bjeffrie
I have Access Server on port 400 behind an internet facing router that maps this port to the standard 443 on the internet side. Is it possible to set the auto generated client configuration that gets downloaded to use a specific port? By default the configuration uses the port that the server is actually listing on in this case 400. I have to edit the configuration file once the client downloads to reflect the actual port 443.
If this is an obvious option I apologize but I can't seem to come up with a way to do this.
Regards
Brad :roll:
The Johan
OpenVPN Technologies support here.
We recommend that you set the port on the Access Server to the port that it can be reached at on the public facing address. Access Server takes the host name (or IP address) of the 'host name or IP address' field configured in the 'Server Network Settings' section of the Admin UI, and the port from that page, to create instructions in the configuration profiles (.ovpn files) for the clients. Making the values different while port forwarding them is not actually something we support.
You can workaround some of it by setting the Connect Client to the advanced mode, which adds the 'import from file' option in the system tray icon menu.
You can then manually download the configuration profile from the front page of the Access Server (select 'LOGIN' instead of 'CONNECT' before you click 'GO').
You can then edit that file and import it.
It is possible to replace the 'remote vpn.mycompany.com 1194 UDP' and 'remote vpn.mycompany.com 443 TCP' lines by messing with the client config directives override field in the section titled 'Advanced VPN' in the Access Server. Using that field you could do something like this;
- remote * (this removes all the lines that Access Server puts in by itself normally)
remote vpn.mycompany.com 1194 UDP (or whatever ports you use on the public facing address)
remote vpn.mycompany.com 443 TCP (or whatever ports you use on the public facing address)
We usually recommend trying UDP first as this will give you the best connectivity.
The Connect Client can also accept something called 'server locked profiles' which are dynamic and require contact with the TCP port where the web services can be reached, and unfortunately that is something that cannot be fixed with client config overrides. So that functionality will simply be broken if the ports don't match what is configured in the Access Server. So the best solution is to simply set the Access Server to the same ports that are used on the public facing address, and then it will work correctly.
