Proxy for https Access

Ben63821

Hallo,

ein 'OpenVPN As' Server ist auf einem Debian System installiert worden.

Da mehrere Systeme über https mit entsprechenden Subdomains ihre Dienste anbieten, leitet ein Proxy (nginx-Proxy) die Zugriffe entsprechend der aufgerufenen Subdomsins an die entsprechenden Systeme weiter. Der Proxy sorgt dafür, dass alle Subdomains mit Zertifikaten mit aktuellen Letsencrypt verschlüsselt werden.

Für die Zugriffe auf OpenVPN ist die Subdomain vpn.xxxxxx.de zugewiesen worden.

Nach der Ersteinrichtung von OpenVPN-AS läuft der Service fehlerfrei an.

Die Zugruffe auf OpenVPN von den Clients erfolgen nur dann fehlerfrei, wenn der Zugriff direkt erfolgt. Dazu wurde der Standardport 443 auf 444 umgelegt.

Nun habe ich erfolhren, dass Proxy in den Configurationsdateien explizit eingetragen werden müssen.

Kann mir jemand mitteilen, wo die Configdateien sich befinden und welche Angaben hier eingetragen werden müssen?

Derzeit können sich die Clients ihre Client.ovpn-Datei über eine Webseite vom Openvpn-as Service herunterladen.

Vielen Dank.

Ben63821

Same posting in English.

Hi there,

an 'OpenVPN As' server has been installed on a Debian system.

Since several systems offer their services via https with the corresponding subdomains, a proxy (nginx proxy) forwards the accesses to the corresponding systems in accordance with the subdomins called. The proxy ensures that all subdomains are encrypted with certificates using the latest Letsencrypt.

The subdomain vpn.xxxxxx.de has been assigned for access to OpenVPN.

After the initial setup of OpenVPN-AS, the service starts without errors.

The calls to OpenVPN from the clients are only error-free if the access is direct. The standard port 443 was switched to 444.

Now I have done that Proxy must be entered explicitly in the configuration files.

Can someone tell me where the config files are and what information must be entered here?

The clients can currently download their Client.ovpn file from the Openvpn-as Service website.

Thank you very much.

Ben63821

Hi there,

in the meantime it was found that the settings must be made as an "advanced VPN setting":

proto tcp-server
proto tcp-client
http-proxy 192.168.188.229 443

If this setting has been made, the service will no longer start:

Options error: --remote MUST be used in TCP Client mode

Here is the configuration:

# ./sacli ConfigQuery
{
  "admin_ui.https.ip_address": "eth0",
  "admin_ui.https.port": "943",
  "aui.eula_version": "2",
  "auth.ldap.0.name": "My LDAP servers",
  "auth.ldap.0.ssl_verify": "never",
  "auth.ldap.0.timeout": "4",
  "auth.ldap.0.use_ssl": "never",
  "auth.module.type": "local",
  "auth.pam.0.service": "openvpnas",
  "auth.radius.0.acct_enable": "false",
  "auth.radius.0.name": "My Radius servers",
  "cs.cws_proto_v2": "true",
  "cs.https.ip_address": "eth0",
  "cs.https.port": "943",
  "cs.prof_sign_web": "true",
  "cs.ssl_method": "SSLv3",
  "cs.ssl_reneg": "true",
  "cs.tls_version_min": "1.1",
  "host.name": "vpn.xxxxxxxx.de",
  "sa.initial_run_groups.0": "web_group",
  "sa.initial_run_groups.1": "openvpn_group",
  "sa.ssl_lib": "openssl",
  "vpn.client.basic": "false",
  "vpn.client.cipher": "AES-256-CBC",
  "vpn.client.config_text": "proto tcp-server\nproto tcp-client\nhttp-proxy 192.168.188.229 443",
  "vpn.client.routing.inter_client": "false",
  "vpn.client.routing.reroute_dns": "true",
  "vpn.client.routing.reroute_gw": "true",
  "vpn.client.routing.superuser_c2c_access": "false",
  "vpn.daemon.0.client.netmask_bits": "20",
  "vpn.daemon.0.client.network": "172.27.224.0",
  "vpn.daemon.0.listen.ip_address": "all",
  "vpn.daemon.0.listen.port": "443",
  "vpn.daemon.0.listen.protocol": "tcp",
  "vpn.daemon.0.server.ip_address": "eth0",
  "vpn.server.cipher": "AES-256-CBC",
  "vpn.server.config_text": "proto tcp-server\nproto tcp-client\nhttp-proxy 192.168.188.229 443",
  "vpn.server.daemon.enable": "false",
  "vpn.server.daemon.tcp.n_daemons": "1",
  "vpn.server.daemon.tcp.port": "443",
  "vpn.server.daemon.udp.n_daemons": "1",
  "vpn.server.daemon.udp.port": "1194",
  "vpn.server.duplicate_cn": "true",
  "vpn.server.group_pool.0": "172.27.240.0/20",
  "vpn.server.port_share.enable": "true",
  "vpn.server.port_share.ip_address": "1.2.3.4",
  "vpn.server.port_share.port": "1234",
  "vpn.server.port_share.service": "admin+client",
  "vpn.server.routing.private_access": "nat",
  "vpn.server.routing.private_network.0": "192.168.188.0/24",
  "vpn.server.tls_auth": "true",
  "vpn.server.tls_version_min": "1.2",
  "vpn.tls_refresh.do_reauth": "true",
  "vpn.tls_refresh.interval": "360"
}

Can anyone give a tip?

Ben63821

Hi,

after many hours of testing I gave up trying to handle https access via a proxy.
A connection works correctly via a separate port 444.

When trying to run the https connection via a nginx proxy, 400 status errors always occurred, the cause of which could not be narrowed down.