Hi guys!! I have server1.conf and server2.conf that are running correctly also tre traffic is routed corretly; Server2 is linked with client2 (just same configuration of client 1 but [b]under http proxy[/b]). I follow this instruction: Configure OpenVPN on server side by adding port 443 and proto tcp-server to the configuration file. Configure OpenVPN on the client side by adding port 443, proto tcp-client and http-proxy 172.27.X.X 8080 to the configuration file. But I cannot surf: it is connected on VPN correctly but no surfing.. no traffic after connection estabilish.. :x Should I set a particular rule to iptable? Like: "iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to-source 172.27.X.X? (172.27.X.X proxy http server) It could work? Can the VPS server has both rules? "iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to-source 172.27.X.X (proxy http)" and "iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to-source 185.115.243.227 (vps) ??? Any suggestions? Thanks guys for helping me :)

[quote="willy87"]how can I surf behind my http proxy![/quote]--[b]redirect-gateway[/b] etc .. [quote="willy87"]Can the VPS server has both rules? "iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to-source 172.27.X.X (proxy http)" [b]and[/b] "iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to-source 185.115.243.227 (vps) ???[/quote]These rule will [u]not[/u] work .. However: [quote="willy87"]SERVER [code]port 1194 proto tcp server 10.8.0.0 255.255.255.0[/code][/quote]vs Server 2 [quote="willy87"][code]port 443 proto tcp-server server 10.8.0.0 255.255.255.0[/code][/quote] [list]any [url=http://en.wikipedia.org/wiki/Private_network]RFC1918[/url] address can be use for --[b]server[/b] .. f.e [oconf=server 2]server 10.11.0.0 255.255.255.0[/oconf]and adjust iptables rules .. :ugeek:[/list]

Hi Traffic! Thanks for your reply! I didn't understand well.. So I am a newbbb :geek: 1) What can I modify and adjust in Iptables? 2)And I should insert this in server2.conf instead of old one? [code]server 10.11.00 255.255.255.0[/code] I explain better: I need to use VPN with 2 different wifi network: Server1 and client1 = normal 3G data o free wifi networks Server2 and client2 = work network under http proxy With privatetunnel.ovpn i simply switch between networks through openVPN settings - proxy button enable/disable If I do the same with server1.conf and client1.ovpn i receive HTTP proxy error.. 3) It could be hard to built same configuration of privatetunnel with my home made VPN? Really Thanks for help me! :? Server

EDIT: What about this iptables rules for my VPS? Check specially last 3 parts please.. It would be marvellous if we do it! [code]*filter # Allow all loopback (lo) traffic and reject traffic # to localhost that does not originate from lo. -A INPUT -i lo -j ACCEPT -A INPUT ! -i lo -s 127.0.0.0/8 -j REJECT -A OUTPUT -o lo -j ACCEPT # Allow ping and ICMP error returns. -A INPUT -p icmp -m state --state NEW --icmp-type 8 -j ACCEPT -A INPUT -p icmp -m state --state ESTABLISHED,RELATED -j ACCEPT -A OUTPUT -p icmp -j ACCEPT # Allow SSH. -A INPUT -i eth0 -p tcp -m state --state NEW,ESTABLISHED --dport 22 -j ACCEPT -A OUTPUT -o eth0 -p tcp -m state --state ESTABLISHED --sport 22 -j ACCEPT # Allow UDP traffic on port 1194. -A INPUT -i eth0 -p udp -m state --state NEW,ESTABLISHED --dport 1194 -j ACCEPT -A OUTPUT -o eth0 -p udp -m state --state ESTABLISHED --sport 1194 -j ACCEPT # Allow DNS resolution and limited HTTP/S on eth0. # Necessary for updating the server and keeping time. -A INPUT -i eth0 -p udp -m state --state ESTABLISHED --sport 53 -j ACCEPT -A OUTPUT -o eth0 -p udp -m state --state NEW,ESTABLISHED --dport 53 -j ACCEPT -A INPUT -i eth0 -p tcp -m state --state ESTABLISHED --sport 53 -j ACCEPT -A OUTPUT -o eth0 -p tcp -m state --state NEW,ESTABLISHED --dport 53 -j ACCEPT -A INPUT -i eth0 -p tcp -m state --state ESTABLISHED --sport 80 -j ACCEPT -A OUTPUT -o eth0 -p tcp -m state --state NEW,ESTABLISHED --dport 80 -j ACCEPT -A INPUT -i eth0 -p tcp -m state --state ESTABLISHED --sport 443 -j ACCEPT -A OUTPUT -o eth0 -p tcp -m state --state NEW,ESTABLISHED --dport 443 -j ACCEPT # Allow traffic on the TUN interface. -A INPUT -i tun0 -j ACCEPT -A FORWARD -i tun0 -j ACCEPT -A OUTPUT -o tun0 -j ACCEPT # Allow forwarding traffic only from the VPN. -A FORWARD -i tun0 -o eth0 -s 10.8.0.0/24 -j ACCEPT -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT # Log any packets which don't fit the rules above... # (optional but useful) -A INPUT -m limit --limit 3/min -j LOG --log-prefix "iptables_INPUT_denied: " --log-level 4 -A FORWARD -m limit --limit 3/min -j LOG --log-prefix "iptables_FORWARD_denied: " --log-level 4 -A OUTPUT -m limit --limit 3/min -j LOG --log-prefix "iptables_OUTPUT_denied: " --log-level 4 # then reject them. -A INPUT -j REJECT -A FORWARD -j REJECT -A OUTPUT -j REJECT # Forwarding traffic VPS (thks to Traffic usr) iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to-source 185.115.243.227 #Forwarding traffic to HTTP Proxy iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 172.27.153.206:4040 iptables -t nat -A POSTROUTING -p tcp -d 172.27.153.206 --dport 4040 -j MASQUERADE -A FORWARD -p tcp -d 172.27.153.206 --dport 80 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT or #Forwarding traffic to HTTP Proxy iptables -t nat -A POSTROUTING -s 10.11.0.0/24 -j SNAT --to-source 172.27.153.206:4040 COMMIT[/code]

EDIT2: What about that rules? It could be good? Please help me ;) [code]# Forwarding traffic VPS (thks to Traffic usr) iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to-source 185.115.243.227 #Forwarding traffic to HTTP Proxy iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 172.27.153.206:4040 iptables -t nat -A POSTROUTING -p tcp -d 172.27.153.206 --dport 4040 -j MASQUERADE -A FORWARD -p tcp -d 172.27.153.206 --dport 80 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT or #Forwarding traffic to HTTP Proxy iptables -t nat -A POSTROUTING -s 10.11.0.0/24 -j SNAT --to-source 172.27.153.206:4040 or #Forwarding traffic to HTTP Proxy # iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j DNAT --to 172.27.153.206:4040 # iptables -A FORWARD -p tcp -d 172.27.153.206 --dport 4040 -j ACCEPT[/code]

up any news guys? I'm waiting your feed. I don't want to destroy my vps connection :) thankss

it doens't work.. also after "service openvpn restart".. no traffic after connection VPN server2 [code]port 443 proto tcp-server dev tun ca ca.crt cert server.crt key server.key dh dh2048.pem server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "redirect-gateway def1 bypass-dhcp" push "dhcp-option DNS 8.8.8.8" keepalive 10 120 comp-lzo user nobody group nogroup persist-key persist-tun status openvpn-status.log verb 3[/code] client2 [code]client dev tun proto tcp-client remote 185.115.243.227 443 http-proxy 172.27.153.206 4040 resolv-retry infinite nobind persist-key persist-tun mute-replay-warnings ns-cert-type server comp-lzo verb 3 set CLIENT_CERT 0[/code] IPTABLES-RULE2: [code]iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to-source 172.27.153.206[/code] ( 172.27.153.206=proxy http) I tried also because port is 4040 but it showing error [code]iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to-source 172.27.153.206:4040[/code]( 172.27.153.206=proxy http)

up any news guys? I'm waiting your feed. I don't want to destroy my vps connection :) thankss

[quote="willy87"]server2 [code]server 10.8.0.0 255.255.255.0[/code][/quote]Can this [b]server2[/b] browse the internet via the proxy ?

Debian VPS <->Iphone client - HTTP proxy VPN traffic problem

willy87

eheh books..but for sure there is something wrong in the iptables.. because i can surf through vps without http proxy.
but i know also that i can surf normally with http proxy but not after VPN estabilished..

anyone know why?
thks!

willy87

SOLVED!! 😃 😃 😃
I just deleted all iptables rules and I set:

"iptables -t nat -A POSTROUTING -s 10.11.0.0/24 -j SNAT --to-source 185.115.243.227 (vps)

and

"iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to-source 185.115.243.227 (vps)

Instead ...to source 172.27.X.X (proxy HTTP)!!

Thanks guysssss!!

Traffic

Thanks for letting us know your solution 8-)

willy87

Hi guys! Thanks really for your help in This post!
I Just need to set perfectly my server.
I would like to delete timeout connection because i would avoid disconnetions from my vpn. I Just need VPN always connected when i am connected with wifi of course.

Thks

Server:

port 443
proto tcp-server
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 4

FalconTent

willy87 wroteI would like to delete timeout connection because i would avoid disconnetions from my vpn

If your VPN is timing out then there is a problem with your network ..

willy87

Sure? Because I tried also from home wifi network and i checked that when the iPhone is lock or after 30 seconds.. Wifi is still on but no more VPN connection.. :-(

FalconTent

I believe this is to do with aggressive battery saving setting which closes openvpn .. see your iPhone log file.

willy87

Hi guys!
What I should do if i change my VPS IP? Because I need to change just the ip address!
Because I changed the client configuration modifying just the IP and then I type because of new IP (212.8.251.91)

iptables -t nat -A POSTROUTING -s 10.11.0.0/24 -j SNAT --to-source 212.8.251.91
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to-source 212.8.251.91

Should I remove before all rules and add only these 2 or what?

In the openvpn software i see that i am connected but no surfing.. something with port forwarding or.. ?

thanks for helping me

willy87

ok solved by myself 🙂

just add these

iptables -t nat -A POSTROUTING -s 10.11.0.0/24 -j SNAT --to-source 212.8.251.91
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to-source 212.8.251.91

on iptables rules and sudo reboot! 🙂

[deleted]

Hello, I have problem in the same server. I found my device often disconneted even with
keepalive 10 60 command setted

I would like that my VPN will be never disconnected and stay always on

I assume that my internet connection is OK

server:

port 443
proto tcp-server
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
server 10.9.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
keepalive 10 60
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 4

client:

client
dev tun
proto tcp-client
remote XXX 443
resolv-retry infinite
nobind
persist-key
persist-tun
http-proxy-retry # retry on connection failures
http-proxy XXX55555
mute-replay-warnings
ns-cert-type server
comp-lzo
verb 3
set CLIENT_CERT 0

log:

2018-01-20 13:51:20 EVENT: CONNECTED @212.8.251.91:443 (172.24.249.205) via /TCPv4-via-HTTP on NetworkExtensionTUN/10.9.0.6/ gw=[/]

2018-01-20 13:55:29 OS Event: SLEEP

2018-01-20 13:55:29 EVENT: PAUSE

2018-01-20 13:58:25 OS Event: WAKEUP

2018-01-20 13:58:28 RESUME TEST: Internet:ReachableViaWiFi/-R t------

2018-01-20 13:58:28 STANDARD RESUME

2018-01-20 13:58:28 EVENT: RESUME

2018-01-20 13:58:28 EVENT: RECONNECTING

2018-01-20 13:58:28 Contacting [172.24.249.205]:55555/TCP via HTTP Proxy

2018-01-20 13:58:28 EVENT: WAIT_PROXY

2018-01-20 13:58:28 EVENT: WAIT

2018-01-20 13:58:28 TO PROXY: CONNECT 212.8.251.91:443 HTTP/1.0

Host: 212.8.251.91


2018-01-20 13:58:30 FROM PROXY: HTTP/1.1 200 Connection established


2018-01-20 13:58:30 Connecting to [212.8.251.91]:443 (172.24.249.205) via TCPv4-via-HTTP

2018-01-20 13:58:31 EVENT: CONNECTING

2018-01-20 13:58:31 Tunnel Options:V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client

2018-01-20 13:58:31 Creds: UsernameEmpty/PasswordEmpty

2018-01-20 13:58:31 Peer Info:

IV_GUI_VER=net.openvpn.connect.ios 1.2.6-4

IV_VER=3.1.2

IV_PLAT=ios

IV_NCP=2

IV_TCPNL=1

IV_PROTO=2

IV_LZO=1

IV_IPv6=0

IV_AUTO_SESS=1

IV_BS64DL=1


2018-01-20 13:58:38 VERIFY OK : depth=1

cert. version     : 3

serial number     : 93:8D:1A:CD:64:84:97:C9

issuer name       : C=NL, ST=AM, L=Amsterdam, O=ServerBabbo, OU=MyOrganizationalUnit, CN=ServerBabbo CA, ??=server, emailAddress=me@myhost.mydomain

subject name      : C=NL, ST=AM, L=Amsterdam, O=ServerBabbo, OU=MyOrganizationalUnit, CN=ServerBabbo CA, ??=server, emailAddress=me@myhost.mydomain

issued  on        : 2016-04-26 17:43:50

expires on        : 2026-04-24 17:43:50

signed using      : RSA with SHA-256

RSA key size      : 2048 bits

basic constraints : CA=true


2018-01-20 13:58:38 VERIFY OK : depth=0

cert. version     : 3

serial number     : 01

issuer name       : C=NL, ST=AM, L=Amsterdam, O=ServerBabbo, OU=MyOrganizationalUnit, CN=ServerBabbo CA, ??=server, emailAddress=me@myhost.mydomain

subject name      : C=NL, ST=AM, L=Amsterdam, O=ServerBabbo, OU=MyOrganizationalUnit, CN=server, ??=server, emailAddress=me@myhost.mydomain

issued  on        : 2016-04-26 17:44:12

expires on        : 2026-04-24 17:44:12

signed using      : RSA with SHA-256

RSA key size      : 2048 bits

basic constraints : CA=false

subject alt name  : server

cert. type        : SSL Server

key usage         : Digital Signature, Key Encipherment

ext key usage     : TLS Web Server Authentication


2018-01-20 13:58:43 SSL Handshake: TLSv1.0/TLS-DHE-RSA-WITH-3DES-EDE-CBC-SHA

2018-01-20 13:58:43 Session is ACTIVE

2018-01-20 13:58:43 EVENT: GET_CONFIG

2018-01-20 13:58:43 Sending PUSH_REQUEST to server...

2018-01-20 13:58:44 Sending PUSH_REQUEST to server...

2018-01-20 13:58:46 OPTIONS:

0 [redirect-gateway] [def1] [bypass-dhcp] 

1 [dhcp-option] [DNS] [208.67.222.222] 

2 [dhcp-option] [DNS] [208.67.220.220] 

3 [route] [10.9.0.1] 

4 [topology] [net30] 

5 [ping] [10] 

6 [ping-restart] [60] 

7 [ifconfig] [10.9.0.6] [10.9.0.5] 

8 [block-ipv6] 


2018-01-20 13:58:46 PROTOCOL OPTIONS:

  cipher: BF-CBC

  digest: SHA1

  compress: LZO

  peer ID: -1

2018-01-20 13:58:46 EVENT: ASSIGN_IP

2018-01-20 13:58:46 NIP: preparing TUN network settings

2018-01-20 13:58:46 NIP: init TUN network settings with endpoint: 172.24.249.205

2018-01-20 13:58:46 NIP: adding IPv4 address to network settings 10.9.0.6/255.255.255.252

2018-01-20 13:58:46 NIP: adding (included) IPv4 route 10.9.0.1/32

2018-01-20 13:58:46 NIP: redirecting all IPv4 traffic to TUN interface

2018-01-20 13:58:46 NIP: adding DNS 208.67.222.222

2018-01-20 13:58:46 NIP: adding DNS 208.67.220.220

2018-01-20 13:58:46 NIP: blocking all IPv6 traffic - not supported

2018-01-20 13:58:46 Connected via NetworkExtensionTUN

2018-01-20 13:58:46 Per-Key Data Limit: 48000000/48000000

2018-01-20 13:58:46 LZO-ASYM init swap=0 asym=0

2018-01-20 13:58:46 EVENT: CONNECTED @212.8.251.91:443 (172.24.249.205) via /TCPv4-via-HTTP on NetworkExtensionTUN/10.9.0.6/ gw=[/]

2018-01-20 14:11:04 OS Event: SLEEP

2018-01-20 14:11:04 EVENT: PAUSE

2018-01-20 14:14:23 OS Event: WAKEUP

2018-01-20 14:14:26 RESUME TEST: Internet:ReachableViaWiFi/-R t------

2018-01-20 14:14:26 STANDARD RESUME

2018-01-20 14:14:26 EVENT: RESUME

2018-01-20 14:14:26 EVENT: RECONNECTING

2018-01-20 14:14:26 Contacting [172.24.249.205]:55555/TCP via HTTP Proxy

2018-01-20 14:14:26 EVENT: WAIT_PROXY

2018-01-20 14:14:26 EVENT: WAIT

2018-01-20 14:14:26 TO PROXY: CONNECT 212.8.251.91:443 HTTP/1.0

waiting for your kind feedback

thanks!!! 🙂 😉

« Previous Page