '[UNDEF]'
Wed Mar 05 08:05:08 2014 pkcs11_id_management = DISABLED
Wed Mar 05 08:05:08 2014 server_network = 0.0.0.0
Wed Mar 05 08:05:08 2014 server_netmask = 0.0.0.0
Wed Mar 05 08:05:08 2014 server_network_ipv6 = ::
Wed Mar 05 08:05:08 2014 server_netbits_ipv6 = 0
Wed Mar 05 08:05:08 2014 server_bridge_ip = 0.0.0.0
Wed Mar 05 08:05:08 2014 server_bridge_netmask = 0.0.0.0
Wed Mar 05 08:05:08 2014 server_bridge_pool_start = 0.0.0.0
Wed Mar 05 08:05:08 2014 server_bridge_pool_end = 0.0.0.0
Wed Mar 05 08:05:08 2014 ifconfig_pool_defined = DISABLED
Wed Mar 05 08:05:08 2014 ifconfig_pool_start = 0.0.0.0
Wed Mar 05 08:05:08 2014 ifconfig_pool_end = 0.0.0.0
Wed Mar 05 08:05:08 2014 ifconfig_pool_netmask = 0.0.0.0
Wed Mar 05 08:05:08 2014 ifconfig_pool_persist_filename = '[UNDEF]'
Wed Mar 05 08:05:08 2014 ifconfig_pool_persist_refresh_freq = 600
Wed Mar 05 08:05:08 2014 ifconfig_ipv6_pool_defined = DISABLED
Wed Mar 05 08:05:08 2014 ifconfig_ipv6_pool_base = ::
Wed Mar 05 08:05:08 2014 ifconfig_ipv6_pool_netbits = 0
Wed Mar 05 08:05:08 2014 n_bcast_buf = 256
Wed Mar 05 08:05:08 2014 tcp_queue_limit = 64
Wed Mar 05 08:05:08 2014 real_hash_size = 256
Wed Mar 05 08:05:08 2014 virtual_hash_size = 256
Wed Mar 05 08:05:08 2014 client_connect_script = '[UNDEF]'
Wed Mar 05 08:05:08 2014 learn_address_script = '[UNDEF]'
Wed Mar 05 08:05:08 2014 client_disconnect_script = '[UNDEF]'
Wed Mar 05 08:05:08 2014 client_config_dir = '[UNDEF]'
Wed Mar 05 08:05:08 2014 ccd_exclusive = DISABLED
Wed Mar 05 08:05:08 2014 tmp_dir = 'C:\Users\ADMINI~1\AppData\Local\Temp\'
Wed Mar 05 08:05:08 2014 push_ifconfig_defined = DISABLED
Wed Mar 05 08:05:08 2014 push_ifconfig_local = 0.0.0.0
Wed Mar 05 08:05:08 2014 push_ifconfig_remote_netmask = 0.0.0.0
Wed Mar 05 08:05:08 2014 push_ifconfig_ipv6_defined = DISABLED
Wed Mar 05 08:05:08 2014 push_ifconfig_ipv6_local = ::/0
Wed Mar 05 08:05:08 2014 push_ifconfig_ipv6_remote = ::
Wed Mar 05 08:05:08 2014 enable_c2c = DISABLED
Wed Mar 05 08:05:08 2014 duplicate_cn = DISABLED
Wed Mar 05 08:05:08 2014 cf_max = 0
Wed Mar 05 08:05:08 2014 cf_per = 0
Wed Mar 05 08:05:08 2014 max_clients = 1024
Wed Mar 05 08:05:08 2014 max_routes_per_client = 256
Wed Mar 05 08:05:08 2014 auth_user_pass_verify_script = '[UNDEF]'
Wed Mar 05 08:05:08 2014 auth_user_pass_verify_script_via_file = DISABLED
Wed Mar 05 08:05:08 2014 client = ENABLED
Wed Mar 05 08:05:08 2014 pull = ENABLED
Wed Mar 05 08:05:08 2014 auth_user_pass_file = '[UNDEF]'
Wed Mar 05 08:05:08 2014 show_net_up = DISABLED
Wed Mar 05 08:05:08 2014 route_method = 0
Wed Mar 05 08:05:08 2014 ip_win32_defined = DISABLED
Wed Mar 05 08:05:08 2014 ip_win32_type = 3
Wed Mar 05 08:05:08 2014 dhcp_masq_offset = 0
Wed Mar 05 08:05:08 2014 dhcp_lease_time = 31536000
Wed Mar 05 08:05:08 2014 tap_sleep = 0
Wed Mar 05 08:05:08 2014 dhcp_options = DISABLED
Wed Mar 05 08:05:08 2014 dhcp_renew = DISABLED
Wed Mar 05 08:05:08 2014 dhcp_pre_release = DISABLED
Wed Mar 05 08:05:08 2014 dhcp_release = DISABLED
Wed Mar 05 08:05:08 2014 domain = '[UNDEF]'
Wed Mar 05 08:05:08 2014 netbios_scope = '[UNDEF]'
Wed Mar 05 08:05:08 2014 netbios_node_type = 0
Wed Mar 05 08:05:08 2014 disable_nbt = DISABLED
Wed Mar 05 08:05:08 2014 OpenVPN 2.3.2 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Aug 22 2013
Wed Mar 05 08:05:08 2014 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25344
Wed Mar 05 08:05:08 2014 Need hold release from management interface, waiting...
Wed Mar 05 08:05:08 2014 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25344
Wed Mar 05 08:05:08 2014 MANAGEMENT: CMD 'state on'
Wed Mar 05 08:05:08 2014 MANAGEMENT: CMD 'log all on'
Wed Mar 05 08:05:08 2014 MANAGEMENT: CMD 'hold off'
Wed Mar 05 08:05:08 2014 MANAGEMENT: CMD 'hold release'
Wed Mar 05 08:05:08 2014 LZO compression initialized
Wed Mar 05 08:05:08 2014 Control Channel MTU parms [ L:1560 D:140 EF:40 EB:0 ET:0 EL:0 ]
Wed Mar 05 08:05:08 2014 Socket Buffers: R=[8192->8192] S=[8192->8192]
Wed Mar 05 08:05:08 2014 Data Channel MTU parms [ L:1560 D:1450 EF:60 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Mar 05 08:05:08 2014 Local Options String: 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher AES-128-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Wed Mar 05 08:05:08 2014 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher AES-128-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Wed Mar 05 08:05:08 2014 Local Options hash (VER=V4): 'bc07730e'
Wed Mar 05 08:05:08 2014 Expected Remote Options hash (VER=V4): 'b695cb4a'
Wed Mar 05 08:05:08 2014 Attempting to establish TCP connection with [AF_INET]PROXYIP:8080
Wed Mar 05 08:05:08 2014 MANAGEMENT: >STATE:1394006708,TCP_CONNECT,,,
Wed Mar 05 08:05:08 2014 TCP connection established with [AF_INET]PROXYIP:8080
Wed Mar 05 08:05:08 2014 Send to HTTP proxy: 'CONNECT SERVERIP:5000 HTTP/1.0'
Wed Mar 05 08:05:12 2014 HTTP proxy returned: 'HTTP/1.0 200 Connection established'
Wed Mar 05 08:05:14 2014 TCPv4_CLIENT link local: [undef]
Wed Mar 05 08:05:14 2014 TCPv4_CLIENT link remote: [AF_INET]PROXYIP:8080
Wed Mar 05 08:05:14 2014 MANAGEMENT: >STATE:1394006714,WAIT,,,
Wed Mar 05 08:05:14 2014 MANAGEMENT: >STATE:1394006714,AUTH,,,
Wed Mar 05 08:05:14 2014 TLS: Initial packet from [AF_INET]PROXYIP:8080, sid=4d04fb73 7071e5c4
Wed Mar 05 08:05:15 2014 VERIFY OK: depth=1, C=UK, ST=WM, L=Birmingham, O=OpenVPN, OU="", CN=Psycorp-CA, name=Psycorp-CA, emailAddress=
Wed Mar 05 08:05:15 2014 VERIFY OK: nsCertType=SERVER
Wed Mar 05 08:05:15 2014 VERIFY OK: depth=0, C=UK, ST=WM, L=Birmingham, O=OpenVPN, OU="", CN=Server, name=Psycorp-CA, emailAddress=
Wed Mar 05 08:05:16 2014 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Wed Mar 05 08:05:16 2014 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Mar 05 08:05:16 2014 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Wed Mar 05 08:05:16 2014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Mar 05 08:05:16 2014 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Wed Mar 05 08:05:16 2014 [Server] Peer Connection Initiated with [AF_INET]PROXYIP:8080
Wed Mar 05 08:05:17 2014 MANAGEMENT: >STATE:1394006717,GET_CONFIG,,,
Wed Mar 05 08:05:18 2014 SENT CONTROL [Server]: 'PUSH_REQUEST' (status=1)
Wed Mar 05 08:05:19 2014 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 8.8.8.8,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.10 10.8.0.9'
Wed Mar 05 08:05:19 2014 OPTIONS IMPORT: timers and/or timeouts modified
Wed Mar 05 08:05:19 2014 OPTIONS IMPORT: --ifconfig/up options modified
Wed Mar 05 08:05:19 2014 OPTIONS IMPORT: route options modified
Wed Mar 05 08:05:19 2014 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Wed Mar 05 08:05:19 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Mar 05 08:05:19 2014 MANAGEMENT: >STATE:1394006719,ASSIGN_IP,,10.8.0.10,
Wed Mar 05 08:05:19 2014 open_tun, tt->ipv6=0
Wed Mar 05 08:05:19 2014 TAP-WIN32 device [Local Area Connection 6] opened: \\.\Global\{02E4CD1F-9E63-45B0-AE9E-D5DFCD4F6125}.tap
Wed Mar 05 08:05:19 2014 TAP-Windows Driver Version 9.9
Wed Mar 05 08:05:19 2014 TAP-Windows MTU=1500
Wed Mar 05 08:05:19 2014 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.10/255.255.255.252 on interface {02E4CD1F-9E63-45B0-AE9E-D5DFCD4F6125} [DHCP-serv: 10.8.0.9, lease-time: 31536000]
Wed Mar 05 08:05:19 2014 DHCP option string: 06040808 0808
Wed Mar 05 08:05:19 2014 Successful ARP Flush on interface [19] {02E4CD1F-9E63-45B0-AE9E-D5DFCD4F6125}
Wed Mar 05 08:05:21 2014 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Wed Mar 05 08:05:21 2014 C:\Windows\system32\route.exe ADD PROXYIP MASK 255.255.255.255 10.128.236.1
Wed Mar 05 08:05:21 2014 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Wed Mar 05 08:05:21 2014 Route addition via IPAPI succeeded [adaptive]
Wed Mar 05 08:05:21 2014 C:\Windows\system32\route.exe DELETE 0.0.0.0 MASK 0.0.0.0 10.128.236.1
Wed Mar 05 08:05:21 2014 Route deletion via IPAPI succeeded [adaptive]
Wed Mar 05 08:05:21 2014 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 0.0.0.0 10.8.0.9
Wed Mar 05 08:05:21 2014 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Wed Mar 05 08:05:21 2014 Route addition via IPAPI succeeded [adaptive]
Wed Mar 05 08:05:21 2014 MANAGEMENT: >STATE:1394006721,ADD_ROUTES,,,
Wed Mar 05 08:05:21 2014 C:\Windows\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.9
Wed Mar 05 08:05:21 2014 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Wed Mar 05 08:05:21 2014 Route addition via IPAPI succeeded [adaptive]
Wed Mar 05 08:05:21 2014 Initialization Sequence Completed
Wed Mar 05 08:05:21 2014 MANAGEMENT: >STATE:1394006721,CONNECTED,SUCCESS,10.8.0.10,PROXYIP

Unsuccessfull connection attempt using same config but substituting server domain name for ip in remote statement

Wed Mar 05 08:04:12 2014 pkcs11_protected_authentication = DISABLED
Wed Mar 05 08:04:12 2014 pkcs11_protected_authentication = DISABLED
Wed Mar 05 08:04:12 2014 pkcs11_protected_authentication = DISABLED
Wed Mar 05 08:04:12 2014 pkcs11_protected_authentication = DISABLED
Wed Mar 05 08:04:12 2014 pkcs11_protected_authentication = DISABLED
Wed Mar 05 08:04:12 2014 pkcs11_private_mode = 00000000
Wed Mar 05 08:04:12 2014 pkcs11_private_mode = 00000000
Wed Mar 05 08:04:12 2014 pkcs11_private_mode = 00000000
Wed Mar 05 08:04:12 2014 pkcs11_private_mode = 00000000
Wed Mar 05 08:04:12 2014 pkcs11_private_mode = 00000000
Wed Mar 05 08:04:12 2014 pkcs11_private_mode = 00000000
Wed Mar 05 08:04:12 2014 pkcs11_private_mode = 00000000
Wed Mar 05 08:04:12 2014 pkcs11_private_mode = 00000000
Wed Mar 05 08:04:12 2014 pkcs11_private_mode = 00000000
Wed Mar 05 08:04:12 2014 pkcs11_private_mode = 00000000
Wed Mar 05 08:04:12 2014 pkcs11_private_mode = 00000000
Wed Mar 05 08:04:12 2014 pkcs11_private_mode = 00000000
Wed Mar 05 08:04:12 2014 pkcs11_private_mode = 00000000
Wed Mar 05 08:04:12 2014 pkcs11_private_mode = 00000000
Wed Mar 05 08:04:12 2014 pkcs11_private_mode = 00000000
Wed Mar 05 08:04:12 2014 pkcs11_private_mode = 00000000
Wed Mar 05 08:04:12 2014 pkcs11_cert_private = DISABLED
Wed Mar 05 08:04:12 2014 pkcs11_cert_private = DISABLED
Wed Mar 05 08:04:12 2014 pkcs11_cert_private = DISABLED
Wed Mar 05 08:04:12 2014 pkcs11_cert_private = DISABLED
Wed Mar 05 08:04:12 2014 pkcs11_cert_private = DISABLED
Wed Mar 05 08:04:12 2014 pkcs11_cert_private = DISABLED
Wed Mar 05 08:04:12 2014 pkcs11_cert_private = DISABLED
Wed Mar 05 08:04:12 2014 pkcs11_cert_private = DISABLED
Wed Mar 05 08:04:12 2014 pkcs11_cert_private = DISABLED
Wed Mar 05 08:04:12 2014 pkcs11_cert_private = DISABLED
Wed Mar 05 08:04:12 2014 pkcs11_cert_private = DISABLED
Wed Mar 05 08:04:12 2014 pkcs11_cert_private = DISABLED
Wed Mar 05 08:04:12 2014 pkcs11_cert_private = DISABLED
Wed Mar 05 08:04:12 2014 pkcs11_cert_private = DISABLED
Wed Mar 05 08:04:12 2014 pkcs11_cert_private = DISABLED
Wed Mar 05 08:04:12 2014 pkcs11_cert_private = DISABLED
Wed Mar 05 08:04:12 2014 pkcs11_pin_cache_period = -1
Wed Mar 05 08:04:12 2014 pkcs11_id = '[UNDEF]'
Wed Mar 05 08:04:12 2014 pkcs11_id_management = DISABLED
Wed Mar 05 08:04:12 2014 server_network = 0.0.0.0
Wed Mar 05 08:04:12 2014 server_netmask = 0.0.0.0
Wed Mar 05 08:04:12 2014 server_network_ipv6 = ::
Wed Mar 05 08:04:12 2014 server_netbits_ipv6 = 0
Wed Mar 05 08:04:12 2014 server_bridge_ip = 0.0.0.0
Wed Mar 05 08:04:12 2014 server_bridge_netmask = 0.0.0.0
Wed Mar 05 08:04:12 2014 server_bridge_pool_start = 0.0.0.0
Wed Mar 05 08:04:12 2014 server_bridge_pool_end = 0.0.0.0
Wed Mar 05 08:04:12 2014 ifconfig_pool_defined = DISABLED
Wed Mar 05 08:04:12 2014 ifconfig_pool_start = 0.0.0.0
Wed Mar 05 08:04:12 2014 ifconfig_pool_end = 0.0.0.0
Wed Mar 05 08:04:12 2014 ifconfig_pool_netmask = 0.0.0.0
Wed Mar 05 08:04:12 2014 ifconfig_pool_persist_filename = '[UNDEF]'
Wed Mar 05 08:04:12 2014 ifconfig_pool_persist_refresh_freq = 600
Wed Mar 05 08:04:12 2014 ifconfig_ipv6_pool_defined = DISABLED
Wed Mar 05 08:04:12 2014 ifconfig_ipv6_pool_base = ::
Wed Mar 05 08:04:12 2014 ifconfig_ipv6_pool_netbits = 0
Wed Mar 05 08:04:12 2014 n_bcast_buf = 256
Wed Mar 05 08:04:12 2014 tcp_queue_limit = 64
Wed Mar 05 08:04:12 2014 real_hash_size = 256
Wed Mar 05 08:04:12 2014 virtual_hash_size = 256
Wed Mar 05 08:04:12 2014 client_connect_script = '[UNDEF]'
Wed Mar 05 08:04:12 2014 learn_address_script = '[UNDEF]'
Wed Mar 05 08:04:12 2014 client_disconnect_script = '[UNDEF]'
Wed Mar 05 08:04:12 2014 client_config_dir = '[UNDEF]'
Wed Mar 05 08:04:12 2014 ccd_exclusive = DISABLED
Wed Mar 05 08:04:12 2014 tmp_dir = 'C:\Users\ADMINI~1\AppData\Local\Temp\'
Wed Mar 05 08:04:12 2014 push_ifconfig_defined = DISABLED
Wed Mar 05 08:04:12 2014 push_ifconfig_local = 0.0.0.0
Wed Mar 05 08:04:12 2014 push_ifconfig_remote_netmask = 0.0.0.0
Wed Mar 05 08:04:12 2014 push_ifconfig_ipv6_defined = DISABLED
Wed Mar 05 08:04:12 2014 push_ifconfig_ipv6_local = ::/0
Wed Mar 05 08:04:12 2014 push_ifconfig_ipv6_remote = ::
Wed Mar 05 08:04:12 2014 enable_c2c = DISABLED
Wed Mar 05 08:04:12 2014 duplicate_cn = DISABLED
Wed Mar 05 08:04:12 2014 cf_max = 0
Wed Mar 05 08:04:12 2014 cf_per = 0
Wed Mar 05 08:04:12 2014 max_clients = 1024
Wed Mar 05 08:04:12 2014 max_routes_per_client = 256
Wed Mar 05 08:04:12 2014 auth_user_pass_verify_script = '[UNDEF]'
Wed Mar 05 08:04:12 2014 auth_user_pass_verify_script_via_file = DISABLED
Wed Mar 05 08:04:12 2014 client = ENABLED
Wed Mar 05 08:04:12 2014 pull = ENABLED
Wed Mar 05 08:04:12 2014 auth_user_pass_file = '[UNDEF]'
Wed Mar 05 08:04:12 2014 show_net_up = DISABLED
Wed Mar 05 08:04:12 2014 route_method = 0
Wed Mar 05 08:04:12 2014 ip_win32_defined = DISABLED
Wed Mar 05 08:04:12 2014 ip_win32_type = 3
Wed Mar 05 08:04:12 2014 dhcp_masq_offset = 0
Wed Mar 05 08:04:12 2014 dhcp_lease_time = 31536000
Wed Mar 05 08:04:12 2014 tap_sleep = 0
Wed Mar 05 08:04:12 2014 dhcp_options = DISABLED
Wed Mar 05 08:04:12 2014 dhcp_renew = DISABLED
Wed Mar 05 08:04:12 2014 dhcp_pre_release = DISABLED
Wed Mar 05 08:04:12 2014 dhcp_release = DISABLED
Wed Mar 05 08:04:12 2014 domain = '[UNDEF]'
Wed Mar 05 08:04:12 2014 netbios_scope = '[UNDEF]'
Wed Mar 05 08:04:12 2014 netbios_node_type = 0
Wed Mar 05 08:04:12 2014 disable_nbt = DISABLED
Wed Mar 05 08:04:12 2014 OpenVPN 2.3.2 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Aug 22 2013
Wed Mar 05 08:04:12 2014 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25344
Wed Mar 05 08:04:12 2014 Need hold release from management interface, waiting...
Wed Mar 05 08:04:12 2014 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25344
Wed Mar 05 08:04:13 2014 MANAGEMENT: CMD 'state on'
Wed Mar 05 08:04:13 2014 MANAGEMENT: CMD 'log all on'
Wed Mar 05 08:04:13 2014 MANAGEMENT: CMD 'hold off'
Wed Mar 05 08:04:13 2014 MANAGEMENT: CMD 'hold release'
Wed Mar 05 08:04:13 2014 LZO compression initialized
Wed Mar 05 08:04:13 2014 Control Channel MTU parms [ L:1560 D:140 EF:40 EB:0 ET:0 EL:0 ]
Wed Mar 05 08:04:13 2014 Socket Buffers: R=[8192->8192] S=[8192->8192]
Wed Mar 05 08:04:13 2014 Data Channel MTU parms [ L:1560 D:1450 EF:60 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Mar 05 08:04:13 2014 Local Options String: 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher AES-128-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Wed Mar 05 08:04:13 2014 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher AES-128-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Wed Mar 05 08:04:13 2014 Local Options hash (VER=V4): 'bc07730e'
Wed Mar 05 08:04:13 2014 Expected Remote Options hash (VER=V4): 'b695cb4a'
Wed Mar 05 08:04:13 2014 Attempting to establish TCP connection with [AF_INET]PROXYIP:8080
Wed Mar 05 08:04:13 2014 MANAGEMENT: >STATE:1394006653,TCP_CONNECT,,,
Wed Mar 05 08:04:13 2014 TCP connection established with [AF_INET]PROXYIP:8080
Wed Mar 05 08:04:13 2014 Send to HTTP proxy: 'CONNECT SERVERDOMAIN:443 HTTP/1.0'
Wed Mar 05 08:04:13 2014 HTTP proxy returned: 'HTTP/1.0 303 See Other'
Wed Mar 05 08:04:13 2014 HTTP proxy returned bad status
Wed Mar 05 08:04:13 2014 TCP/UDP: Closing socket
Wed Mar 05 08:04:13 2014 SIGUSR1[soft,init_instance] received, process restarting
Wed Mar 05 08:04:13 2014 MANAGEMENT: >STATE:1394006653,RECONNECTING,init_instance,,
Wed Mar 05 08:04:13 2014 Restart pause, 5 second(s)

As I've already said, the logfile indicates that when using a http-proxy in the config the openvpn client is passing the unresolved server domain name to the proxy, which as you can see above is returning an error.

Unless I've misread it I gather from the http 1.0 spec that the proxy should accept the domain name in the connect request and do the resolution itself, however in this instance it won't obviously.

So is there a way of forcing the openvpn to perform the resolution itself?

psycorp

I know the client itself won't perform the resolution. It isn't forwarding the request to our DNS server either.

I've checked and our local DNS server resolves the domain correctly, when queried, and the host is configured to use this server.

I've performed a packet capture and can confirm that openvpn is sending the domain name in the HTTP CONNECT request to the proxy. No resolution is being performed.

psycorp

On the off chance that it may help someone else in the future I'll post my solution to this problem.

The domain resolution not being performed before the http connect request was sent to the proxy wasn't the problem. Further reading and an examination of a packet capture log while using a browser showed this is normal behaviour.

The issue was that our WAN web filtering system was blocking the domain of the dynamic dns service I was using. Adding an allow rule for the domain solved the problem.

Unfortunately even with verb 4 logging openvpn didn't log this information so I had to dig through another packet capture and examine the http fields to find it.

Thanks for all the help though :roll: