Hi All,
It is possible to use same settings from "OpenVPN Access Server Virtual Appliance for the Microsoft Hyper-V Virtualization Platform" to Raspberry OpenVPN 2.3.4-5 installation?
My issue is that the Hyper-V installation is working fine but the Raspberry installation is not connecting correct and of course not working.
Both of the two installations (appliance Hyper-V and Pi2) are on a home network and both of them use a Cisco Ironport in between. I know that the Ironport is the Issue, but I can't figure out why the Rasperry OpenVPN installation is not working.
Connection path is "PC on work" --> "Ironport" --> "Hyper-V appliance" or "Pi2".
= = = = SETUP = = = =
Device: appliance Hyper-V with version 2.0.12
Status: working
Port 443
Config: all default settings used, except TCP + 443 port
Device: Pi2 with OpenVPN with version 2.3.4-5
Status: not working
Port 443
Install script used from
https://github.com/StarshipEngineer/OpenVPN-Setup
/etc/openvpn/server.conf
local 10.1.1.206
dev tun
proto tcp
port 443
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig 10.8.0.1 10.8.0.2
push "route 10.8.0.1 255.255.255.255"
push "route 10.8.0.0 255.255.255.0"
push "route 10.1.1.206 255.255.255.0"
push "dhcp-option DNS 8.8.8.8"
push "redirect-gateway def1"
client-to-client
duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-128-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 1
Client config
client
dev tun
proto tcp
remote 333.333.33.333 443
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
ns-cert-type server
key-direction 1
cipher AES-128-CBC
comp-lzo
verb 5
mute 20
= = = = Client Error log = = = = (( connect to Pi2 ))
Tue Jan 12 15:25:45 2016 us=949388 Current Parameter Settings:
Tue Jan 12 15:25:45 2016 us=949388 config = 'iphone.ovpn'
Tue Jan 12 15:25:45 2016 us=949388 mode = 0
Tue Jan 12 15:25:45 2016 us=949388 show_ciphers = DISABLED
Tue Jan 12 15:25:45 2016 us=949388 show_digests = DISABLED
Tue Jan 12 15:25:45 2016 us=949388 show_engines = DISABLED
Tue Jan 12 15:25:45 2016 us=949388 genkey = DISABLED
Tue Jan 12 15:25:45 2016 us=949388 key_pass_file = '[UNDEF]'
Tue Jan 12 15:25:45 2016 us=950388 show_tls_ciphers = DISABLED
Tue Jan 12 15:25:45 2016 us=950388 Connection profiles [default]:
Tue Jan 12 15:25:45 2016 us=950388 proto = tcp-client
Tue Jan 12 15:25:45 2016 us=950388 local = '[UNDEF]'
Tue Jan 12 15:25:45 2016 us=950388 local_port = 0
Tue Jan 12 15:25:45 2016 us=950388 remote = '333.333.33.333'
Tue Jan 12 15:25:45 2016 us=950388 remote_port = 443
Tue Jan 12 15:25:45 2016 us=950388 remote_float = DISABLED
Tue Jan 12 15:25:45 2016 us=950388 bind_defined = DISABLED
Tue Jan 12 15:25:45 2016 us=950388 bind_local = DISABLED
Tue Jan 12 15:25:45 2016 us=950388 connect_retry_seconds = 5
Tue Jan 12 15:25:45 2016 us=950388 connect_timeout = 10
Tue Jan 12 15:25:45 2016 us=950388 NOTE: --mute triggered...
Tue Jan 12 15:25:45 2016 us=950388 268 variation(s) on previous 20 message(s) suppressed by --mute
Tue Jan 12 15:25:45 2016 us=950388 OpenVPN 2.3.10 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Jan 4 2016
Tue Jan 12 15:25:45 2016 us=950388 Windows version 6.1 (Windows 7)
Tue Jan 12 15:25:45 2016 us=950388 library versions: OpenSSL 1.0.1q 3 Dec 2015, LZO 2.09
Enter Management Password:
Tue Jan 12 15:25:45 2016 us=950388 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Tue Jan 12 15:25:45 2016 us=950388 Need hold release from management interface, waiting...
Tue Jan 12 15:25:46 2016 us=435436 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Tue Jan 12 15:25:46 2016 us=535446 MANAGEMENT: CMD 'state on'
Tue Jan 12 15:25:46 2016 us=535446 MANAGEMENT: CMD 'log all on'
Tue Jan 12 15:25:46 2016 us=551448 MANAGEMENT: CMD 'hold off'
Tue Jan 12 15:25:46 2016 us=551448 MANAGEMENT: CMD 'hold release'
Tue Jan 12 15:25:51 2016 us=845977 MANAGEMENT: CMD 'password [...]'
Tue Jan 12 15:25:51 2016 us=845977 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Tue Jan 12 15:25:51 2016 us=845977 Control Channel Authentication: tls-auth using INLINE static key file
Tue Jan 12 15:25:51 2016 us=845977 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jan 12 15:25:51 2016 us=845977 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jan 12 15:25:51 2016 us=845977 LZO compression initialized
Tue Jan 12 15:25:51 2016 us=846978 Control Channel MTU parms [ L:1560 D:1182 EF:68 EB:0 ET:0 EL:3 ]
Tue Jan 12 15:25:51 2016 us=846978 Socket Buffers: R=[8192->8192] S=[64512->64512]
Tue Jan 12 15:25:51 2016 us=846978 Data Channel MTU parms [ L:1560 D:1450 EF:60 EB:143 ET:0 EL:3 AF:3/1 ]
Tue Jan 12 15:25:51 2016 us=846978 Local Options String: 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,keydir 1,cipher AES-128-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Tue Jan 12 15:25:51 2016 us=846978 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,keydir 0,cipher AES-128-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Tue Jan 12 15:25:51 2016 us=846978 Local Options hash (VER=V4): '0bdd0804'
Tue Jan 12 15:25:51 2016 us=846978 Expected Remote Options hash (VER=V4): 'a642654b'
Tue Jan 12 15:25:51 2016 us=846978 Attempting to establish TCP connection with [AF_INET]333.333.33.333:443 [nonblock]
Tue Jan 12 15:25:51 2016 us=846978 MANAGEMENT: >STATE:1452608751,TCP_CONNECT,,,
Tue Jan 12 15:25:52 2016 us=847078 TCP connection established with [AF_INET]333.333.33.333:443
Tue Jan 12 15:25:52 2016 us=847078 TCPv4_CLIENT link local: [undef]
Tue Jan 12 15:25:52 2016 us=847078 TCPv4_CLIENT link remote: [AF_INET]333.333.33.333:443
Tue Jan 12 15:25:52 2016 us=847078 MANAGEMENT: >STATE:1452608752,WAIT,,,
Tue Jan 12 15:25:52 2016 us=940087 Connection reset, restarting [0]
Tue Jan 12 15:25:52 2016 us=940087 TCP/UDP: Closing socket
Tue Jan 12 15:25:52 2016 us=940087 SIGUSR1[soft,connection-reset] received, process restarting
Tue Jan 12 15:25:52 2016 us=940087 MANAGEMENT: >STATE:1452608752,RECONNECTING,connection-reset,,
Tue Jan 12 15:25:52 2016 us=940087 Restart pause, 5 second(s)
Tue Jan 12 15:25:56 2016 us=940487 SIGTERM[hard,init_instance] received, process exiting
Tue Jan 12 15:25:56 2016 us=940487 MANAGEMENT: >STATE:1452608756,EXITING,init_instance,,
= = = = Extract from the Hyper-V config.db = = = =
PRAGMA foreign_keys=OFF;
BEGIN TRANSACTION;
CREATE TABLE profile (
id INTEGER NOT NULL,
name VARCHAR(128) NOT NULL,
type VARCHAR(128),
PRIMARY KEY (id)
);
INSERT INTO "profile" VALUES(1,'Default',NULL);
INSERT INTO "profile" VALUES(2,'_INTERNAL',NULL);
CREATE TABLE config (
profile_id INTEGER NOT NULL,
name VARCHAR(128) NOT NULL,
value TEXT,
PRIMARY KEY (profile_id, name),
FOREIGN KEY(profile_id) REFERENCES profile (id)
);
INSERT INTO "config" VALUES(1,'vpn.server.group_pool.0','192.168.200.0/24');
INSERT INTO "config" VALUES(1,'vpn.daemon.0.client.netmask_bits','24');
INSERT INTO "config" VALUES(1,'vpn.server.port_share.ip_address','1.2.3.4');
INSERT INTO "config" VALUES(1,'vpn.daemon.0.listen.port','443');
INSERT INTO "config" VALUES(1,'auth.ldap.0.name','My LDAP servers');
INSERT INTO "config" VALUES(1,'vpn.client.routing.reroute_dns','true');
INSERT INTO "config" VALUES(1,'cs.https.ip_address','eth0');
INSERT INTO "config" VALUES(1,'vpn.server.daemon.enable','false');
INSERT INTO "config" VALUES(1,'vpn.tls_refresh.interval','360');
INSERT INTO "config" VALUES(1,'vpn.server.daemon.tcp.n_daemons','1');
INSERT INTO "config" VALUES(1,'vpn.daemon.0.listen.ip_address','eth0');
INSERT INTO "config" VALUES(1,'auth.ldap.0.timeout','4');
INSERT INTO "config" VALUES(1,'vpn.server.daemon.tcp.port','443');
INSERT INTO "config" VALUES(1,'vpn.server.port_share.port','1234');
INSERT INTO "config" VALUES(1,'cs.prof_sign_web','true');
INSERT INTO "config" VALUES(1,'cs.cws_proto_v2','true');
INSERT INTO "config" VALUES(1,'vpn.daemon.0.server.ip_address','eth0');
INSERT INTO "config" VALUES(1,'vpn.server.routing.private_access','nat');
INSERT INTO "config" VALUES(1,'vpn.daemon.0.client.network','192.168.200.0');
INSERT INTO "config" VALUES(1,'auth.pam.0.service','openvpnas');
INSERT INTO "config" VALUES(1,'auth.ldap.0.use_ssl','never');
INSERT INTO "config" VALUES(1,'vpn.server.routing.private_network.0','192.168.0.0/24');
INSERT INTO "config" VALUES(1,'vpn.server.daemon.udp.n_daemons','1');
INSERT INTO "config" VALUES(1,'sa.initial_run_groups.0','web_group');
INSERT INTO "config" VALUES(1,'sa.initial_run_groups.1','openvpn_group');
INSERT INTO "config" VALUES(1,'host.name','remote.harmveenstra.com');
INSERT INTO "config" VALUES(1,'auth.radius.0.acct_enable','false');
INSERT INTO "config" VALUES(1,'vpn.tls_refresh.do_reauth','true');
INSERT INTO "config" VALUES(1,'vpn.server.daemon.udp.port','1194');
INSERT INTO "config" VALUES(1,'vpn.server.port_share.service','admin+client');
INSERT INTO "config" VALUES(1,'admin_ui.https.port','943');
INSERT INTO "config" VALUES(1,'cs.https.port','943');
INSERT INTO "config" VALUES(1,'admin_ui.https.ip_address','eth0');
INSERT INTO "config" VALUES(1,'vpn.client.routing.reroute_gw','true');
INSERT INTO "config" VALUES(1,'auth.module.type','pam');
INSERT INTO "config" VALUES(1,'vpn.client.basic','false');
INSERT INTO "config" VALUES(1,'auth.ldap.0.ssl_verify','never');
INSERT INTO "config" VALUES(1,'vpn.daemon.0.listen.protocol','tcp');
INSERT INTO "config" VALUES(1,'auth.radius.0.name','My Radius servers');
INSERT INTO "config" VALUES(1,'vpn.server.nat.masquerade','true');
INSERT INTO "config" VALUES(1,'vpn.server.port_share.enable','true');
INSERT INTO "config" VALUES(1,'vpn.client.routing.inter_client','false');
INSERT INTO "config" VALUES(2,'run_api.active_profile','Default');
INSERT INTO "config" VALUES(2,'webui.edit_profile','Default');
INSERT INTO "config" VALUES(2,'webui.welcome_shown','true');
INSERT INTO "config" VALUES(1,'aui.eula_version','2');
INSERT INTO "config" VALUES(1,'cs.cws_ui_offer.mac','true');
INSERT INTO "config" VALUES(1,'cs.cws_ui_offer.linux','true');
INSERT INTO "config" VALUES(1,'cs.cws_ui_offer.win','true');
INSERT INTO "config" VALUES(1,'cs.cws_ui_offer.server_locked','false');
INSERT INTO "config" VALUES(1,'cs.cws_ui_offer.ios','true');
INSERT INTO "config" VALUES(1,'cs.cws_ui_offer.autologin','true');
INSERT INTO "config" VALUES(1,'cs.admin_only','true');
INSERT INTO "config" VALUES(1,'xmlrpc.relay_level','1');
INSERT INTO "config" VALUES(1,'cs.cws_ui_offer.android','true');
INSERT INTO "config" VALUES(1,'cs.cws_ui_offer.user_locked','true');
INSERT INTO "config" VALUES(1,'vpn.server.google_auth.enable','true');
INSERT INTO "config" VALUES(1,'vpn.server.routing.gateway_access','true');
INSERT INTO "config" VALUES(1,'vpn.general.osi_layer','3');
INSERT INTO "config" VALUES(1,'cs.ca_bundle','-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
');
INSERT INTO "config" VALUES(1,'cs.priv_key','-----BEGIN PRIVATE KEY-----
-----END PRIVATE KEY-----
');
INSERT INTO "config" VALUES(1,'cs.cert','-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
');
INSERT INTO "config" VALUES(1,'vpn.server.tls_version_min','default');
INSERT INTO "config" VALUES(1,'cs.ssl_reneg','false');
INSERT INTO "config" VALUES(1,'sa.ssl_lib','openssl');
INSERT INTO "config" VALUES(1,'cs.tls_version_min','default');
INSERT INTO "config" VALUES(1,'vpn.client.config_text','');
INSERT INTO "config" VALUES(1,'vpn.server.duplicate_cn','true');
INSERT INTO "config" VALUES(1,'vpn.server.config_text','');
INSERT INTO "config" VALUES(1,'vpn.client.routing.superuser_c2c_access','true');
CREATE UNIQUE INDEX ix_profile_name ON profile (name);
CREATE INDEX ix_profile_id ON profile (id);
CREATE INDEX ix_profile_type ON profile (type);
CREATE INDEX ix_config_name ON config (name);
CREATE INDEX ix_config_profile_id ON config (profile_id);
COMMIT;
Server log
Tue Jan 12 15:25:52 2016 TCP connection established with [AF_INET]444.444.44.444:52741
Tue Jan 12 15:25:52 2016 444.444.44.444:52741 WARNING: Bad encapsulated packet length from peer (5635), which must be > 0 and <= 1560 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...]
Tue Jan 12 15:25:52 2016 444.444.44.444:52741 Connection reset, restarting [0]
