Setting TCP or UDP from the client side?

TheMG

If there is an obvious answer to this question, then I totally missed it.

So what I'm wondering is if there is a way to force the client to use a TCP or UDP connection without changing the configuration on the server.

I want to have UDP available on my server for performance reasons, however at some public hotspots UDP doesn't work well and keeps dropping out. Thus I would need to force my OpenVPN client software to use TCP only while connected to such a hotspot in order to have a reliable VPN connection.

Is this at all possible?

If not, then would it be possible to have two installations of OpenVPN server on the same machine and same IP address, while having one OpenVPN installation configured to TCP and one configured to UDP, and then use profiles on the client one for TCP one for UDP?

krzee

TheMG wroteIf there is an obvious answer to this question, then I totally missed it.

So what I'm wondering is if there is a way to force the client to use a TCP or UDP connection without changing the configuration on the server.
...
Is this at all possible?

If not, then would it be possible to have two installations of OpenVPN server on the same machine and same IP address, while having one OpenVPN installation configured to TCP and one configured to UDP, and then use profiles on the client one for TCP one for UDP?

yes, this is how it is done. note that each server instance must use its own subnet

TheMG

Ok, thanks. I'll give running two instances of OpenVPN Server a try when I get back from my current trip.

I think having a TCP-only option should solve the problem with that hotspot. My guess is that their NAT is either forcibly dropping UDP after a given timeout irrespective of any active UDP traffic, possibly to help prevent NAT flooding. Though I don't know why they wouldn't just drop UDP traffic altogether. They only have TCP/UDP 21,80,443 unblocked.

TheMG

Seems to work fine! I have an almost bulletproof solution now with the following options:

443 TCP
443 UDP

and something else I just realized, many well managed hotspots despite their insane port and traffic restrictions allow IPSec VPNs on port 1293!!!

So I also added 1293 TCP/UDP, which seems to work just fine at this problematic hotspot! In fact I'm posting this over my VPN from that very hotspot right now.

krzee

thank you for posting that finding!