Set up VPN server behind proxy server

eddyson1006

Just to explain about the environment first.
The computer is behind a proxy server with 160.0.235.240(as an example) with port 3128.
While, the proxy server only allowed port 443 which is https. But, when I start up the server with the following code:

port 443
proto tcp-server
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
server 10.8.0.0 255.255.255.0
duplicate-cn
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

It comes out with error of:

Mon Sep 12 02:43:47 2011 OpenVPN 2.2.1 Win32-MSVC++ [SSL] [LZO2] built on Jul 1
2011
Mon Sep 12 02:43:47 2011 NOTE: OpenVPN 2.1 requires '--script-security 2' or hig
her to call user-defined scripts or executables
Mon Sep 12 02:43:48 2011 Diffie-Hellman initialized with 1024 bit key
Mon Sep 12 02:43:48 2011 TLS-Auth MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0
]
Mon Sep 12 02:43:48 2011 Socket Buffers: R=[8192->8192] S=[8192->8192]
Mon Sep 12 02:43:48 2011 TCP/UDP: Socket bind failed on local address [undef]:44
3: Address already in use (WSAEADDRINUSE)
Mon Sep 12 02:43:48 2011 Exiting
Press any key to continue...

Anyway, I already confirm port 443 are clear. So, any ideas?

janjust

on the windows PC where you are starting OpenVPN port 443 is in use - you can use 'netstat -anp' (or was it '-ano' on windows?) to find out who is using port 443.

eddyson1006

I had search for the port 443 in used, but it returned free. What else could hold the server to start up? :geek:
Below are the step I do for checking the port.

Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\>netstat -o -n -a |findstr 0.0:443
TCP 0.0.0.0:443 0.0.0.0:0 LISTENING 1648

C:\>tasklist /FI "PID eq 1648"
INFO: No tasks are running which match the specified criteria.

Any ideas more? If I put other port like 1234 it would established easily, but anyway proxy only allowed port 443 as it is use commonly, user can't connect when using other port.

janjust

according to 'netstat' SOMETHING is listening on port 443 ; whether tasklist returns the actual process is a different matter. Just run 'tasklist' and look for 1648 in the output - I'm not sure whether tasklist will show system processes which claim that port.

eddyson1006

Yeap, I checked the process, 1648 is the nt authority process of https using port 443.
So, any way to share the port 443 or do NAT to receive data from 443 and convert it to any of the port?
Here is the img of the process on the port.
http://img825.imageshack.us/img825/4313/unledmdx.png

janjust

if your proxy server can only connect to port 443 then you MUST disable this HTTPS listener; if you can configure the proxy server to connect to other ports then choose one and run your server on that.

eddyson1006

After trying around the whole day, I have no more ideas on how to disable the process running on port 443. Because its the default 443 for https.
Anyway, maybe can change the default port of https from 443 to 444. And set a "port-share localhost 444" at the server.opvn file. http://www.packtpub.com/article/new-features-of-openvpn-2-1-and-2-2 under subtopic of "Port sharing with an HTTPS server".

The problem is, how to change https from 443 to 444? I tried on with some netsh and RSAT stuff but not so sure how to use it. Anybody got experience on it?

eddyson1006

Thanks janjust for help! I already got it. 😃