Hi, I have an OpenVPN client behind ISA Server ( Forefront TMG ) but I can't connect to OpenVPN server. I tried from Win7 logged on domain and from WinXpHome, but I have the same results. I tried from a PC with direct access to Internet and the connection works without errors. Below you can found client.ovpn, server.ovpn and the result on client. Thanks for any ideas. client.ovpn : client dev tun dev-node "OpenVPN" proto tcp remote x.x.x.x 443 resolv-retry infinite nobind persist-key persist-tun http-proxy y.y.y.y 8080 login.txt ntlm2 ( the same with ntlm ) ca "C:\\Program Files\\OpenVPN\\config\\ca.crt" cert "C:\\Program Files\\OpenVPN\\config\\vnc-pc.crt" key "C:\\Program Files\\OpenVPN\\config\\vnc-pc.key" ns-cert-type server tls-auth ta.key 1 comp-lzo verb 3 --------------------------------- server.opvn: port 443 proto tcp dev tun ca "C:\\Programmi\\OpenVPN\\config\\ca.crt" cert "C:\\Programmi\\OpenVPN\\config\\server.crt" key "C:\\Programmi\\OpenVPN\\config\\server.key" # This file should be kept secret dh dh1024.pem server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt keepalive 10 120 tls-auth ta.key 0 # This file is secret comp-lzo max-clients 10 persist-key persist-tun status openvpn-status.log verb 3 ----------------------- And this is the client result: Wed Apr 13 18:34:14 2011 OpenVPN 2.1.4 i686-pc-mingw32 [SSL] [LZO2] [PKCS11] built on Nov 8 2010 Wed Apr 13 18:34:14 2011 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables Wed Apr 13 18:34:14 2011 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file Wed Apr 13 18:34:14 2011 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication Wed Apr 13 18:34:14 2011 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication Wed Apr 13 18:34:14 2011 LZO compression initialized Wed Apr 13 18:34:14 2011 Control Channel MTU parms [ L:1544 D:168 EF:68 EB:0 ET:0 EL:0 ] Wed Apr 13 18:34:14 2011 Socket Buffers: R=[8192->8192] S=[8192->8192] Wed Apr 13 18:34:14 2011 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ] Wed Apr 13 18:34:14 2011 Local Options hash (VER=V4): 'ee93268d' Wed Apr 13 18:34:14 2011 Expected Remote Options hash (VER=V4): 'bd577cd1' Wed Apr 13 18:34:14 2011 Attempting to establish TCP connection with 172.27.0.50:8080 Wed Apr 13 18:34:14 2011 TCP connection established with y.y.y.y:8080 Wed Apr 13 18:34:14 2011 Send to HTTP proxy: 'CONNECT x.x.x.x:443 HTTP/1.0' Wed Apr 13 18:34:14 2011 Attempting NTLM Proxy-Authorization phase 1 Wed Apr 13 18:34:14 2011 HTTP proxy returned: 'HTTP/1.1 407 Proxy Authentication Required ( Access is denied. )' Wed Apr 13 18:34:14 2011 Proxy requires authentication Wed Apr 13 18:34:14 2011 HTTP proxy returned: 'Via: 1.1 PROXYSRVNAME' Wed Apr 13 18:34:14 2011 HTTP proxy returned: 'Proxy-Authenticate: NTLM TlRMTVNTUAACAAAABgAGADgAAAAGAoECdhzAfS0l/ugAAAAAAAAAAJoAmg A+AAAABgByFwAAAA9UV1BOMDkCAAwAVABXAFAATgAwADkAAQAWAEQAS QBTAEMATwBWAEUAUgBZADAAOQAEABQAVABXAFAATgAwADkALgBOAEUAV AADACwARABJAFMAQwBPAFYARQBSAFkAMAA5AC4AVABXAFAATgAwADkALg BOAEUAVAAFABQAVABXAFAATgAwADkALgBOAEUAVAAHAAgAvhEJ7vn5ywE AAAAA' Wed Apr 13 18:34:14 2011 auth string: 'TlRMTVNTUAACAAAABgAGADgAAAAGAoECdhzAfS0l/ugAAAAAAAAAAJoAmg A+AAAABgByFwAAAA9UV1BOMDkCAAwAVABXAFAATgAwADkAAQAWAEQAS QBTAEMATwBWAEU' Wed Apr 13 18:34:14 2011 Received NTLM Proxy-Authorization phase 2 response Wed Apr 13 18:34:16 2011 recv_line: TCP port read timeout expired Wed Apr 13 18:34:16 2011 Send to HTTP proxy: 'CONNECT x.x.x.x:443 HTTP/1.0' Wed Apr 13 18:34:16 2011 Send to HTTP proxy: 'Host: x.x.x.x' Wed Apr 13 18:34:16 2011 Attempting NTLM Proxy-Authorization phase 3 Wed Apr 13 18:34:16 2011 NTLM Proxy-Authorization phase 3 failed: received corrupted data from proxy server Wed Apr 13 18:34:16 2011 TCP/UDP: Closing socket Wed Apr 13 18:34:16 2011 SIGTERM[soft,init_instance] received, process exiting

nltm support in the 'http-proxy' option is bad - I've never managed to get it to work myself. OpenVPN sends incorrect messages to the proxy, so I am not surprised that some proxies return the wrong answers also...

I found an article where an Italian found a BUG in ntml.c [url]http://www.morzello.com/index.php/openvpn-ntlm-e-quel-proxy-infame/[/url] He changed the row 179 of ntlm.c from buf_printf (&out, "%s", "TlRMTVNTUAABAAAAAgIAAA=="); to buf_printf (&out, "%s", "TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAFASgKAAAADw=="); He say that found the solution sniffing other software like Firefox when connects to Proxy. What do you think?

I tried that some time ago, it did not work for me; see [url]https://community.openvpn.net/openvpn/ticket/94[/url] for more info

I found the solution: a buffer too small!! You need to change the size of buf2 from 128 to 512 in proxy.c and ntlm.c and delete this line: [code]buf2[127] = 0;[/code] Now it works!

Hi All, since several people told me that changes I made to the software does not work at 100% I modified the code as shown in this post. But I would say that line: buf2[127] = 0; should not be removed but changed in: buf2[511] = 0; for security reasons. A patched version of the client exe is available at: http://www.morzello.com/repository/network/openvpn-2.1.4-ntlmv2.zip If you think it's useful we could make a patch for the community. please, let me know at: http://www.morzello.com bye.

Good idea! I'd like to stomp out this NTLM bug once and for all. However, when I look through the 2.1.4 code base , file ntlm.c , I don't see any lines like [code]buf2[127] = 0;[/code] am I missing something? Once we get this sorted out as a proper patch (including valid NTLM handshake as seen by Wireshark) then I'd like to submit this as a patch to the devel team.

Take a look to proxy.c also :) storto

thanks! I've managed to recompile openvpn with your patch but I still could not get it working. After some debugging I found out that my test server (apache httpd 2.2 + mod_proxy + mod_ntlm) itself does not work properly: it also fails when handing https traffic from Firefox or Internet Explorer. It acts fine as a proxy for http:// traffic but it won't do HTTP CONNECTs . Do you know any open source proxy servers that support NTLM ?

Hi, i have the same Problem. My Client-Log looks exactly the same: recv_line: TCP port read timeout expired Send to HTTP proxy: 'CONNECT x.x.x.x:443 HTTP/1.0' Send to HTTP proxy: 'Host: x.x.x.x' Attempting NTLM Proxy-Authorization phase 3 NTLM Proxy-Authorization phase 3 failed: received corrupted data from proxy server TCP/UDP: Closing socket SIGTERM[soft,init_instance] received, process exiting My Client is behind an Astaro Security Gateway (in ActiveDirectory, so NTLM) and i try to connect to an other Astaro. I tried the Astaro SSl VPN Client (which is OpenVPN), and other older, and the newest official OpenVPN-Versions. Also i tried the fix from stortoaranci (thanks for that!). But nothing worked. Am I doing something wrong or is there another bug? @ stortoaranci: My knowledge about coding is not good. So im not able to compile a patched Windows Client. So i would be interested in a working Windows-Version. Thanks for help already, and sry for my bad English. Dave

Hi Dave, did you try the win version available at morzello.com? that works fine for me. I think the best practice is to take a look to the firefox ntlm implementation in order to resolve any possible issue. I don't know if anyone is working on that right now.

OpenVPN client behind ISA ( Forefront TMG )

stortoaranci

Hi Dave,

Mon May 16 08:00:21 2011 HTTP proxy returned: 'HTTP/1.1 200 Connection established'

means that ntlm auth goes ok. I think there is another issue then.

is it possible that your proxy uses a blacklist that do not allow you to connect to the server?

stortoaranci

since I have no news on this subject I post the link of a quick patch file I wrote to improve (try) ntlm support.

http://www.morzello.com/repository/network/openvpn-2.1.4-ntlm-patch.zip

I hope this could be useful for someone.

bye.

syrou

stortoaranci wrotesince I have no news on this subject I post the link of a quick patch file I wrote to improve (try) ntlm support.

http://www.morzello.com/repository/network/openvpn-2.1.4-ntlm-patch.zip

I hope this could be useful for someone.

bye.

I confirm that this patch works flawlessly. Thank you very much, stortoaranci.

It would be great if this patch could be included in the main trunk version of VPN, if it doesn't have any side effects (not in my case).

cathal

This Patch works fine for me, how can wee put it into the main release?
Because it is not fixed in the 2.2.x or 2.3.x releases.

pahanedition

I have the same problem.
Help, how fix openvpn 2.3 ?

cron2

cathal wroteThis Patch works fine for me, how can wee put it into the main release?
Because it is not fixed in the 2.2.x or 2.3.x releases.

There is an open bug in OpenVPN trac (#259), which has this patch as an attachment. Unfortunately, it completely lacks an *explanation* of what the patch does - and not having much understanding about NTLM, I can't "look at the code and understand it".

So, to get the patch into 2.3.3: explain what the patch does, and why. And please do so in the trac ticket, because I do not regularily monitor the forums.

thanks.

cathal

cron2 wrote
cathal wroteThis Patch works fine for me, how can wee put it into the main release?
Because it is not fixed in the 2.2.x or 2.3.x releases.
There is an open bug in OpenVPN trac (#259), which has this patch as an attachment. Unfortunately, it completely lacks an *explanation* of what the patch does - and not having much understanding about NTLM, I can't "look at the code and understand it".

So, to get the patch into 2.3.3: explain what the patch does, and why. And please do so in the trac ticket, because I do not regularily monitor the forums.

thanks.

a few seconds ago i posted everything i know about the patch
at trac 259
i hope it will help you

« Previous Page