OpenVPN2.7 socks-proxy is different from 2.6 ， how to setting ？

peter11

I install OpenVPN-2.7.8-I002-amd64.msi in windows10. And my setting is:

client
dev tap
dev-node "OpenVPN TAP-Windows6"
proto tcp-client
remote 123.123.123.123 12345
resolv-retry infinite
nobind
key "C:\Program Files\OpenVPN\abc\etyst.key"
cert "C:\Program Files\OpenVPN\abc\etyst.crt"
ca "C:\Program Files\OpenVPN\abc\ca.crt"
tls-client
remote-cert-tls server
tls-crypt-v2 "C:\Program Files\OpenVPN\abc\ta-etyst.key"
socks-proxy 127.0.0.1 54321 "C:\Program Files\OpenVPN\abc\socks5_auth.txt"
auth-nocache
data-ciphers AES-256-GCM
verb 3

OpenVPN Socks5 server failed with log：
socks_username_password_auth: server refused the authentication

If set socks-proxy 127.0.0.1 54321 stdin , failed log is:
socks_username_password_auth: TCP port read failed on recv(): Software caused connection abort (WSAECONNABORTED) (errno=10053)

But uninstall OpenVPN2.7.8, and install OpenVPN-2.6.23-I002-amd64.msi , this setting is worked.
So socks-proxy of 2.7.8 is different from 2.6.23 .

WireShark check tcp of OpenVPN with socks server：
openvpn sent data to server 05 01 02
socks sent date to openvpn 05 02
openvpn 01 +length +username +length +password
socks 01 00
openvpn FIN,ACK
socks 05 01 00 01 00 00 00 00 00 00

Socks server send 01 00 means verification successful ,but openvpn sent FIN,ACK . OpenVPN 2.6.23 will send 05 01 00 03 0e +Destinasion IP +00 50 at this time.

Please help me solve this problem.

Mohammad Montazeri

The 2.7 manual still documents the same socks-proxy syntax: server, optional port, then a two-line username/password file (or stdin). So the configuration form you posted is still supported: https://openvpn.net/community-docs/community-articles/openvpn-2-7-manual/

Your 01 00 observation is the useful clue: RFC 1929 defines status 00 as successful username/password authentication. If those bytes are the complete response in the same TCP stream, they do not agree with "server refused the authentication". That points to checking how the exchange is received/handled, rather than changing TLS certificates or ciphers. It does not by itself establish which component is at fault.

Which SOCKS server implementation/version is listening on 54321? A side-by-side, sanitized TCP-stream summary for 2.6.23 and 2.7.8 with that same proxy would make a stronger reproduction report than further unrelated profile changes. Keep actual usernames/passwords and private keys out of the report: this SOCKS authentication exchange carries the password in cleartext. RFC: https://www.rfc-editor.org/rfc/rfc1929.html

AI-assisted technical feedback; I work on a VPN service.

peter11

Mohammad Montazeri

Thank you !

OpenVPN 2.7.9 released. I have tried. But 2.7.9 is like this too.

sanitized TCP-stream summary for 2.7.9:

No. Time Source Destination Protocol Length Info
1 0.000000000 127.0.0.1 127.0.0.1 TCP 56 54322 → 54321 [SYN] Seq=0 Win=65535 Len=0 MSS=65495 WS=256 SACK_PERM

Frame 1: Packet, 56 bytes on wire (448 bits), 56 bytes captured (448 bits) on interface \Device\NPF_Loopback, id 0
Null/Loopback
Internet Protocol Version 4, Src: 127.0.0.1, Dst: 127.0.0.1
Transmission Control Protocol, Src Port: 54322, Dst Port: 54321, Seq: 0, Len: 0

No. Time Source Destination Protocol Length Info
2 0.000231300 127.0.0.1 127.0.0.1 TCP 56 54321 → 54322 [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 MSS=65495 WS=256 SACK_PERM

Frame 2: Packet, 56 bytes on wire (448 bits), 56 bytes captured (448 bits) on interface \Device\NPF_Loopback, id 0
Null/Loopback
Internet Protocol Version 4, Src: 127.0.0.1, Dst: 127.0.0.1
Transmission Control Protocol, Src Port: 54321, Dst Port: 54322, Seq: 0, Ack: 1, Len: 0

No. Time Source Destination Protocol Length Info
3 0.000347400 127.0.0.1 127.0.0.1 TCP 44 54322 → 54321 [ACK] Seq=1 Ack=1 Win=2619648 Len=0

Frame 3: Packet, 44 bytes on wire (352 bits), 44 bytes captured (352 bits) on interface \Device\NPF_Loopback, id 0
Null/Loopback
Internet Protocol Version 4, Src: 127.0.0.1, Dst: 127.0.0.1
Transmission Control Protocol, Src Port: 54322, Dst Port: 54321, Seq: 1, Ack: 1, Len: 0

No. Time Source Destination Protocol Length Info
4 0.001860800 127.0.0.1 127.0.0.1 TCP 47 54322 → 54321 [PSH, ACK] Seq=1 Ack=1 Win=2619648 Len=3

Frame 4: Packet, 47 bytes on wire (376 bits), 47 bytes captured (376 bits) on interface \Device\NPF_Loopback, id 0
Null/Loopback
Internet Protocol Version 4, Src: 127.0.0.1, Dst: 127.0.0.1
Transmission Control Protocol, Src Port: 54322, Dst Port: 54321, Seq: 1, Ack: 1, Len: 3
Data (3 bytes)

0000 05 01 02 ...

No. Time Source Destination Protocol Length Info
5 0.001873600 127.0.0.1 127.0.0.1 TCP 44 54321 → 54322 [ACK] Seq=1 Ack=4 Win=2619648 Len=0

Frame 5: Packet, 44 bytes on wire (352 bits), 44 bytes captured (352 bits) on interface \Device\NPF_Loopback, id 0
Null/Loopback
Internet Protocol Version 4, Src: 127.0.0.1, Dst: 127.0.0.1
Transmission Control Protocol, Src Port: 54321, Dst Port: 54322, Seq: 1, Ack: 4, Len: 0

No. Time Source Destination Protocol Length Info
6 0.004453800 127.0.0.1 127.0.0.1 TCP 46 54321 → 54322 [PSH, ACK] Seq=1 Ack=4 Win=2619648 Len=2

Frame 6: Packet, 46 bytes on wire (368 bits), 46 bytes captured (368 bits) on interface \Device\NPF_Loopback, id 0
Null/Loopback
Internet Protocol Version 4, Src: 127.0.0.1, Dst: 127.0.0.1
Transmission Control Protocol, Src Port: 54321, Dst Port: 54322, Seq: 1, Ack: 4, Len: 2
Data (2 bytes)

0000 05 02 ..

No. Time Source Destination Protocol Length Info
7 0.004503900 127.0.0.1 127.0.0.1 TCP 44 54322 → 54321 [ACK] Seq=4 Ack=3 Win=2619648 Len=0

Frame 7: Packet, 44 bytes on wire (352 bits), 44 bytes captured (352 bits) on interface \Device\NPF_Loopback, id 0
Null/Loopback
Internet Protocol Version 4, Src: 127.0.0.1, Dst: 127.0.0.1
Transmission Control Protocol, Src Port: 54322, Dst Port: 54321, Seq: 4, Ack: 3, Len: 0

No. Time Source Destination Protocol Length Info
8 0.006488700 127.0.0.1 127.0.0.1 TCP 73 54322 → 54321 [PSH, ACK] Seq=4 Ack=3 Win=2619648 Len=29

Frame 8: Packet, 73 bytes on wire (584 bits), 73 bytes captured (584 bits) on interface \Device\NPF_Loopback, id 0
Null/Loopback
Internet Protocol Version 4, Src: 127.0.0.1, Dst: 127.0.0.1
Transmission Control Protocol, Src Port: 54322, Dst Port: 54321, Seq: 4, Ack: 3, Len: 29
Data (29 bytes)

0000 01 length username length password ****
0010 **** ****

No. Time Source Destination Protocol Length Info
9 0.006510600 127.0.0.1 127.0.0.1 TCP 44 54321 → 54322 [ACK] Seq=3 Ack=33 Win=2619648 Len=0

Frame 9: Packet, 44 bytes on wire (352 bits), 44 bytes captured (352 bits) on interface \Device\NPF_Loopback, id 0
Null/Loopback
Internet Protocol Version 4, Src: 127.0.0.1, Dst: 127.0.0.1
Transmission Control Protocol, Src Port: 54321, Dst Port: 54322, Seq: 3, Ack: 33, Len: 0

No. Time Source Destination Protocol Length Info
10 0.006581700 127.0.0.1 127.0.0.1 TCP 46 54321 → 54322 [PSH, ACK] Seq=3 Ack=33 Win=2619648 Len=2

Frame 10: Packet, 46 bytes on wire (368 bits), 46 bytes captured (368 bits) on interface \Device\NPF_Loopback, id 0
Null/Loopback
Internet Protocol Version 4, Src: 127.0.0.1, Dst: 127.0.0.1
Transmission Control Protocol, Src Port: 54321, Dst Port: 54322, Seq: 3, Ack: 33, Len: 2
Data (2 bytes)

0000 01 00 ..

No. Time Source Destination Protocol Length Info
11 0.006618800 127.0.0.1 127.0.0.1 TCP 44 54322 → 54321 [ACK] Seq=33 Ack=5 Win=2619648 Len=0

Frame 11: Packet, 44 bytes on wire (352 bits), 44 bytes captured (352 bits) on interface \Device\NPF_Loopback, id 0
Null/Loopback
Internet Protocol Version 4, Src: 127.0.0.1, Dst: 127.0.0.1
Transmission Control Protocol, Src Port: 54322, Dst Port: 54321, Seq: 33, Ack: 5, Len: 0

No. Time Source Destination Protocol Length Info
12 0.008078900 127.0.0.1 127.0.0.1 TCP 44 54322 → 54321 [FIN, ACK] Seq=33 Ack=5 Win=2619648 Len=0

Frame 12: Packet, 44 bytes on wire (352 bits), 44 bytes captured (352 bits) on interface \Device\NPF_Loopback, id 0
Null/Loopback
Internet Protocol Version 4, Src: 127.0.0.1, Dst: 127.0.0.1
Transmission Control Protocol, Src Port: 54322, Dst Port: 54321, Seq: 33, Ack: 5, Len: 0

No. Time Source Destination Protocol Length Info
13 0.008118500 127.0.0.1 127.0.0.1 TCP 44 54321 → 54322 [ACK] Seq=5 Ack=34 Win=2619648 Len=0

Frame 13: Packet, 44 bytes on wire (352 bits), 44 bytes captured (352 bits) on interface \Device\NPF_Loopback, id 0
Null/Loopback
Internet Protocol Version 4, Src: 127.0.0.1, Dst: 127.0.0.1
Transmission Control Protocol, Src Port: 54321, Dst Port: 54322, Seq: 5, Ack: 34, Len: 0

No. Time Source Destination Protocol Length Info
14 0.008239000 127.0.0.1 127.0.0.1 TCP 54 54321 → 54322 [PSH, ACK] Seq=5 Ack=34 Win=2619648 Len=10

Frame 14: Packet, 54 bytes on wire (432 bits), 54 bytes captured (432 bits) on interface \Device\NPF_Loopback, id 0
Null/Loopback
Internet Protocol Version 4, Src: 127.0.0.1, Dst: 127.0.0.1
Transmission Control Protocol, Src Port: 54321, Dst Port: 54322, Seq: 5, Ack: 34, Len: 10
Data (10 bytes)

0000 05 01 00 01 00 00 00 00 00 00 ..........

No. Time Source Destination Protocol Length Info
15 0.008275000 127.0.0.1 127.0.0.1 TCP 44 54322 → 54321 [RST, ACK] Seq=34 Ack=15 Win=0 Len=0

Frame 15: Packet, 44 bytes on wire (352 bits), 44 bytes captured (352 bits) on interface \Device\NPF_Loopback, id 0
Null/Loopback
Internet Protocol Version 4, Src: 127.0.0.1, Dst: 127.0.0.1
Transmission Control Protocol, Src Port: 54322, Dst Port: 54321, Seq: 34, Ack: 15, Len: 0

socks server send data 01 00 in No. 10，But OpenVPN send FIN, ACK flags in No. 12.
sanitized TCP-stream summary is a bit long. 2.6.23 is worked，it will send Destinasion IP in No. 12 .