LDAP connectivity w/ new install

gr8day8

I am trying to deploy a openvpn server in a dmz. I want users authenticated with AD.
Here’s my system organization:

Trusted zone (10.0.0.0/8)
Internal MSoft domain controller 10.10.3.8
Internal Domain is mycompany.local
DMZ (192.168.100.0/24)
Openvpn.mycompany.com 192.168.100.102 1 to 1 NAT <-- --> 101.1.1.102
Openvpn.mycompany.com is a base debian install with ssh server and openvpn-sa installed.
I am able to log into the openvpn console from my workstation
The external IP is 100.1.1.102 (not real, just made up for this purpose)
Firewall allows traffic from 192.168.100.102  10.10.3.8 (am able to ping)
Untrust (the outside)
101.1.1.102 (nat’d to internal ip)
I can open a browser (on the outside) to the https://101.1.1.102 and see client login page.
I am unable to authenticate with my Active Directory account.
What am I missing?
WHere do I look for errors?
Do I set the server name to 101.1.1.102 (since then I test it complains about no external interface) or 192.168.100.102?

gr8day8

As a followup... Looking in my log file

2014-10-31 16:38:33-0700 [-] Cannot connect to LDAP server ldaps://10.10.3.8/: {'desc': "Can't contact LDAP server"} (facility='admin_bind to [mydomain\domain acct]') (user='mydomain\me')
2014-10-31 16:38:33-0700 [-] WEB OUT: '2014-10-31 16:38:33-0700 [UDSProxyQueryProtocol,client] Web login authentication failed: {\'status\': 2, \'reason\': \'Cannot connect to LDAP server ldaps://10.10.3.8/: {\\\'desc\\\': "Can$
2014-10-31 16:38:33-0700 [-] WEB OUT: '2014-10-31 16:38:33-0700 [UDSProxyQueryProtocol,client] Web login failed (twisted.cred.error.UnauthorizedLogin)'
2014-10-31 16:38:33-0700 [-] WEB OUT: "2014-10-31 16:38:33-0700 [UDSProxyQueryProtocol,client] CPage WebException in CLogin/auth: 'Login failed' (None)

Traffic

gr8day8 wroteand openvpn-sa installed

Do you mean: OpenVPN Access Server ?

gr8day8

yes. I installed open access server....
I can get to both user and admin UI. The user UI won't authenticate on AD.
for the user name do I use the format domain\user or just user?

From the logs... the Access Server isn't connecting to the ldap server. the dap server is a domain controller.
How do I verify the Access Server is even connecting correctly to LDAP?

The Johan

From your log file it is abundantly clear that Access Server cannot connect to it.

Note that by default Access Server is configured for LDAP, not LDAPS. If you want SSL security over that connection you'll have to configure that separately. If I were you I'd try first to get LDAP working on the standard port and then work on security later on, for example in the case where your network is not trusted.

If you want to verify that traffic is going anywhere, try using tcpdump or wireshark to show you the packets. You could for example run TCPdump on the background on the Access Server and filter for packets on the LDAP port, and then try to log on. You should be seeing packets going out (and in, as a reponse from the Windows Server).

On the Windows Server system, the same applies but you'll have to use a Windows tool to do so, like WireShark. Again, you can filter there for packets on the LDAP port, and then try to log on at the Access Server. You should be seeing packets coming in (and out, obviously).