Hello everyone,
I am facing some censorship when connecting to my OpenVPN from a certain country. The OpenVPN server its outside of the country.
Like so, I've set a specific server on TCP with the following configuration:
port 1195
proto tcp
dev tun
topology subnet
client-to-client
server 10.9.0.0 255.255.255.0
client-config-dir /etc/openvpn/static
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh2048.pem
ifconfig-pool-persist /var/tmp/openvpn-ipp.txt
keepalive 10 120
comp-lzo
user nobody
persist-key
persist-tun
status /var/log/openvpn-status-tcp.log
log-append /var/log/openvpn-tcp.log
verb 3
push route 172.31.0.0 255.255.0.0
push dhcp-option DNS 172.31.9.199
crl-verify /etc/openvpn/keys/crl.pem
duplicate-cn
And then an Obfsproxy server
outside of the country where the censorship is happening:
bin/obfsproxy --log-file=obfsproxy.log --lomin-severity=debug --data-dir=/path/to/data scramblesuit --password=VeryRealPassword --dest=<vpn-server-ip>:1195 server 0.0.0.0:80
Then I set a SOCKS5 proxy
inside the contry I am trying to access from.
obfsproxy --log-file=obfsproxy.log --log-min-severity=info scramblesuit --password=VeryRealPassword socks 0.0.0.0:80
Then the client configuration is made liks such.
client
dev tun
proto tcp
remote <ip-to-obfsproxy-server-outside-country>
port 80
resolv-retry infinite
# Downgrade privileges after initialization (non-Windows only)
;user nobody
;group nobody
persist-key
persist-tun
mute-replay-warnings
ca /path/to/certs/ca.crt
cert /path/to/certs/client.crt
key /path/to/certs/client.key
# This updates the resolvconf with dns settings
script-security 2
up /etc/openvpn/update-resolv-conf.sh
down /etc/openvpn/update-resolv-conf.sh
comp-lzo
verb 3
socks-proxy-retry
socks-proxy <obfsproxy-client-inside-country-ip> 80
The client connecting:
# openvpn client.conf
Wed Jan 14 14:52:15 2015 OpenVPN 2.3.6 x86_64-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Dec 2 2014
Wed Jan 14 14:52:15 2015 library versions: OpenSSL 1.0.1j 15 Oct 2014, LZO 2.08
Wed Jan 14 14:52:15 2015 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Wed Jan 14 14:52:15 2015 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Wed Jan 14 14:52:15 2015 Socket Buffers: R=[87380->131072] S=[16384->131072]
Wed Jan 14 14:52:15 2015 Attempting to establish TCP connection with [AF_INET]<ip-obfsproxy-server-outside-county>:80 [nonblock]
Wed Jan 14 14:52:16 2015 TCP connection established with [AF_INET]<ip-obfsproxy-server-outside-country>:80
Wed Jan 14 14:52:19 2015 TCPv4_CLIENT link local: [undef]
Wed Jan 14 14:52:19 2015 TCPv4_CLIENT link remote: [AF_INET]<ip-obfsroxy-server-outside-country>:80
Wed Jan 14 14:53:19 2015 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Wed Jan 14 14:53:19 2015 TLS Error: TLS handshake failed
Wed Jan 14 14:53:19 2015 Fatal TLS error (check_tls_errors_co), restarting
Wed Jan 14 14:53:19 2015 SIGUSR1[soft,tls-error] received, process restarting
The server:
Wed Jan 14 14:52:05 2015 TCP connection established with [AF_INET]<ip-obfsproxy-server>:51460
Wed Jan 14 14:52:07 2015 172.31.37.18:51460 TLS: Initial packet from [AF_INET]<ip-obfsproxy-server>:51460, sid=c10ab5ea 0fabfbe7
Wed Jan 14 14:52:07 2015 172.31.37.18:51460 Connection reset, restarting [0]
Wed Jan 14 14:52:07 2015 172.31.37.18:51460 SIGUSR1[soft,connection-reset] received, client-instance restarting
Wed Jan 14 14:52:19 2015 TCP connection established with [AF_INET]<ip-obfsproxy-server>:51461
Wed Jan 14 14:52:19 2015 172.31.37.18:51461 TLS: Initial packet from [AF_INET]<ip-obfsproxy-server>:51461, sid=a251140d 178b4839
Wed Jan 14 14:52:19 2015 172.31.37.18:51461 Connection reset, restarting [0]
Wed Jan 14 14:52:19 2015 172.31.37.18:51461 SIGUSR1[soft,connection-reset] received, client-instance restarting
Wed Jan 14 14:53:28 2015 TCP connection established with [AF_INET]<ip-obfsproxy-server>:51462
Wed Jan 14 14:53:28 2015 172.31.37.18:51462 Connection reset, restarting [0]
Wed Jan 14 14:53:28 2015 172.31.37.18:51462 SIGUSR1[soft,connection-reset] received, client-instance restarting
Its like the OpenVPN server is not awaye its being accessed trough a socks proxy.
Server OpenVPN version:
OpenVPN 2.3.2 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Dec 1 2014
Client OpenVPN version:
OpenVPN 2.3.6 x86_64-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Dec 2 2014 library versions: OpenSSL 1.0.1j 15 Oct 2014, LZO 2.08
Obfsproxy version
Git commit 64aeb8d880cf64eb22d80b3f07f97154c08a28ec
Any ideas welcome.
Thanks in advance.
