This is my first post here so thanks in advance for your patience. I'm trying to tunnel my OpenVPN connection through Stunnel. Connecting from a Windows 10 PC to an Amazon Linux AMI EC2 instance (14.04).
OpenVPN is able to establish a connection, then it immediately resets and tries again. I can see the Stunnel icon in my PC's system tray lighting up whenever it tries to connect. I've tried tweaking the configs on both ends multiple ways always to the same results. I've tried disabling Windows Firewall and opening up the necessary ports both through the AWS security groups and on iptables to no avail.
Judging by the log files, I think something is wrong with Stunnel on the server side, but I'm not certain. Any advice is appreciated!
OpenVPN server conf:
port 1194
proto tcp-server
dev tun1
ifconfig 10.4.0.1 10.4.0.2
push "route 10.4.0.1 255.255.255.255" ##tried with and without this
status server-tcp.log
verb 3
secret ovpn.key
OpenVPN client conf:
proto tcp-client
remote localhost 1194
port 1194
dev tun
secret ovpn.key
redirect-gateway def1
ifconfig 10.4.0.2 10.4.0.1
route ser.ver.ip 255.255.255.255 net_gateway ## tried with and without this
OpenVPN server log:
Tue May 10 23:03:02 2016 Socket Buffers: R=[87380->131072] S=[20480->131072]
Tue May 10 23:03:02 2016 TUN/TAP device tun0 opened
Tue May 10 23:03:02 2016 TUN/TAP TX queue length set to 100
Tue May 10 23:03:02 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue May 10 23:03:02 2016 /sbin/ip link set dev tun0 up mtu 1500
Tue May 10 23:03:02 2016 /sbin/ip addr add dev tun0 local 10.4.0.1 peer 10.4.0.2
Tue May 10 23:03:02 2016 Listening for incoming TCP connection on [undef]
OpenVPN client log (repeats itself after this):
[Tue May 10 17:48:47 2016 Warning: cannot open --log file: C:\Program Files\OpenVPN\log\myconfig.ssl.log: Access is denied. (errno=5)
Tue May 10 17:48:47 2016 OpenVPN 2.3.8 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Aug 4 2015
Tue May 10 17:48:47 2016 library versions: OpenSSL 1.0.1p 9 Jul 2015, LZO 2.08
Tue May 10 17:48:48 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue May 10 17:48:48 2016 open_tun, tt->ipv6=0
Tue May 10 17:48:48 2016 TAP-WIN32 device [Ethernet 3] opened: \\.\Global\{EA4413A9-3C09-4231-8753-572C7026FBB1}.tap
Tue May 10 17:48:48 2016 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.4.0.2/255.255.255.252 on interface {EA4413A9-3C09-4231-8753-572C7026FBB1} [DHCP-serv: 10.4.0.1, lease-time: 31536000]
Tue May 10 17:48:48 2016 Attempting to establish TCP connection with [AF_INET]127.0.0.1:1194 [nonblock]
Tue May 10 17:48:48 2016 TCP connection established with [AF_INET]127.0.0.1:1194
Tue May 10 17:48:48 2016 TCPv4_CLIENT link local: [undef]
Tue May 10 17:48:48 2016 TCPv4_CLIENT link remote: [AF_INET]127.0.0.1:1194
Tue May 10 17:48:58 2016 Connection reset, restarting [-1]
Tue May 10 17:48:58 2016 SIGUSR1[soft,connection-reset] received, process restarting
Stunnel server conf:
cert = /etc/stunnel/stunnel.pem
pid = /var/run/stunnel.pid
[openvpn]
accept = 4948
connect = ser.ver.ip:1194
Stunnel client conf:
[openvpn]
client = yes
;accept = 127.0.0.1:31337
accept = 1194
connect = ser.ver.ip:4948
cert = stunnel.pem
Stunnel client log:
2016.05.10 17:53:03 LOG5[59]: Service [openvpn] accepted connection from 127.0.0.1:52489
2016.05.10 17:53:13 LOG3[59]: s_connect: s_poll_wait ser.ver.ip:443: TIMEOUTconnect exceeded
2016.05.10 17:53:13 LOG5[59]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket
Stunnel server log:
May 10 23:17:03 ip-172-31-18-146 stunnel: LOG5[24951:139660572809216]: stunnel 4 .56 on x86_64-redhat-linux-gnu platform
May 10 23:17:03 ip-172-31-18-146 stunnel: LOG5[24951:139660572809216]: Compiled/ running with OpenSSL 1.0.1k-fips 8 Jan 2015
May 10 23:17:03 ip-172-31-18-146 stunnel: LOG5[24951:139660572809216]: Threading :PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Auth:LIBWRAP
May 10 23:17:03 ip-172-31-18-146 stunnel: LOG5[24951:139660572809216]: Reading c onfiguration from file /etc/stunnel/stunnel.conf
May 10 23:17:03 ip-172-31-18-146 stunnel: LOG5[24951:139660572809216]: FIPS mode is enabled
May 10 23:17:03 ip-172-31-18-146 stunnel: LOG4[24951:139660572809216]: Insecure file permissions on /etc/stunnel/stunnel.pem
May 10 23:17:03 ip-172-31-18-146 stunnel: LOG5[24951:139660572809216]: Configura tion successful
May 10 23:17:03 ip-172-31-18-146 stunnel: LOG3[24957:139660572809216]: Cannot cr eate pid file /var/run/stunnel.pid
May 10 23:17:03 ip-172-31-18-146 stunnel: LOG3[24957:139660572809216]: create: P ermission denied (13)
May 10 23:17:39 ip-172-31-18-146 sshd[24959]: Invalid user support from 117.39.6 0.82
May 10 23:17:39 ip-172-31-18-146 sshd[24959]: input_userauth_request: invalid us er support [preauth]
May 10 23:17:39 ip-172-31-18-146 sshd[24959]: Connection closed by 117.39.60.82 [preauth]
May 10 23:17:41 ip-172-31-18-146 sudo: ec2-user : TTY=pts/0 ; PWD=/var/log ; USE R=root ; COMMAND=/bin/cat secure
May 10 23:17:42 ip-172-31-18-146 sshd[24961]: Invalid user postgres from 148.251 .42.143
May 10 23:17:42 ip-172-31-18-146 sshd[24961]: input_userauth_request: invalid us er postgres [preauth]
May 10 23:17:42 ip-172-31-18-146 sshd[24961]: Received disconnect from 148.251.4 2.143: 11: Bye Bye [preauth]
