I can connect the openvpn without stunnel. But our clients in china are having truble. I try to see whether stunnel can help.
I have openvpn runging on centos, I also installed stunnel on it. I am testing on a mac with tunnelblick and stunnel
But when I test it with stunnel, the openvpn log will show Errors:
127.0.0.1:60601 WARNING: Bad encapsulated packet length from peer (5635), which must be > 0 and <= 1563 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...]
127.0.0.1:60601 Connection reset, restarting [0]
pem was created by this
openssl req -new -x509 -days 3650 -nodes -out /etc/stunnel/stunnel.pem -keyout /etc/stunnel/stunnel.pem
my stunnel config on centos likes like that
cert = /etc/stunnel/stunnel.pem
chroot = /var/run/stunnel
setuid = nobody
setgid = nobody
pid = /stunnel.pid
client = yes
[openvpn]
accept = 8001
connect = 127.0.0.1:1194
on the Mac, stunnel like this
pid = /stunnel.pid
output = stunnel.log
#compression = zlib
sslVersion = all
options = NO_SSLv2
options = DONT_INSERT_EMPTY_FRAGMENTS
client = yes
[openvpn]
accept = 127.0.0.1:995
connect = 192.168.1.244:8001
and my openvpn client config is
client
dev tun
proto tcp
port 995
remote 127.0.0.1
cipher AES-256-CBC
resolv-retry infinite
nobind
persist-key
persist-tun
comp-lzo
verb 3
tun-mtu 1500
<ca>
-----BEGIN CERTIFICATE-----
......
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
.....
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
.....
-----END PRIVATE KEY-----
</key>
the openvpn config on centos is
port 1194
proto tcp-server
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh4096.pem
--mode server
--tls-server
--dev tun
--topology "subnet"
--push "topology subnet"
--ifconfig 10.8.0.1 255.255.255.0
--push "route-gateway 10.8.0.1"
--ifconfig-pool 10.8.0.2 10.8.0.199 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir /etc/openvpn/staticclients
keepalive 5 30
cipher AES-256-CBC
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
log /var/log/openvpn.log
log-append /var/log/openvpn.log
verb 3
