Clem_E
Hi everyone,
I am struggling trying to understand what is going on here.
I have an OpenVPN Server and Plex Media Server (http://PMS) running on a dedicated server
I have an OpenVPN Client loaded on my iPhone (iOS 9.3.1).
I want to connect to PMS webserver on port 32400 from my iPhone connected to the internet through Wifi.
I suspect that this port is blocked from the Wifi network since the webpage is not loading when connected to Wifi (but fine on cellular).
I thus connect my iPhone to my OpenVPN Server and try to reach http://PMS:32400 > nothing.
My (first) question is : why does the port is still blocked although I am connected through the VPN ?
Thank you for your help !!
Traffic
OpenVPN does not block any ports ..
Please see the Forum rules (top of this page)
Clem_E
Thank you for your reply.
You meant it doesn't forward any ports?
However, I noticed that some of my apps didn't work on the wifi network and after connecting my phone to my VPN, the app starts working. So I guess that OpenVpn managed to unblock something that was blocked by the network.
Traffic
Please post details of your config and log files.
Clem_E
Here's my config :
mode server
proto tcp
port 443
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
tls-auth openvpn.key 0
cipher AES-256-CBC
server 10.10.10.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 10 120
user nobody
group nogroup
chroot /etc/openvpn/jail
persist-key
persist-tun
comp-lzo
verb 3
mute 20
status openvpn-status.log
log-append /var/log/openvpn/openvpn.log
Notice : I run OpenVPN Access Server, I'm not sure if this config file (/etc/openvpn/server.conf) is used.
Since I don't have any real issue (just questions on how OpenVpn is working) I don't think that the log file will be useful.
Traffic
Clem_E wroteNotice : I run OpenVPN Access Server
- Then the config you posted is of no consequence ..
Clem_E
That was my feeling. Is there an auto-generated config file when using OpenVPN AS ?
Independently of any configuration file, I don't think that I get if OpenVpn can hide all the traffic (and I mean every request on any port) from a firewall or proxy server between the client and the server.
The Johan
> Is there an auto-generated config file when using OpenVPN AS ?
The server-side configuration is handled by using the web-based Admin UI that comes with the Access Server.
The client-side configurations are handled by using the web-based Client UI and the bundled Connect Client that come with the Access Server.
> I don't think that I get if OpenVpn can hide all the traffic
OpenVPN hides no traffic. It is a VPN system. What it can do is instruct your computer or device to send traffic for non-local subnets (so, the Internet) and local subnets (though you don't want to forward the subnet you're using locally for obvious reasons) through the VPN tunnel. The VPN server can then use routing or NAT to forward the packets. When using NAT, the traffic appears to be coming from the Access Server's own IP address.
Clem_E
So practically, if I want to communicate to exemple.com:1234 and I am connected to my vpn.com, what the proxy/firewall sees is request to vpn.com:1234.
Then my vpn server will get for me exemple.com:1234 and return the result.
I am right?
The Johan
No. What you are describing is a proxy server. OpenVPN is a not a proxy server. It is a VPN.
If your VPN client is connected to a VPN server like the Access Server product, and you have the option switched on that routes all client Internet traffic through the VPN server, and you open a webpage like
http://www.example.com on port 80, then the following happens. Your client computer will send its request to the VPN server. The VPN server alters the request by changing the original source IP address to its own IP address. Then it sends it on to the next system that will eventually take it to the target computer (
http://www.example.com). The web service on port 80 on that web server will then send a response back to the origin IP address of the request, which in this case is the Access Server's IP address. When the packet arrives back at the Access Server, the Access Server recognizes the packet as having originally been requested by the VPN client. It then alters the destination IP address of the packet and sends it on to the VPN client.
It is important to note the difference between proxy and a routing system like the Access Server; a proxy makes the request on behalf of a client, and is most usually limited to just one or two ports (ports 80 and 443 and maybe FTP TCP 21). A VPN server like the Access Server functions just like a router with NAT, like the router device you have sitting in your own network at home and in the office, that works with a private range of IP addresses and has only 1 public IP address that it uses to provide all client computers access to the Internet. And of course, just like with your home router, the traffic will appear to be coming from the router's or Access Server's IP address.
An important difference here is that the Access Server just passes the traffic on, and a proxy server makes it separate requests; a session for the client side and a session for the server side. This separation also makes caching very easy to do on a proxy server; why retrieve the same page again when you've already retrieved it for someone else a short while ago? So it's more efficient in some ways, but very rigid in other ways; it only works for browsers and some specific programs that support a proxy system. But VPN can transport pretty much any traffic.
Clem_E
Thank you very much for your clear explanations!
What I understood is that a VPN is pretty much like a router.
My company always told us to connect to the VPN when traveling outside of the company network (like hotspots). I thought it was for security reasons in order to avoid any spying of the traffic from the hotspot network but it is actually just to be connected to the company network (in order to have a local IP address) and avoid opening it to the Internet so that employees traveling can access to the company resources. I guess...
What is interesting is that certain apps that are not loading when I am connected on a restricted network, are working well when I turn on my VPN. I don't see what explain this behavior based on your explanations though.
The Johan
> What I understood is that a VPN is pretty much like a router.
That's not what the definition of VPN is, but sure, the SERVER acts as a router, to facilitate access to resources.
> I thought it was for security reasons in order to avoid any spying of the traffic from the hotspot network
That's one reason to use a VPN, yes. Making a comparison to trucks and packages, the trucks themselves are closed, you don't see what's in them. These trucks go over the hotspot network and over the Internet to the VPN server. Once at the VPN server, the contents, the packages in the trucks, are unpacked. Any responses back go into those same trucks back to the VPN client and unpacked there.
I am wasting a lot of time on explaining VPN. This really is the most basic level of knowledge you should have of a VPN solution before even considering using it.
> I don't see what explain this behavior based on your explanations though.
Well, then you're not looking well enough. If a direct connection from your client computer over a hotspot network is restricted, that is because of something blocking you locally, in the hotspot router or their internet provider or whatever. If you are able to get a VPN tunnel connected to a server elsewhere, that has Internet access without these restrictions, and you are able to get network packets sent there, through the VPN tunnel, and get responses back through the VPN tunnel as well, then you'll be able to take advantage of the Internet connection that the VPN server enjoys, and bypass the local restrictions.
Clem_E
The thing is that I see a lot of contradictions in the replies of this topic.
In your last response, you said that a VPN can avoid spying packets from a hotspot network but back in your first reply you told me that a VPN can't hide the traffic (at least its content).
Nonetheless, I am grateful that you still reply to my questions even if it is a waste of your time..
The Johan
I had to go back to read again what you wrote, and now that things are clearer (for the both of us) I now finally understand this sentence you wrote, the way you meant it. I didn't understand it completely before.
> Independently of any configuration file, I don't think that I get if OpenVpn can hide all the traffic (and I mean every request on any port) from a firewall or proxy server between the client and the server.
To explain this with the trucks and packages analogy again; yes, OpenVPN _CAN_ hide all the PACKETS of traffic that are sent in the TRUCKS. From the point of view of the firewall or proxy server that you are running your VPN tunnel through, it only sees a bunch of trucks but it has no idea what's in them. The packages of information are packed at your VPN client into these trucks, the trucks go onto the network, through the firewall/proxy server, and to the target VPN server, and there the packets of information are unpacked. Vice-versa the same goes.
Clem_E
Great! I'm relieved 'cause I thought what I think I knew on VPN was totally wrong. I like your analogy to trucks.
So back to my first question, I noticed that even connected to my VPN, when I made requests to my Apache web server, the IP address logged is the IP of the router and not the IP of my VPN server. However, websites like "whatsmyip" display the IP of the VPN server. Is this because of the requests made on a specific port?
Maybe the trucks only hide the content of the packets but not the destination of it (I mean the port) ?
The Johan
> when I made requests to my Apache web server,
Where is this Apache web server located exactly? Check with traceroute in the command prompt exactly which path the traffic follows from your VPN client system to the target Apache web server.
> the IP address logged is the IP of the router
Which router?
> websites like "whatsmyip" display the IP of the VPN server
That should be correct, yes.
> Is this because of the requests made on a specific port?
Port should be irrelevant here. Check with traceroute to see where the traffic goes if you try to reach the target web server.
I suppose it is possible that if your web browser is configured to automatically configure proxy servers, that a local proxy server might somehow get configured on your system, and if it is a local proxy server, then it is local traffic, and local traffic doesn't get rerouted through the VPN server... I guess this is a possibility, at least.
> Maybe the trucks only hide the content of the packets but not the destination of it (I mean the port) ?
To continue the analogy, ports are like the contents of the packages that go in the truck. The truck goes to a location, the packages inside the truck stay in the truck, and the contents of the packages in the truck stay within the packages in the truck. They all travel together.
Clem_E
> Where is this Apache web server located exactly?
It's located on the same server where Access Server is running. Maybe that's a particular configuration...
> Which router?
The log shows the public ip address of the hotspot that provides me the internet.
> Traceroute
From: Local address of the hotspot (192.168.2.1)
To: Public address of my server
Looks the same whether I'm connected through my VPN or not.
The Johan
> It's located on the same server where Access Server is running. Maybe that's a particular configuration...
Yeah no need to look further; this is the issue entirely. And for a very good reason.
Your client computer is being told that all the traffic you're sending out (the payload) should go into the VPN adapter on your local computer. The VPN program on your computer then encrypts this and encapsulates this in VPN packets (the transport). To ensure that the VPN transport packets make it to the VPN server, an exception is made specifically for the IP address of the VPN server. So the VPN transport packets go directly to the VPN server. So all the traffic EXCEPT the traffic to the VPN server itself, goes into the VPN tunnel. Otherwise, if you don't make this exception, all the transport traffic would just loop back into the VPN tunnel adapter as payload, and get re-encrypted and encapsulated, and sent out into new transport packets which would then loop back into the VPN tunnel ad infinitum.
So, any services you run on the IP address of the VPN server itself will not go through the VPN tunnel.
