Openvpn through http proxy and Connection reset

fefe78

Hi everybody,

due to recent corporate proxy changes, I'm not able anymore to connect to my ssh server and doing ssh tunneling (still I have not figured why), so I decided to try the openvpn way.

My vpn server is a debian VPS hosted in US, my client is a debian machine located in EU.

Here is my server configuration:

dev tun1
ifconfig 10.9.8.1 10.9.8.2
proto tcp-server
port 443
tls-server
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
reneg-sec 60
log-append /var/log/openvpn.log
verb 5

My client configuration:


client
dev tun1
remote server-ip
port 443
proto tcp-client
tls-client
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/pe.crt
key /etc/openvpn/easy-rsa/keys/pe.key
reneg-sec 60
http-proxy corp-proxy 8080
ifconfig 10.9.8.1 10.9.8.2
log-append /var/log/openvpn.log
verb 5

When I try to connect I get connection reset client side:

Tue Oct 28 10:11:22 2014 us=889568 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Tue Oct 28 10:11:22 2014 us=890131 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Tue Oct 28 10:11:22 2014 us=903327 Control Channel MTU parms [ L:1543 D:140 EF:40 EB:0 ET:0 EL:0 ]
Tue Oct 28 10:11:22 2014 us=910719 Socket Buffers: R=[87380->131072] S=[16384->131072]
Tue Oct 28 10:11:22 2014 us=917680 Data Channel MTU parms [ L:1543 D:1450 EF:43 EB:4 ET:0 EL:0 ]
Tue Oct 28 10:11:22 2014 us=923688 Local Options String: 'V4,dev-type tun,link-mtu 1543,tun-mtu 1500,proto TCPv4_CLIENT,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Tue Oct 28 10:11:22 2014 us=924049 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1543,tun-mtu 1500,proto TCPv4_SERVER,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Tue Oct 28 10:11:22 2014 us=924369 Local Options hash (VER=V4): 'db02a8f8'
Tue Oct 28 10:11:22 2014 us=924517 Expected Remote Options hash (VER=V4): '7e068940'
Tue Oct 28 10:11:22 2014 us=924641 Attempting to establish TCP connection with [AF_INET]proxy-ip:8080 [nonblock]
Tue Oct 28 10:11:23 2014 us=926065 TCP connection established with [AF_INET]proxy-ip:8080
Tue Oct 28 10:11:23 2014 us=926146 Send to HTTP proxy: 'CONNECT xxx.xxx.xxx.xxx:443 HTTP/1.0'
Tue Oct 28 10:11:24 2014 us=5888 HTTP proxy returned: 'HTTP/1.0 200 Connection Established'
Tue Oct 28 10:11:26 2014 us=12513 TCPv4_CLIENT link local: [undef]
Tue Oct 28 10:11:26 2014 us=12679 TCPv4_CLIENT link remote: [AF_INET]proxy-ip:8080
WTue Oct 28 10:11:26 2014 us=100075 Connection reset, restarting [-1]
Tue Oct 28 10:11:26 2014 us=101127 TCP/UDP: Closing socket
Tue Oct 28 10:11:26 2014 us=101832 SIGUSR1[soft,connection-reset] received, process restarting
Tue Oct 28 10:11:26 2014 us=102388 Restart pause, 5 second(s)

Server side log have these info:

Tue Oct 28 06:10:36 2014 us=469365 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or e
xecutables
Tue Oct 28 06:10:36 2014 us=470280 Diffie-Hellman initialized with 1024 bit key
Tue Oct 28 06:10:36 2014 us=470751 Control Channel MTU parms [ L:1543 D:140 EF:40 EB:0 ET:0 EL:0 ]
Tue Oct 28 06:10:36 2014 us=470774 Socket Buffers: R=[174760->131072] S=[174760->131072]
Tue Oct 28 06:10:36 2014 us=470966 TUN/TAP device tun1 opened
Tue Oct 28 06:10:36 2014 us=470986 TUN/TAP TX queue length set to 100
Tue Oct 28 06:10:36 2014 us=470996 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Oct 28 06:10:36 2014 us=471010 /sbin/ifconfig tun1 10.9.8.1 pointopoint 10.9.8.2 mtu 1500
Tue Oct 28 06:10:36 2014 us=478355 Data Channel MTU parms [ L:1543 D:1450 EF:43 EB:4 ET:0 EL:0 ]
Tue Oct 28 06:10:36 2014 us=478407 Local Options String: 'V4,dev-type tun,link-mtu 1543,tun-mtu 1500,proto TCPv4_SERVER,ifconfi
g 10.9.8.2 10.9.8.1,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Tue Oct 28 06:10:36 2014 us=478424 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1543,tun-mtu 1500,proto TCPv4_CLIE
NT,ifconfig 10.9.8.1 10.9.8.2,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Tue Oct 28 06:10:36 2014 us=478438 Local Options hash (VER=V4): '50282195'
Tue Oct 28 06:10:36 2014 us=478446 Expected Remote Options hash (VER=V4): '257dc101'
Tue Oct 28 06:10:36 2014 us=478457 Listening for incoming TCP connection on [undef]
Tue Oct 28 06:10:37 2014 us=478561 TCP connection established with [AF_INET]xxx.xxx.xxx.xxx:53634
Tue Oct 28 06:10:37 2014 us=478601 TCPv4_SERVER link local (bound): [undef]
Tue Oct 28 06:10:37 2014 us=478617 TCPv4_SERVER link remote: [AF_INET]xxx.xxx.xxx.xxx:53634
Tue Oct 28 06:10:37 2014 us=478719 WARNING: Bad encapsulated packet length from peer (17231), which must be > 0 and <= 1543 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...]
Tue Oct 28 06:10:37 2014 us=478738 Connection reset, restarting [0]
Tue Oct 28 06:10:37 2014 us=478844 TCP/UDP: Closing socket
Tue Oct 28 06:10:37 2014 us=478890 Closing TUN/TAP interface
Tue Oct 28 06:10:37 2014 us=478910 /sbin/ifconfig tun1 0.0.0.0
Tue Oct 28 06:10:37 2014 us=514740 SIGUSR1[soft,connection-reset] received, process restarting
Tue Oct 28 06:10:37 2014 us=514772 Restart pause, 1 second(s)

Anybody can help?

Thanks.

maikcat

first correct your server config by using server directive.

Michael.

fefe78

thanks..
added this lines in server.conf:

mode server
server 10.8.0.0 255.255.255.0

no changes.. same response.. :cry:

maikcat

please post current used configs.

which proxy do you have?

Michael.

fefe78

Server:

mode server
server 10.8.0.0 255.255.255.0
dev tun1
ifconfig 10.9.8.1 10.9.8.2
proto tcp-server
port 443
tls-server
#secret /etc/openvpn/static.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
reneg-sec 60
log-append /var/log/openvpn.log
verb 5
tun-mtu 1500

Client:

client
dev tun1
remote <server_ip>
port 443
proto tcp-client
tls-client
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/pe.crt
key /etc/openvpn/easy-rsa/keys/pe.key
reneg-sec 60
http-proxy corp-proxy 8080
http-proxy-option AGENT user-agent "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; Media Center PC 6.0; InfoPath.3; MS-RTC LM 8; Zune 4.7)"
http-proxy-option VERSION 1.1
log-append /var/log/openvpn.log
verb 5
tun-mtu 1500

I don't know which type of proxy is, is the corporate one.. I should not know and I can't ask :mrgreen:

maikcat

its obvious that you are changing configs,
please stick to one because changing settings makes troubleshooting even more diffcult.

please use this for server config:

server 10.8.0.0 255.255.255.0
dev tun1
proto tcp-server
port 443
tls-server
#secret /etc/openvpn/static.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
reneg-sec 60
log-append /var/log/openvpn.log
verb 5
tun-mtu 1500

fefe78

i tought you told me to add the server directive, and I have added the two lines above.. The other lines are the same..
I've added a few hhtp-proxy options client side.. don't think makes big difference..

maikcat

first correct your server config by using server directive.

my comment was about reading how the server directive works and apply it to your config,
anyway can you please first use the config i proposed?

its difficult to troubleshoot if you keep changing configs in the way,
f.e you added tun-mtu (which is good) but the commented line of secret directive
shows that your original config was using static key encryption and NOT tls,
configuring static key encryption also needs ifconfig directives BUT
when you switch to TLS you SHOULD use server directive (which also if you read the docs its expands and uses ifconfig itself)

so, please use the config provided by me then we see the errors you get,also it would be great
if you could try to test your config from another location without proxy to check and verify it works...

regards

Michael.

fefe78

ok, I have tried the configuration you posted... always the same response (for the record I'be never user the secret static key.. was my first attempt but the server never started with this option.)

I've also tried to connect without passing through http proxy (with my home network) and the connection succeeded.

I presume that the proxy is in some way detecting everything except the connect to http 443 port (that seems initially to accept)... and reset all the other attempts.

maikcat

if your proxy is configured to intercept https based traffic openvpn will probably not work...

Michael.

[deleted]

sees very complicated but every problem can be solved
I'll try to figure it out and tell asap

fefe78

i find a solution, not for the openvpn, but this can describe the problems faced...

I managed to connect again to my ssh server using stunnel, because probably the problem is that the proxy is now using DPI on 443 port.. and reset all connections that aren't "real" https... Stunnel wrap the https request in a SSL container, so it is unoticeable by the proxy which type of https request I'm doing.

Openvpn is using certificates, but I don't know if it works in this way with https requests.

Mr.Dadulka

Hello,

I read through and stick with your last post.
I've also trying to understand how to setup stunnel on my tomato router with Android client.

I didn't understand the problematic but can learn a lost from forums. Do I still need OpenVPN to setup stunnel router-android client connection?

How do you iniaite stunnel? For Windows there is a app for it, but for Android I can't find the procedure of setting up.

Thank you if you have any suggestion.