Stuck on management state help with translating log output

leptserkhan

Below find my windows openvpn logs on windows 10. This laptop client can connect no problem from my home network to my OpenVpn server, but when going to an internet cafe, gets stuck on "Management State".

Thu Dec 17 15:02:49 2015 OpenVPN 2.3.9 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Dec 16 2015
Thu Dec 17 15:02:49 2015 library versions: OpenSSL 1.0.1q 3 Dec 2015, LZO 2.09
Enter Management Password:
Thu Dec 17 15:02:49 2015 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Thu Dec 17 15:02:49 2015 Need hold release from management interface, waiting...
Thu Dec 17 15:02:50 2015 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Thu Dec 17 15:02:50 2015 MANAGEMENT: CMD 'state on'
Thu Dec 17 15:02:50 2015 MANAGEMENT: CMD 'log all on'
Thu Dec 17 15:02:50 2015 MANAGEMENT: CMD 'hold off'
Thu Dec 17 15:02:50 2015 MANAGEMENT: CMD 'hold release'
Thu Dec 17 15:02:50 2015 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Thu Dec 17 15:02:50 2015 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Dec 17 15:02:50 2015 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Dec 17 15:02:50 2015 Socket Buffers: R=[65536->65536] S=[65536->65536]
Thu Dec 17 15:02:50 2015 UDPv4 link local: [undef]
Thu Dec 17 15:02:50 2015 UDPv4 link remote: [AF_INET]xxx.xxx.xxx.xxx:443
Thu Dec 17 15:02:50 2015 MANAGEMENT: >STATE:1450382570,WAIT,,,
Thu Dec 17 15:02:52 2015 SIGTERM[hard,] received, process exiting
Thu Dec 17 15:02:52 2015 MANAGEMENT: >STATE:1450382572,EXITING,SIGTERM,,

Does "SIGTERM[hard,] received, process exiting" mean the server is sending back an exit code or is the local cafe router doing so?
FYI: there are no other clients currnelty attempting a connect so concurrent connections can not be a problem from the server side, I presume.

Traffic

leptserkhan wrote This laptop client can connect no problem from my home network to my OpenVpn server

Is your server at Home and what version of OpenVPN is the server ?

leptserkhan

Below is server information. Server is at an ISP and it has worked flawlessly for many years with regular updates

OpenVPN 2.3.7 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jul 8 2015
library versions: OpenSSL 1.0.2d 9 Jul 2015, LZO 2.08
Originally developed by James Yonan
Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net>
Compile time defines: enable_crypto=yes enable_crypto_ofb_cfb=yes enable_debug=yes enable_def_auth=yes enable_dependency_tracking=no enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown enable_fast_install=yes enable_fragment=yes enable_http_proxy=yes enable_iproute2=yes enable_libtool_lock=yes enable_lzo=yes enable_lzo_stub=no enable_maintainer_mode=no enable_management=yes enable_multi=yes enable_multihome=yes enable_pam_dlopen=no enable_password_save=yes enable_pedantic=no enable_pf=yes enable_pkcs11=yes enable_plugin_auth_pam=yes enable_plugin_down_root=yes enable_plugins=yes enable_port_share=yes enable_selinux=no enable_server=yes enable_shared=yes enable_shared_with_static_runtimes=no enable_silent_rules=no enable_small=no enable_socks=yes enable_ssl=yes enable_static=yes enable_strict=no enable_strict_options=no enable_systemd=yes enable_win32_dll=yes enable_x509_alt_username=yes with_crypto_library=openssl with_gnu_ld=yes with_ifconfig_path=/sbin/ifconfig with_iproute_path=/sbin/ip with_mem_check=no with_plugindir='${prefix}/lib/openvpn' with_route_path=/sbin/route with_sysroot=n

Traffic

First off: You have posted this in the wrong board ..
This board is for Access-Server Product Support but you are running OpenVPN the Free version.
(This is not important as a mod can move it in time)

leptserkhan wroteDoes "SIGTERM[hard,] received, process exiting" mean the server is sending back an exit code or is the local cafe router doing so?

This usually means you (the user) has terminated the process. An internet cafe cannot send this signal to your client.
(at least, unless that internet cafe is run by the NSA ?)

However, the internet cafe can block your access to the server .. I recommend you reconfigure your server and client to use TCP protocol port 443 (HTTPS) for the sort of problem you are experiencing.

The next best step would be for you to post your server and client config files.

leptserkhan wrote Server is at an ISP

I would also contact the ISP and ask if there is any administration required for you to connect from sites other than your home address.

leptserkhan

thank you for your help. In the future where is the board for openvpn? I tried to find it on this forum but only open access server.

I have 100% control of the server it's a VPS. I believe that tcp might solve the problem although I can't imagine why -- UDP is flowing in and out of the router at the cafe. . .

Below is first server file, then client file.
Question, since I have two separate clients -- a linux client and a windows client -- is it wrong to have the "user" and "group" switch in the server.conf since windows does not use that (and I've removed it from the windows laptop client.conf file anyway), just wondering if I should also remove from server.conf:

local xxx.xxx.xxx.xxx
port 443
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh4096.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
# duplicate-cn
keepalive 10 120
tls-auth ta.key 0 # This file is secret
tls-server
max-clients 30
user nobody
group nogroup
persist-key
persist-tun
verb 3
mute 20
log-append /var/log/openvpn.log

and now the client file:

client
dev tun
proto udp
remote xxx.xxx.xxx.xxx 443
nobind
persist-key
persist-tun
ca ca.crt
cert laptop.crt
key laptop.key
# ns-cert-type server
remote-cert-tls server
tls-client
tls-auth ta.key 1
comp-lzo
verb 3
status openvpn-status.log
log-append openvpn.log

Traffic

leptserkhan wrotewhere is the board for openvpn?

Here: https://forums.openvpn.net/configuration-f6.html

leptserkhan wrote I believe that tcp might solve the problem although I can't imagine why

HTTPS is TCP only not UDP.

leptserkhan wroteUDP is flowing in and out of the router at the cafe. . .

That does not appear to be the case ..

leptserkhan wroteis it wrong to have the "user" and "group" switch in the server.conf

--user/--group is only supported by *nix not windows. Typically, it is used to drop privileges on the server for added protection. (Personally, I do not use it as it is too intrusive on other settings)

Now you should check your server log to see if there are any connection attempts made when you are located in the cafe, I suspect you will not see any attempts as the cafe is blocking you (which is reasonably normal for UDP port 443).

leptserkhan

Will do everything you suggested and thanks for the help. I'm learning. . .

Quick question: then when I'm connected from my home computer and have an established session with my openvpn server and I go to an https site and everything works, how is that possible, or have I been unknowingly degraded to http without my knowledge? The locked https icon still shows in the browser panel.

Traffic

That is how a VPN works ..

Try this while connected to your VPN: https://www.whatismyip.com/ ( * Note: HTTPS * )

You want to see your server IP not your client IP.

leptserkhan

Please pardon my ignorance and I'm admitting my ignorance still learning.

In a previous post you said https would not work over protocol UDP, which makes perfect sense. I get that.

But when my client connects to my openvpn server for a url to an https site, isn't that https over UDP between client and server?

What am I missing here?

Traffic

leptserkhan wrotePlease pardon my ignorance and I'm admitting my ignorance still learning.

Yep .. me2 8-)

leptserkhan wroteIn a previous post you said https would not work over protocol UDP, which makes perfect sense. I get that

I did not say what I think you think I said .. ?!?

HTTPS is Protocol TCP port 443 only. Therefore Protocol UDP port 443 is not HTTPS. You need to learn the difference between TCP and UDP.

leptserkhan wroteBut when my client connects to my openvpn server for a url to an https site, isn't that https over UDP between client and server?

What am I missing here?

What you are missing is: The VPN is totally transparent .. the HTTP/S protocol sent over a VPN is encapsulated and encrypted by the VPN (Virtual Private Network). A VPN allows you to securely connect to another location (this is similar to https but not the same). The packets sent over a VPN are not "aware of" or "part of" that VPN .. I recommend a little reading about VPNs.

leptserkhan

Let me rephrase.

I completely understand the difference between UDP and TCP.

The original post was about why a router was not allowing me to connect to my openvpn server. The solution was to use TCP instead of UDP. Although I know that sending packets over to port 443 via UDP is certainly NOT https, I asked how can a protocol which is required to use TPC on port 443 still allow me to connect via https whilst the client is connecting to my opevpn server on port 443 using UDP.

Wouldn't the correct answer would have been that the connection between my openpvn server and the destination (https) website is indeed using TCP over port 443, whilst the tunnel between my client and openvpn server is UDP on port 443.

No?

Traffic

No! .. it is still possible to connect to an https website over a VPN configured to use the same protocol/port combination as https. It is recommended that you use UDP for your VPN for general performance .. and to avoid "TCP in TCP wrapping". This is offered by OpenVPN as an explanation:
http://sites.inka.de/~bigred/devel/tcp-tcp.html