I freely roam on the internet but I'm highly filtered intranet. :| I think cisco series deep inspection firewall on the end because of most interfaces registered to Cisco. Also all intranet computers installed a [u]trusted root certificate[/u] owned by the organization. To see open outbound ports I scan to own personal server (1 to 65535) and get only TCP(21,80 and 443). I tested below configuration as successfully via 4G(mobile) connection but not LAN as you show: :( [b]Client logs:[/b] Sun Mar 04 17:53:49 2018 Attempting to establish TCP connection with [AF_INET]88.x.x.x:443 [nonblock] Sun Mar 04 17:53:49 2018 MANAGEMENT: >STATE:1520175229,TCP_CONNECT,,,,,, Sun Mar 04 17:53:50 2018 TCP connection established with [AF_INET]88.x.x.x:443 Sun Mar 04 17:53:50 2018 TCP_CLIENT link local: (not bound) Sun Mar 04 17:53:50 2018 TCP_CLIENT link remote: [AF_INET]88.x.x.x:443 Sun Mar 04 17:53:50 2018 MANAGEMENT: >STATE:1520175230,WAIT,,,,,, [b]After the client connection my server logs says:[/b] Sun Mar 4 17:08:18 2018 us=57589 95.x.x.x:41489 Connection reset, restarting [0] Sun Mar 4 17:08:18 2018 us=57753 95.x.x.x:41489 SIGUSR1[soft,connection-reset] received, client-instance restarting Sun Mar 4 17:08:18 2018 us=57960 TCP/UDP: Closing socket Also I tried cert authentication method with my organization's Root CA cert in client configuration but result was same. I think the firewall configured to pass TCP443 and not secure connection to inspect it. Is there a any trick to bypass firewall? Thanks for your reading & help. ;) [b]Client configuration:[/b] [code]client dev tun remote 88.x.x.x 443 tcp-client auth-user-pass nobind auth-nocache cipher AES-256-CBC keysize 256 resolv-retry infinite persist-key persist-tun comp-lzo verb 5 -----BEGIN CERTIFICATE----- MIIFCTCCA/GgAw1111JAMvabL6k111111111111111Ib3DQEBCwUAMIGzMQswCQYD VQQGEwJVUzELMAkGA1UECBMCQ0ExFTATBgNVBAcTDFNhbkZyYW5jaXNjbzEVMBMG A1UEChMMRm9ydC1GdW5zdG9222222222222222xRNeU9yZ2FuaXphdGlvbmFsVW5p dDEYMBYGA1UEAxMPRm9ydC1GdW5zdG9uIENBMQ8wDQYDVQQpEwZzZXJ2ZXIxHzAd BgkqhkiG9w0BCQEWEDc04343434343434FpbC5jb20wHhcNMTcwODE1MjI0MzM5WhcN MjcwODEzMjI0MzM5WjCBszELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRUwEwYD VQQHEwxTYW5GcmFuY2lzY28xFTATBgNVBAoTDEZvcnQtRnVuc3RvbjEdMBsGA1UE CxMUTXlPcmdhbml6YXRpb25hbFVuaXQxGDAWBgNVBAMTD0ZvcnQtRnVuc3RvbiBD QTEPMA0GA1UEKRMGc2VydmVyMR8wHQYJKoZIhvcNAQkBFhA3NG5rNGRAZ21haWwu Y29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnUfMsepaFqigHwGK FuQzJLYgC6BZ4/TwxFucUxApJ3W/VgnXm/d+juO166PgyCxsxcCXJogBvUYSdaRT x+n7TMwaX3hXnYeBnijy9GjwCQwyn+ArVOChr1kas4+f4BSkTyMJpQfdPurySw1t gkPqTs2DEkiHN1arG+RXyrCdwys/cnfgtwN6RmncrO2qZO4wnYH/qYzvviRRTsrc dW/TTJri7b9UEu72hEIYmkBA+dNZKjX2b4x1v2mJ9QTyXuM9qX0HZVFxrN3KfPw+ gEtM5Lp6Cqy5D8QaVGIVjjHzgSnhZozM/582kd5y45UlJF3JlrfGtWq18luqWs0y eJYkaQIDAQABo4IBHDCCARgwHQYDVR0OBBYEFEuPWOqdE8O2XjWKDJObCuKiSnHH MIHoBgNVHSMEgeAwgd2AFEuPWOqdE8O2XjWKDJObCuKiSnHHoYG5pIG2MIGzMQsw CQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExFTATBgNVBAcTDFNhbkZyYW5jaXNjbzEV MBMGA1UEChMMRm9ydC1GdW5zdG9uMR0wGwYDVQQLExRNeU9yZ2FuaXphdGlvbmFs VW5pdDEYMBYGA1UEAxMPRm9ydC1GdW5zdG9uIENBMQ8wDQYDVQQpEwZzZXJ2ZXIx HzAdBgkqhkiG9w0BCQEWEDc0bms0ZEBnbWFpbC5jb22CCQDL2my+pKrpujAMBgNV HRMEBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAYp0LElR9hzAe365PDrgWPWMWJ fMtdHd4pOJDffUJna6u7aXJmtNYcQFi+5mDuTYbhak7eIZTJ8CWbQ7MfRf/iVNGA VULI3h655S3jtOrtFXa74m72ygCFQAzvt6IzFKBffgw2T6XazG6O95Uymu78aiBM STuzEdaQP6Kwamqp5403FjluLeYRRZuxqlmI380FjILDaSWtCW3eSJ9uZn9KZzyx A7fbcEw0AFQs/JxEL5hfJ7d1A93dSlDfbDAbSKIaGPTQizLTDvHtDgA6wHXdWRO6 vjeUDx8oW+ZAjSva/tzUBLa2x9VIgfpD52y8T26CcFtxLLlyTEZm6vOG0gGj -----END CERTIFICATE----- [/code] [b]Server configuration:[/b] [code]server 10.8.0.0 255.255.255.0 port 443 proto tcp dev tun # Certificates. ca ca.crt cert server.crt key server.key push "redirect-gateway def1 bypass-dhcp" push "dhcp-option DNS 8.8.8.8" push "dhcp-option DNS 8.8.4.4" keepalive 30 120 cipher AES-256-CBC dh dh2048.pem comp-lzo user nobody group nobody duplicate-cn persist-key persist-tun status status-443.log log 443.log log-append 443.log verb 5 client-cert-not-required username-as-common-name plugin /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so login [/code] [b]Client logs:[/b] [code]Sun Mar 04 17:53:47 2018 pkcs11_protected_authentication = DISABLED Sun Mar 04 17:53:47 2018 pkcs11_private_mode = 00000000 Sun Mar 04 17:53:47 2018 pkcs11_private_mode = 00000000 Sun Mar 04 17:53:47 2018 pkcs11_private_mode = 00000000 Sun Mar 04 17:53:47 2018 pkcs11_private_mode = 00000000 Sun Mar 04 17:53:47 2018 pkcs11_private_mode = 00000000 Sun Mar 04 17:53:47 2018 pkcs11_private_mode = 00000000 Sun Mar 04 17:53:47 2018 pkcs11_private_mode = 00000000 Sun Mar 04 17:53:47 2018 pkcs11_private_mode = 00000000 Sun Mar 04 17:53:47 2018 pkcs11_private_mode = 00000000 Sun Mar 04 17:53:47 2018 pkcs11_private_mode = 00000000 Sun Mar 04 17:53:47 2018 pkcs11_private_mode = 00000000 Sun Mar 04 17:53:47 2018 pkcs11_private_mode = 00000000 Sun Mar 04 17:53:47 2018 pkcs11_private_mode = 00000000 Sun Mar 04 17:53:47 2018 pkcs11_private_mode = 00000000 Sun Mar 04 17:53:47 2018 pkcs11_private_mode = 00000000 Sun Mar 04 17:53:47 2018 pkcs11_private_mode = 00000000 Sun Mar 04 17:53:47 2018 pkcs11_cert_private = DISABLED Sun Mar 04 17:53:47 2018 pkcs11_cert_private = DISABLED Sun Mar 04 17:53:47 2018 pkcs11_cert_private = DISABLED Sun Mar 04 17:53:47 2018 pkcs11_cert_private = DISABLED Sun Mar 04 17:53:47 2018 pkcs11_cert_private = DISABLED Sun Mar 04 17:53:47 2018 pkcs11_cert_private = DISABLED Sun Mar 04 17:53:47 2018 pkcs11_cert_private = DISABLED Sun Mar 04 17:53:47 2018 pkcs11_cert_private = DISABLED Sun Mar 04 17:53:47 2018 pkcs11_cert_private = DISABLED Sun Mar 04 17:53:47 2018 pkcs11_cert_private = DISABLED Sun Mar 04 17:53:47 2018 pkcs11_cert_private = DISABLED Sun Mar 04 17:53:47 2018 pkcs11_cert_private = DISABLED Sun Mar 04 17:53:47 2018 pkcs11_cert_private = DISABLED Sun Mar 04 17:53:47 2018 pkcs11_cert_private = DISABLED Sun Mar 04 17:53:47 2018 pkcs11_cert_private = DISABLED Sun Mar 04 17:53:47 2018 pkcs11_cert_private = DISABLED Sun Mar 04 17:53:47 2018 pkcs11_pin_cache_period = -1 Sun Mar 04 17:53:47 2018 pkcs11_id = '[UNDEF]' Sun Mar 04 17:53:47 2018 pkcs11_id_management = DISABLED Sun Mar 04 17:53:47 2018 server_network = 0.0.0.0 Sun Mar 04 17:53:47 2018 server_netmask = 0.0.0.0 Sun Mar 04 17:53:47 2018 server_network_ipv6 = :: Sun Mar 04 17:53:47 2018 server_netbits_ipv6 = 0 Sun Mar 04 17:53:47 2018 server_bridge_ip = 0.0.0.0 Sun Mar 04 17:53:47 2018 server_bridge_netmask = 0.0.0.0 Sun Mar 04 17:53:47 2018 server_bridge_pool_start = 0.0.0.0 Sun Mar 04 17:53:47 2018 server_bridge_pool_end = 0.0.0.0 Sun Mar 04 17:53:47 2018 ifconfig_pool_defined = DISABLED Sun Mar 04 17:53:47 2018 ifconfig_pool_start = 0.0.0.0 Sun Mar 04 17:53:47 2018 ifconfig_pool_end = 0.0.0.0 Sun Mar 04 17:53:47 2018 ifconfig_pool_netmask = 0.0.0.0 Sun Mar 04 17:53:47 2018 ifconfig_pool_persist_filename = '[UNDEF]' Sun Mar 04 17:53:47 2018 ifconfig_pool_persist_refresh_freq = 600 Sun Mar 04 17:53:47 2018 ifconfig_ipv6_pool_defined = DISABLED Sun Mar 04 17:53:47 2018 ifconfig_ipv6_pool_base = :: Sun Mar 04 17:53:47 2018 ifconfig_ipv6_pool_netbits = 0 Sun Mar 04 17:53:47 2018 n_bcast_buf = 256 Sun Mar 04 17:53:47 2018 tcp_queue_limit = 64 Sun Mar 04 17:53:47 2018 real_hash_size = 256 Sun Mar 04 17:53:47 2018 virtual_hash_size = 256 Sun Mar 04 17:53:47 2018 client_connect_script = '[UNDEF]' Sun Mar 04 17:53:47 2018 learn_address_script = '[UNDEF]' Sun Mar 04 17:53:47 2018 client_disconnect_script = '[UNDEF]' Sun Mar 04 17:53:47 2018 client_config_dir = '[UNDEF]' Sun Mar 04 17:53:47 2018 ccd_exclusive = DISABLED Sun Mar 04 17:53:47 2018 tmp_dir = 'C:\Users\Pro\AppData\Local\Temp\' Sun Mar 04 17:53:47 2018 push_ifconfig_defined = DISABLED Sun Mar 04 17:53:47 2018 push_ifconfig_local = 0.0.0.0 Sun Mar 04 17:53:47 2018 push_ifconfig_remote_netmask = 0.0.0.0 Sun Mar 04 17:53:47 2018 push_ifconfig_ipv6_defined = DISABLED Sun Mar 04 17:53:47 2018 push_ifconfig_ipv6_local = ::/0 Sun Mar 04 17:53:47 2018 push_ifconfig_ipv6_remote = :: Sun Mar 04 17:53:47 2018 enable_c2c = DISABLED Sun Mar 04 17:53:47 2018 duplicate_cn = DISABLED Sun Mar 04 17:53:47 2018 cf_max = 0 Sun Mar 04 17:53:47 2018 cf_per = 0 Sun Mar 04 17:53:47 2018 max_clients = 1024 Sun Mar 04 17:53:47 2018 max_routes_per_client = 256 Sun Mar 04 17:53:47 2018 auth_user_pass_verify_script = '[UNDEF]' Sun Mar 04 17:53:47 2018 auth_user_pass_verify_script_via_file = DISABLED Sun Mar 04 17:53:47 2018 auth_token_generate = DISABLED Sun Mar 04 17:53:47 2018 auth_token_lifetime = 0 Sun Mar 04 17:53:47 2018 client = ENABLED Sun Mar 04 17:53:47 2018 pull = ENABLED Sun Mar 04 17:53:47 2018 auth_user_pass_file = 'stdin' Sun Mar 04 17:53:47 2018 show_net_up = DISABLED Sun Mar 04 17:53:47 2018 route_method = 3 Sun Mar 04 17:53:47 2018 block_outside_dns = DISABLED Sun Mar 04 17:53:47 2018 ip_win32_defined = DISABLED Sun Mar 04 17:53:47 2018 ip_win32_type = 3 Sun Mar 04 17:53:47 2018 dhcp_masq_offset = 0 Sun Mar 04 17:53:47 2018 dhcp_lease_time = 31536000 Sun Mar 04 17:53:47 2018 tap_sleep = 0 Sun Mar 04 17:53:47 2018 dhcp_options = DISABLED Sun Mar 04 17:53:47 2018 dhcp_renew = DISABLED Sun Mar 04 17:53:47 2018 dhcp_pre_release = DISABLED Sun Mar 04 17:53:47 2018 domain = '[UNDEF]' Sun Mar 04 17:53:47 2018 netbios_scope = '[UNDEF]' Sun Mar 04 17:53:47 2018 netbios_node_type = 0 Sun Mar 04 17:53:47 2018 disable_nbt = DISABLED Sun Mar 04 17:53:47 2018 OpenVPN 2.4.4 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Sep 26 2017 Sun Mar 04 17:53:47 2018 Windows version 6.2 (Windows 8 or greater) 64bit Sun Mar 04 17:53:47 2018 library versions: OpenSSL 1.0.2l 25 May 2017, LZO 2.10 Sun Mar 04 17:53:47 2018 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340 Sun Mar 04 17:53:47 2018 Need hold release from management interface, waiting... Sun Mar 04 17:53:47 2018 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340 Sun Mar 04 17:53:47 2018 MANAGEMENT: CMD 'state on' Sun Mar 04 17:53:47 2018 MANAGEMENT: CMD 'log all on' Sun Mar 04 17:53:47 2018 MANAGEMENT: CMD 'echo all on' Sun Mar 04 17:53:47 2018 MANAGEMENT: CMD 'hold off' Sun Mar 04 17:53:47 2018 MANAGEMENT: CMD 'hold release' Sun Mar 04 17:53:48 2018 MANAGEMENT: CMD 'username "Auth" "vpn"' Sun Mar 04 17:53:48 2018 MANAGEMENT: CMD 'password [...]' Sun Mar 04 17:53:48 2018 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info. Sun Mar 04 17:53:49 2018 LZO compression initializing Sun Mar 04 17:53:49 2018 Control Channel MTU parms [ L:1624 D:1210 EF:40 EB:0 ET:0 EL:3 ] Sun Mar 04 17:53:49 2018 Data Channel MTU parms [ L:1624 D:1450 EF:124 EB:406 ET:0 EL:3 ] Sun Mar 04 17:53:49 2018 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-client' Sun Mar 04 17:53:49 2018 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-server' Sun Mar 04 17:53:49 2018 TCP/UDP: Preserving recently used remote address: [AF_INET]88.x.x.x:443 Sun Mar 04 17:53:49 2018 Socket Buffers: R=[65536->65536] S=[65536->65536] Sun Mar 04 17:53:49 2018 Attempting to establish TCP connection with [AF_INET]88.x.x.x:443 [nonblock] Sun Mar 04 17:53:49 2018 MANAGEMENT: >STATE:1520175229,TCP_CONNECT,,,,,, Sun Mar 04 17:53:50 2018 TCP connection established with [AF_INET]88.x.x.x:443 Sun Mar 04 17:53:50 2018 TCP_CLIENT link local: (not bound) Sun Mar 04 17:53:50 2018 TCP_CLIENT link remote: [AF_INET]88.x.x.x:443 Sun Mar 04 17:53:50 2018 MANAGEMENT: >STATE:1520175230,WAIT,,,,,, Sun Mar 04 17:54:09 2018 read TCP_CLIENT: Unknown error (code=10060) Sun Mar 04 17:54:09 2018 Connection reset, restarting [-1] Sun Mar 04 17:54:09 2018 TCP/UDP: Closing socket Sun Mar 04 17:54:09 2018 SIGUSR1[soft,connection-reset] received, process restarting Sun Mar 04 17:54:09 2018 MANAGEMENT: >STATE:1520175249,RECONNECTING,connection-reset,,,,, Sun Mar 04 17:54:09 2018 Restart pause, 5 second(s)[/code] [b]Server logs:[/b] [code]Sun Mar 4 17:59:01 2018 us=536412 TCP connection established with [AF_INET]95.x.x.x:41674 Sun Mar 4 17:59:01 2018 us=536451 TCPv4_SERVER link local: (not bound) Sun Mar 4 17:59:01 2018 us=536482 TCPv4_SERVER link remote: [AF_INET]95.x.x.x:41674 Sun Mar 4 17:59:02 2018 us=474228 95.x.x.x:41674 Connection reset, restarting [0] Sun Mar 4 17:59:02 2018 us=474344 95.x.x.x:41674 SIGUSR1[soft,connection-reset] received, client-instance restarting Sun Mar 4 17:59:02 2018 us=474567 TCP/UDP: Closing socket Sun Mar 4 18:02:01 2018 us=726629 MULTI: multi_create_instance called Sun Mar 4 18:02:01 2018 us=727090 Re-using SSL/TLS context Sun Mar 4 18:02:01 2018 us=727204 LZO compression initializing Sun Mar 4 18:02:01 2018 us=727612 Control Channel MTU parms [ L:1624 D:1210 EF:40 EB:0 ET:0 EL:3 ] Sun Mar 4 18:02:01 2018 us=727686 Data Channel MTU parms [ L:1624 D:1450 EF:124 EB:406 ET:0 EL:3 ] Sun Mar 4 18:02:01 2018 us=727888 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-server' Sun Mar 4 18:02:01 2018 us=727930 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-client' Sun Mar 4 18:02:01 2018 us=728052 TCP connection established with [AF_INET]95.x.x.x:41667 Sun Mar 4 18:02:01 2018 us=728099 TCPv4_SERVER link local: (not bound) Sun Mar 4 18:02:01 2018 us=728131 TCPv4_SERVER link remote: [AF_INET]95.x.x.x:41667 Sun Mar 4 18:02:02 2018 us=664425 95.x.x.x:41667 Connection reset, restarting [0] Sun Mar 4 18:02:02 2018 us=664538 95.x.x.x:41667 SIGUSR1[soft,connection-reset] received, client-instance restarting Sun Mar 4 18:02:02 2018 us=664683 TCP/UDP: Closing socket[/code]

[quote=TANKADO post_id=77283 time=1520176101 user_id=43481] I tried cert authentication method with my organization's Root CA cert in client configuration [/quote]That will not work. [url=http://openvpn.net/index.php/open-source/documentation/howto.html#pki]Setting up your own Certificate Authority (CA) and generating certificates and keys for an OpenVPN server and multiple clients[/url] [quote=TANKADO post_id=77283 time=1520176101 user_id=43481] Is there a any trick to bypass firewall? [/quote]Ask for permission ..

It looks as though this is your problem: [code]Sun Mar 04 17:53:48 2018 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.[/code] - your connection is potentially wide-open to MiTM (Man in The Middle) attacks. There also appears to a lot of noise in your configuration, so maybe stripping it down a bit would help?

I'm having a hard time with my configuration

TANKADO

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

TinCanTech

TANKADO wrote I tried cert authentication method with my organization's Root CA cert in client configuration

That will not work.

Setting up your own Certificate Authority (CA) and generating certificates and keys for an OpenVPN server and multiple clients

TANKADO wrote Is there a any trick to bypass firewall?

Ask for permission ..

TANKADO

re: That will not work.
I was guess and it did not work. It just was a desparative choice.
I tried the link first. It was success with my private connection but not organization's connection.

re: Ask for permission ..
Sorry, what kind of permissinon in there where they inspect all of private secure connection.
They inspect all of my traffic and filtered a lot of sites even google but Interestingly, except yandex.
So I think that the subject is not asking for permissions.

AnotherTaffer

It looks as though this is your problem:

Sun Mar 04 17:53:48 2018 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.

- your connection is potentially wide-open to MiTM (Man in The Middle) attacks.

There also appears to a lot of noise in your configuration, so maybe stripping it down a bit would help?