KVPN wrote
chilinux wrote
OpenVPN AS version 2.8.7 is fair old at this point and has some known security issues that have been since resolved.
I would recommend upgrading to either version 2.8.8 or 2.9.2. Then see if you still experience problems with the web interface.
I have not gone through an upgrade with one of these before. Are they fairly seamless? Any issues with past configs being reset?
Each of the upgrades from 2.8.7 to 2.8.8 I have done has gone seamlessly.
OpenVPN AS makes a backup copy of each of the configuration files on each restart, including when an upgrade is performed.
You can find the configuration files in /usr/local/openvpn_as/etc/db
Backups can be found in sub-directories named with the date/time the backup was made. If you run into any problems, you can restore the configuration from these backups.
KVPN wrote
chilinux wrote
When a service shows in netstat as running on IP 0.0.0.0, then this indicates it is bound to all network interfaces. As such, that indicate it is on the server's local address.
I believe that's what I set originally, for it to listen on all interfaces. I'm not sure if this is useful, but I just checked the init.log and the Admin UI has some random IP address assigned to it. This is not even a subnet we use at any of our locations. I can putty into the access server just fine and access everything from CLI. I don't know how it got this IP address.
By default, the Admin UI web server is available through two different methods. The first is directly via port 943. The second is passed through the VPN service itself to the web server. This is performed through a Unix socket file. My guess is the random address you are seeing in the init.log may not be an IP, but rather is the socket identification number.
KVPN wrote
chilinux wrote
When you have problems access the web UI via port 443, can you also try accessing it via port 943 instead?
When the problem is occurring, are you running the OpenVPN client and is the client actively connected?
I can't use 443 or 943. I am not running the client myself, but I have about 7 employees that are working on it just fine. Seems to only be the Web UI that's acting up.
Do you have any other software/service running on the same server that modifies iptables or the system firewall?
The other possibility I can think of is the kernel might be performing an Out of Memory (OOM) kill against the web service while still leaving the VPN services running. But this should only occur if the system is extremely starved on available ram.
You may want to open a ticket with OpenVPN AS support so they can review the logs for you. There is only so much that can be accomplished through the forums.
