Error: UDP works fine; TCP unable to connect

Snypy

Hello everyone,

My VPN server is installed on a Ubuntu 14.04 x64 VPS by DigitalOcean. It is running fine over UDP; however, I cannot get it to work over TCP. I need to use TCP due to the DPI. Later, I will use stunnel to protect my VPN tunnel from the DPI. Stunnel must use 443/TCP, so I want to use 1194/TCP for OpenVPN.

I believe the problem is in the fact that the client is for some reasons trying to connect to the port 443, instead of 1194.

Thank you in advance for your help!

The client's log file:

configuration file.
Sun Aug 30 03:27:06 2015 OpenVPNAS 2.3_ASC12f Windows-MSVC [SSL (OpenSSL)] [LZO] [NOSCRIPTS] [IPv6] built on Jul 30 2015
Sun Aug 30 03:27:06 2015 library versions: OpenSSL 1.0.2d 9 Jul 2015, LZO 2.06
Sun Aug 30 03:27:07 2015 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Sun Aug 30 03:27:07 2015 Attempting to establish TCP connection with [AF_INET]122.182.121.91:443
Sun Aug 30 03:27:07 2015 TCP connection established with [AF_INET]122.182.121.91:443
Sun Aug 30 03:27:08 2015 HTTP proxy returned bad status
Sun Aug 30 03:27:08 2015 SIGUSR1[soft,init_instance] received, process restarting
[code]

[b]Client:[/b]
[code]client
port 1194
proto tcp
nobind
dev tun
redirect-gateway def1 bypass-dhcp
remote 122.182.121.91
comp-lzo yes

Server:

server 10.8.0.0 255.255.255.0
verb 5
duplicate-cn
key server-key.pem
ca ca.pem
cert server-cert.pem
dh dh.pem
keepalive 10 120
persist-key
persist-tun
comp-lzo
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

user nobody
group nogroup

proto tcp
port 1194
dev tun1194
status openvpn-status-1194.log

Note: 122.182.121.91 is not the real public IP address of the server.

ABauer

Hi,

please check you server configuration.

You cannot connect to 1194/tcp because this is, by default, configured for UDP. This won't work.

Can you reconfigure the TCP port on the server (default 443) to another port like 8443?
Then adjust the client config and make sure you can reach the port (telnet).

Cheers!

Traffic

Snypy wroteI believe the problem is in the fact that the client is for some reasons trying to connect to the port 443, instead of 1194.

Thank you in advance for your help!

The client's log file:
Code:
configuration file.
Sun Aug 30 03:27:06 2015 OpenVPNAS 2.3_ASC12f Windows-MSVC [SSL (OpenSSL)] [LZO] [NOSCRIPTS] [IPv6] built on Jul 30 2015
Sun Aug 30 03:27:06 2015 library versions: OpenSSL 1.0.2d 9 Jul 2015, LZO 2.06
Sun Aug 30 03:27:07 2015 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Sun Aug 30 03:27:07 2015 Attempting to establish TCP connection with [AF_INET]122.182.121.91:443

The client is trying TCP:443 not 1194 ..

Which means this is not the config file in use:

Snypy wroteClient:

client
port 1194
proto tcp[/quote]

[quote="ABauer"]You cannot connect to 1194/tcp because this is, by default, configured for UDP. This won't work[/quote]This will work fine if configured correctly.

ABauer

Traffic wrote
ABauer wroteYou cannot connect to 1194/tcp because this is, by default, configured for UDP. This won't work
This will work fine if configured correctly.

^^ Yes, if configured correctly.
But if the default config is used, this won't work.

Traffic

The OP's posted config shows:

Snypy wroteClient:
code:
client
port 1194
proto tcp

Snypy wroteServer:
code:
server 10.8.0.0 255.255.255.0
proto tcp
port 1194

Which is correct - Although the log shows that is not the config in use by the client.

Another option would be like so:

remote 122.182.121.91  1194  tcp

ABauer

@Traffic: Sorry, you're right :roll: . I really overlooked this. :shock: