Can't access OpenVPN server from client browser: "connection was reset"

dlanced

Hi,
I'm pretty new to OpenVPN and trying to create a VPN connection to an OpenVPN server on an AWS EC2 instance running Ubuntu 14.04. My local client is running Ubuntu 16.04 from which I initiate the connection using:

sudo openvpn --config client.conf

The connection seems to work (at least when using proto tcp): I get an "Initialization Sequence Completed" message on the client, and this from the server (via /var/log/syslog - public IP address redacted):

Jun 20 15:15:50 ip-172-31-7-128 ovpn-server[4070]: client1/x.x.x.x:33938 PUSH: Received control message: 'PUSH_REQUEST'
Jun 20 15:15:50 ip-172-31-7-128 ovpn-server[4070]: client1/x.x.x.x:33938 send_push_reply(): safe_cap=940
Jun 20 15:15:50 ip-172-31-7-128 ovpn-server[4070]: client1/x.x.x.x:33938 SENT CONTROL [client1]: 'PUSH_REPLY,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)

When I try to access the server from a browser on the client, however, the page fails to load and I am told "connection was reset"
This is what I see on the server:

Jun 20 14:31:52 ip-172-31-7-128 ovpn-server[2639]: TCP connection established with [AF_INET]108.63.132.231:34776
Jun 20 14:31:52 ip-172-31-7-128 ovpn-server[2639]: x.x.x.x:34776 WARNING: Bad encapsulated packet length from peer (18245), which must be > 0 and <= 1544 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...]
Jun 20 14:31:52 ip-172-31-7-128 ovpn-server[2639]: x.x.x.x:34776 Connection reset, restarting [0]
Jun 20 14:31:52 ip-172-31-7-128 ovpn-server[2639]: x.x.x.x:34776 SIGUSR1[soft,connection-reset] received, client-instance restarting

When using proto udp, I'm told: "can't establish a connection to the server" and nothing at all happens on the server side.

Here are my config files:

server.conf [server]

port 1194
proto tcp
dev tun

ca ca.crt
cert server.crt
key server.key

dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo

user nobody
group nogroup

persist-key
persist-tun

status openvpn-status.log
verb 3

client.conf [client]

client
dev tun
proto tcp
remote 54.173.114.215 1194
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun

# Enable compression on the VPN link.
# Don't enable this unless it is also
# enabled in the server config file.
comp-lzo

verb 3

# SSL/TLS parms.
# . . .
ca ca.crt
cert client1.crt
key client1.key

<ca>
-----BEGIN CERTIFICATE-----

...etc.

Any ideas? Thanks!

TinCanTech

See your log files for full details of the openvpn versions you are running.

dlanced

TinCanTech wroteSee your log files for full details of the openvpn versions you are running.

This is from the server (on Ubuntu 14.04):

# openvpn --version
OpenVPN 2.3.2 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Dec  1 2014
Originally developed by James Yonan
Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net>
Compile time defines: enable_crypto=yes enable_debug=yes enable_def_auth=yes enable_dependency_tracking=no enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown enable_eurephia=yes enable_fast_install=yes enable_fragment=yes enable_http_proxy=yes enable_iproute2=yes enable_libtool_lock=yes enable_lzo=yes enable_lzo_stub=no enable_maintainer_mode=no enable_management=yes enable_multi=yes enable_multihome=yes enable_pam_dlopen=no enable_password_save=yes enable_pedantic=no enable_pf=yes enable_pkcs11=yes enable_plugin_auth_pam=yes enable_plugin_down_root=yes enable_plugins=yes enable_port_share=yes enable_selinux=no enable_server=yes enable_shared=yes enable_shared_with_static_runtimes=no enable_small=no enable_socks=yes enable_ssl=yes enable_static=yes enable_strict=no enable_strict_options=no enable_systemd=no enable_win32_dll=yes enable_x509_alt_username=yes with_crypto_library=openssl with_gnu_ld=yes with_ifconfig_path=/sbin/ifconfig with_iproute_path=/sbin/ip with_mem_check=no with_plugindir='${prefix}/lib/openvpn' with_route_path=/sbin/route with_sysroot=no

And this is from the client (Ubuntu 16.04):

$ openvpn --version
OpenVPN 2.3.10 i686-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Feb  2 2016
library versions: OpenSSL 1.0.2g-fips  1 Mar 2016, LZO 2.08
Originally developed by James Yonan
Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net>
Compile time defines: enable_crypto=yes enable_crypto_ofb_cfb=yes enable_debug=yes enable_def_auth=yes enable_dependency_tracking=no enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown enable_fast_install=yes enable_fragment=yes enable_http_proxy=yes enable_iproute2=yes enable_libtool_lock=yes enable_lzo=yes enable_lzo_stub=no enable_maintainer_mode=no enable_management=yes enable_multi=yes enable_multihome=yes enable_pam_dlopen=no enable_password_save=yes enable_pedantic=no enable_pf=yes enable_pkcs11=yes enable_plugin_auth_pam=yes enable_plugin_down_root=yes enable_plugins=yes enable_port_share=yes enable_selinux=no enable_server=yes enable_shared=yes enable_shared_with_static_runtimes=no enable_silent_rules=no enable_small=no enable_socks=yes enable_ssl=yes enable_static=yes enable_strict=no enable_strict_options=no enable_systemd=yes enable_win32_dll=yes enable_x509_alt_username=yes with_crypto_library=openssl with_gnu_ld=yes with_mem_check=no with_plugindir='${prefix}/lib/openvpn' with_sysroot=no

I'll start it up again using openvpn.log for logging and send those logs in just a minute...
Thanks,

dlanced

openvpn.log on server:

Mon Jun 20 15:52:19 2016 OpenVPN 2.3.2 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Dec  1 2014
Mon Jun 20 15:52:19 2016 Diffie-Hellman initialized with 2048 bit key
Mon Jun 20 15:52:19 2016 Socket Buffers: R=[87380->131072] S=[16384->131072]
Mon Jun 20 15:52:19 2016 ROUTE_GATEWAY 172.31.0.1/255.255.240.0 IFACE=eth0 HWADDR=0a:cc:8a:3d:d1:9d
Mon Jun 20 15:52:19 2016 TUN/TAP device tun0 opened
Mon Jun 20 15:52:19 2016 TUN/TAP TX queue length set to 100
Mon Jun 20 15:52:19 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Jun 20 15:52:19 2016 /sbin/ip link set dev tun0 up mtu 1500
Mon Jun 20 15:52:19 2016 /sbin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2
Mon Jun 20 15:52:19 2016 /sbin/ip route add 10.8.0.0/24 via 10.8.0.2
Mon Jun 20 15:52:19 2016 GID set to nogroup
Mon Jun 20 15:52:19 2016 UID set to nobody
Mon Jun 20 15:52:19 2016 Listening for incoming TCP connection on [undef]
Mon Jun 20 15:52:19 2016 TCPv4_SERVER link local (bound): [undef]
Mon Jun 20 15:52:19 2016 TCPv4_SERVER link remote: [undef]
Mon Jun 20 15:52:19 2016 MULTI: multi_init called, r=256 v=256
Mon Jun 20 15:52:19 2016 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Mon Jun 20 15:52:19 2016 ifconfig_pool_read(), in='client1,10.8.0.4', TODO: IPv6
Mon Jun 20 15:52:19 2016 succeeded -> ifconfig_pool_set()
Mon Jun 20 15:52:19 2016 IFCONFIG POOL LIST
Mon Jun 20 15:52:19 2016 client1,10.8.0.4
Mon Jun 20 15:52:19 2016 MULTI: TCP INIT maxclients=1024 maxevents=1028
Mon Jun 20 15:52:19 2016 Initialization Sequence Completed
Mon Jun 20 15:53:43 2016 TCP connection established with [AF_INET]x.x.x.x:33964
Mon Jun 20 15:53:44 2016 x.x.x.x:33964 TLS: Initial packet from [AF_INET]x.x.x.x:33964, sid=3ea8aaac e5eb0e29
Mon Jun 20 15:53:45 2016 x.x.x.x:33964 VERIFY OK: depth=1, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=Fort-Funston CA, name=server, emailAddress=me@myhost.mydomain
Mon Jun 20 15:53:45 2016 x.x.x.x:33964 VERIFY OK: depth=0, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=client1, name=server, emailAddress=me@myhost.mydomain
Mon Jun 20 15:53:46 2016 x.x.x.x:33964 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Jun 20 15:53:46 2016 x.x.x.x:33964 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Jun 20 15:53:46 2016 x.x.x.x:33964 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Jun 20 15:53:46 2016 x.x.x.x:33964 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Jun 20 15:53:46 2016 x.x.x.x:33964 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Mon Jun 20 15:53:46 2016 x.x.x.x:33964 [client1] Peer Connection Initiated with [AF_INET]x.x.x.x:33964
Mon Jun 20 15:53:46 2016 client1/x.x.x.x:33964 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Mon Jun 20 15:53:46 2016 client1/x.x.x.x:33964 MULTI: Learn: 10.8.0.6 -> client1/x.x.x.x:33964
Mon Jun 20 15:53:46 2016 client1/x.x.x.x:33964 MULTI: primary virtual IP for client1/x.x.x.x:33964: 10.8.0.6
Mon Jun 20 15:53:48 2016 client1/x.x.x.x:33964 PUSH: Received control message: 'PUSH_REQUEST'
Mon Jun 20 15:53:48 2016 client1/x.x.x.x:33964 send_push_reply(): safe_cap=940
Mon Jun 20 15:53:48 2016 client1/x.x.x.x:33964 SENT CONTROL [client1]: 'PUSH_REPLY,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
Mon Jun 20 15:53:54 2016 client1/x.x.x.x:33964 Connection reset, restarting [0]
Mon Jun 20 15:53:54 2016 client1/x.x.x.x:33964 SIGUSR1[soft,connection-reset] received, client-instance restarting
Mon Jun 20 15:54:20 2016 TCP connection established with [AF_INET]x.x.x.x:33966
Mon Jun 20 15:54:21 2016 x.x.x.x:33966 TLS: Initial packet from [AF_INET]x.x.x.x:33966, sid=95fbe2d1 101c2825
Mon Jun 20 15:54:22 2016 x.x.x.x:33966 VERIFY OK: depth=1, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=Fort-Funston CA, name=server, emailAddress=me@myhost.mydomain
Mon Jun 20 15:54:22 2016 x.x.x.x:33966 VERIFY OK: depth=0, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=client1, name=server, emailAddress=me@myhost.mydomain
Mon Jun 20 15:54:22 2016 x.x.x.x:33966 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Jun 20 15:54:22 2016 x.x.x.x:33966 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authenticationMon Jun 20 15:54:22 2016 x.x.x.x:33966 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Jun 20 15:54:22 2016 x.x.x.x:33966 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Jun 20 15:54:22 2016 x.x.x.x:33966 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Mon Jun 20 15:54:22 2016 x.x.x.x:33966 [client1] Peer Connection Initiated with [AF_INET]x.x.x.x:33966
Mon Jun 20 15:54:22 2016 client1/x.x.x.x:33966 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Mon Jun 20 15:54:22 2016 client1/x.x.x.x:33966 MULTI: Learn: 10.8.0.6 -> client1/x.x.x.x:33966
Mon Jun 20 15:54:22 2016 client1/x.x.x.x:33966 MULTI: primary virtual IP for client1/x.x.x.x:33966: 10.8.0.6
Mon Jun 20 15:54:25 2016 client1/x.x.x.x:33966 PUSH: Received control message: 'PUSH_REQUEST'
Mon Jun 20 15:54:25 2016 client1/x.x.x.x:33966 send_push_reply(): safe_cap=940
Mon Jun 20 15:54:25 2016 client1/x.x.x.x:33966 SENT CONTROL [client1]: 'PUSH_REPLY,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
Mon Jun 20 15:54:46 2016 TCP connection established with [AF_INET]x.x.x.x:33968
Mon Jun 20 15:54:46 2016 x.x.x.x:33968 WARNING: Bad encapsulated packet length from peer (18245), which must be > 0 and <= 1544 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...]
Mon Jun 20 15:54:46 2016 x.x.x.x:33968 Connection reset, restarting [0]
Mon Jun 20 15:54:46 2016 x.x.x.x:33968 SIGUSR1[soft,connection-reset] received, client-instance restarting
Mon Jun 20 15:54:47 2016 TCP connection established with [AF_INET]x.x.x.x:33970
Mon Jun 20 15:54:47 2016 x.x.x.x:33970 WARNING: Bad encapsulated packet length from peer (18245), which must be > 0 and <= 1544 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...]
Mon Jun 20 15:54:47 2016 x.x.x.x:33970 Connection reset, restarting [0]
Mon Jun 20 15:54:47 2016 x.x.x.x:33970 SIGUSR1[soft,connection-reset] received, client-instance restarting
Mon Jun 20 15:54:47 2016 TCP connection established with [AF_INET]x.x.x.x:33972
Mon Jun 20 15:54:47 2016 x.x.x.x:33972 WARNING: Bad encapsulated packet length from peer (18245), which must be > 0 and <= 1544 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...]
Mon Jun 20 15:54:47 2016 x.x.x.x:33972 Connection reset, restarting [0]
Mon Jun 20 15:54:47 2016 x.x.x.x:33972 SIGUSR1[soft,connection-reset] received, client-instance restarting
Mon Jun 20 15:54:47 2016 TCP connection established with [AF_INET]x.x.x.x:33974
Mon Jun 20 15:54:47 2016 x.x.x.x:33974 WARNING: Bad encapsulated packet length from peer (18245), which must be > 0 and <= 1544 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...]
Mon Jun 20 15:54:47 2016 x.x.x.x:33974 Connection reset, restarting [0]
Mon Jun 20 15:54:47 2016 x.x.x.x:33974 SIGUSR1[soft,connection-reset] received, client-instance restarting
Mon Jun 20 15:54:47 2016 TCP connection established with [AF_INET]x.x.x.x:33976
Mon Jun 20 15:54:47 2016 x.x.x.x:33976 WARNING: Bad encapsulated packet length from peer (18245), which must be > 0 and <= 1544 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...]
Mon Jun 20 15:54:47 2016 x.x.x.x:33976 Connection reset, restarting [0]
Mon Jun 20 15:54:47 2016 x.x.x.x:33976 SIGUSR1[soft,connection-reset] received, client-instance restarting
Mon Jun 20 15:54:47 2016 TCP connection established with [AF_INET]x.x.x.x:33978
Mon Jun 20 15:54:47 2016 x.x.x.x:33978 WARNING: Bad encapsulated packet length from peer (18245), which must be > 0 and <= 1544 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...]
Mon Jun 20 15:54:47 2016x.x.x.x:33978 Connection reset, restarting [0]
Mon Jun 20 15:54:47 2016 x.x.x.x:33978 SIGUSR1[soft,connection-reset] received, client-instance restarting

openvpn-status.log on server:

OpenVPN CLIENT LIST
Updated,Mon Jun 20 15:55:35 2016
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
client1,x.x.x.x:33966,5412,5455,Mon Jun 20 15:54:20 2016
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
10.8.0.6,client1,x.x.x.x:33966,Mon Jun 20 15:54:22 2016
GLOBAL STATS
Max bcast/mcast queue length,0

openvpn.log on client:

Mon Jun 20 11:54:20 2016 OpenVPN 2.3.10 i686-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Feb  2 2016
Mon Jun 20 11:54:20 2016 library versions: OpenSSL 1.0.2g-fips  1 Mar 2016, LZO 2.08
Mon Jun 20 11:54:20 2016 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Mon Jun 20 11:54:20 2016 Socket Buffers: R=[87380->87380] S=[16384->16384]
Mon Jun 20 11:54:20 2016 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Mon Jun 20 11:54:20 2016 Attempting to establish TCP connection with [AF_INET]54.173.114.215:1194 [nonblock]
Mon Jun 20 11:54:21 2016 TCP connection established with [AF_INET]54.173.114.215:1194
Mon Jun 20 11:54:21 2016 TCPv4_CLIENT link local: [undef]
Mon Jun 20 11:54:21 2016 TCPv4_CLIENT link remote: [AF_INET]54.173.114.215:1194
Mon Jun 20 11:54:21 2016 TLS: Initial packet from [AF_INET]54.173.114.215:1194, sid=55af840f c1413334
Mon Jun 20 11:54:22 2016 VERIFY OK: depth=1, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=Fort-Funston CA, name=server, emailAddress=me@myhost.mydomain
Mon Jun 20 11:54:22 2016 VERIFY OK: depth=0, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=server, name=server, emailAddress=me@myhost.mydomain
Mon Jun 20 11:54:22 2016 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Jun 20 11:54:22 2016 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Jun 20 11:54:22 2016 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Jun 20 11:54:22 2016 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Jun 20 11:54:22 2016 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Mon Jun 20 11:54:22 2016 [server] Peer Connection Initiated with [AF_INET]54.173.114.215:1194
Mon Jun 20 11:54:25 2016 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Mon Jun 20 11:54:25 2016 PUSH: Received control message: 'PUSH_REPLY,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Mon Jun 20 11:54:25 2016 OPTIONS IMPORT: timers and/or timeouts modified
Mon Jun 20 11:54:25 2016 OPTIONS IMPORT: --ifconfig/up options modified
Mon Jun 20 11:54:25 2016 OPTIONS IMPORT: route options modified
Mon Jun 20 11:54:25 2016 ROUTE_GATEWAY 192.168.0.1/255.255.255.0 IFACE=wlan0 HWADDR=20:16:d8:bf:9b:64
Mon Jun 20 11:54:25 2016 TUN/TAP device tun0 opened
Mon Jun 20 11:54:25 2016 TUN/TAP TX queue length set to 100
Mon Jun 20 11:54:25 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Jun 20 11:54:25 2016 /sbin/ip link set dev tun0 up mtu 1500
Mon Jun 20 11:54:25 2016 /sbin/ip addr add dev tun0 local 10.8.0.6 peer 10.8.0.5
Mon Jun 20 11:54:25 2016 /sbin/ip route add 10.8.0.1/32 via 10.8.0.5
Mon Jun 20 11:54:25 2016 GID set to nogroup
Mon Jun 20 11:54:25 2016 UID set to nobody
Mon Jun 20 11:54:25 2016 Initialization Sequence Completed
Mon Jun 20 11:57:39 2016 event_wait : Interrupted system call (code=4)
Mon Jun 20 11:57:39 2016 /sbin/ip route del 10.8.0.1/32
RTNETLINK answers: Operation not permitted
Mon Jun 20 11:57:39 2016 ERROR: Linux route delete command failed: external program exited with error status: 2
Mon Jun 20 11:57:39 2016 Closing TUN/TAP interface
Mon Jun 20 11:57:39 2016 /sbin/ip addr del dev tun0 local 10.8.0.6 peer 10.8.0.5
RTNETLINK answers: Operation not permitted
Mon Jun 20 11:57:39 2016 Linux ip addr del failed: external program exited with error status: 2
Mon Jun 20 11:57:39 2016 SIGINT[hard,] received, process exiting
END

TinCanTech

dlanced wroteThis is from the server (on Ubuntu 14.04):

# openvpn --version
OpenVPN 2.3.2 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Dec 1 2014

Please use up to date version.

https://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos

dlanced

TinCanTech wrote
dlanced wroteThis is from the server (on Ubuntu 14.04):

# openvpn --version
OpenVPN 2.3.2 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Dec 1 2014

Please use up to date version.

Thanks. I updated the package on the server, but now I can't connect from the client (using either tcp or udp):
Client log data:

Mon Jun 20 13:30:26 2016 Socket Buffers: R=[87380->87380] S=[16384->16384]
Mon Jun 20 13:30:26 2016 TUN/TAP device tun0 opened
Mon Jun 20 13:30:26 2016 TUN/TAP TX queue length set to 100
Mon Jun 20 13:30:26 2016 GID set to nogroup
Mon Jun 20 13:30:26 2016 UID set to nobody
Mon Jun 20 13:30:26 2016 Attempting to establish TCP connection with [AF_INET]54.173.114.215:1194 [nonblock]
Mon Jun 20 13:30:36 2016 TCP: connect to [AF_INET]54.173.114.215:1194 failed, will try again in 5 seconds: Connection timed out
Mon Jun 20 13:30:51 2016 TCP: connect to [AF_INET]54.173.114.215:1194 failed, will try again in 5 seconds: Connection timed out

As far as I can tell, the server doesn't even see the request:
Server log data:

Mon Jun 20 17:30:13 2016 OpenVPN 2.3.11 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on May 10 2016
Mon Jun 20 17:30:13 2016 library versions: OpenSSL 1.0.1f 6 Jan 2014, LZO 2.06
Mon Jun 20 17:30:14 2016 Diffie-Hellman initialized with 2048 bit key
Mon Jun 20 17:30:14 2016 Socket Buffers: R=[87380->87380] S=[16384->16384]
Mon Jun 20 17:30:14 2016 ROUTE_GATEWAY 172.31.48.1/255.255.240.0 IFACE=eth0 HWADDR=12:ad:1d:b9:70:69
Mon Jun 20 17:30:14 2016 TUN/TAP device tun0 opened
Mon Jun 20 17:30:14 2016 TUN/TAP TX queue length set to 100
Mon Jun 20 17:30:14 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Jun 20 17:30:14 2016 /sbin/ip link set dev tun0 up mtu 1500
Mon Jun 20 17:30:14 2016 /sbin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2
Mon Jun 20 17:30:14 2016 /sbin/ip route add 10.8.0.0/24 via 10.8.0.2
Mon Jun 20 17:30:14 2016 GID set to nogroup
Mon Jun 20 17:30:14 2016 UID set to nobody
Mon Jun 20 17:30:14 2016 Listening for incoming TCP connection on [undef]
Mon Jun 20 17:30:14 2016 TCPv4_SERVER link local (bound): [undef]
Mon Jun 20 17:30:14 2016 TCPv4_SERVER link remote: [undef]
Mon Jun 20 17:30:14 2016 MULTI: multi_init called, r=256 v=256
Mon Jun 20 17:30:14 2016 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Mon Jun 20 17:30:14 2016 IFCONFIG POOL LIST
Mon Jun 20 17:30:14 2016 MULTI: TCP INIT maxclients=1024 maxevents=1028
Mon Jun 20 17:30:14 2016 Initialization Sequence Completed

dlanced

I've updated to the latest build on my server (for 14.04 - "built on May 10 2016") and I'm still getting the same "connection reset" problem with my browser.
Any ideas?
Thanks,

dlanced

Interesting: when I try accessing the page from the command line using port 1194 on curl, my connection is refused (I closed port 80 on my EC2 Security Group).
Is there anything obvious and dumb I'm doing wrong?

curl -vvv 54.172.23.214:1194
* Rebuilt URL to: 54.172.23.214:1194/
*   Trying 54.172.23.214...
* connect to 54.172.23.214 port 1194 failed: Connection refused
* Failed to connect to 54.172.23.214 port 1194: Connection refused
* Closing connection 0
curl: (7) Failed to connect to 54.172.23.214 port 1194: Connection refused

TinCanTech

You cannot use curl to connect to openvpn ..

dlanced

TinCanTech wroteYou cannot use curl to connect to openvpn ..

Thanks. But any regular browser running on a machine with an active OpenVPN client configuration should normally work? I just want to make sure I'm not missing anything obvious.

TinCanTech

dlanced wrotecurl -vvv 54.172.23.214:1194

You cannot use curl to connect to an openvpn server .. openvpn protocol is not http ..

dlanced

I figured out what I was missing: I needed a way to route incoming traffic to my (Apache) web server. Adding the line

port-share localhost 80

opened everything up for me.