UDP working fine , TCP not connecting

dhruvpandit

i was using UDP 53 & 9200 ports already.
but now i added TCP 80,8080 & 443 , openvpn is running with all config on server.
but on client machine , its not connecting and giving this error.

Wed Dec 28 00:52:14 2011 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Wed Dec 28 00:52:17 2011 VERIFY OK: depth=1, /C=US/ST=CA/L=SanFrancisco/O=Fort-Funston/CN=Fort-Funston_CA/emailAddress=me@myhost.mydomain
Wed Dec 28 00:52:17 2011 VERIFY OK: depth=0, /C=US/ST=CA/L=SanFrancisco/O=Fort-Funston/CN=server/emailAddress=me@myhost.mydomain
Wed Dec 28 00:52:18 2011 Connection reset, restarting [0]
Wed Dec 28 00:52:18 2011 TCP/UDP: Closing socket
Wed Dec 28 00:52:18 2011 SIGUSR1[soft,connection-reset] received, process restarting
Wed Dec 28 00:52:18 2011 Restart pause, 5 second(s)

server config

local xxx.xxx.xxx.xxx #
port 80 #- port
proto tcp #- protocol
dev tun
tun-mtu 48000
mssfix 0
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
server 1.2.4.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 4.2.2.1"
keepalive 5 30
persist-key
persist-tun
status 9200.log
verb 3

client config

client
dev tun
proto tcp #- protocol
remote 178.33.104.190 80 #- SERVER IP and OPENVPN Port
resolv-retry infinite
tun-mtu 48000
mssfix 0
persist-key
persist-tun
ca ca.crt
auth-user-pass pass.txt
lport 53
verb 3

maikcat

post logs using verb 5 on server

>Wed Dec 28 00:52:18 2011 Connection reset, restarting [0]

something resets the connection...

Michael.

dhruvpandit

Wed Dec 28 03:01:54 2011 us=625000 Current Parameter Settings:
Wed Dec 28 03:01:54 2011 us=625000   config = 'tcp80.ovpn'
Wed Dec 28 03:01:54 2011 us=625000   mode = 0
Wed Dec 28 03:01:54 2011 us=625000   show_ciphers = DISABLED
Wed Dec 28 03:01:54 2011 us=625000   show_digests = DISABLED
Wed Dec 28 03:01:54 2011 us=625000   show_engines = DISABLED
Wed Dec 28 03:01:54 2011 us=625000   genkey = DISABLED
Wed Dec 28 03:01:54 2011 us=625000   key_pass_file = '[UNDEF]'
Wed Dec 28 03:01:54 2011 us=625000   show_tls_ciphers = DISABLED
Wed Dec 28 03:01:54 2011 us=625000 Connection profiles [default]:
Wed Dec 28 03:01:54 2011 us=625000   proto = tcp-client
Wed Dec 28 03:01:54 2011 us=625000   local = '[UNDEF]'
Wed Dec 28 03:01:54 2011 us=625000   local_port = 53
Wed Dec 28 03:01:54 2011 us=625000   remote = 'xxx.xxx.xxx.xxx'
Wed Dec 28 03:01:54 2011 us=625000   remote_port = 80
Wed Dec 28 03:01:54 2011 us=625000   remote_float = DISABLED
Wed Dec 28 03:01:54 2011 us=625000   bind_defined = DISABLED
Wed Dec 28 03:01:54 2011 us=625000   bind_local = ENABLED
Wed Dec 28 03:01:54 2011 us=625000   connect_retry_seconds = 5
Wed Dec 28 03:01:54 2011 us=625000   connect_timeout = 10
Wed Dec 28 03:01:54 2011 us=625000   connect_retry_max = 0
Wed Dec 28 03:01:54 2011 us=625000   socks_proxy_server = '[UNDEF]'
Wed Dec 28 03:01:54 2011 us=625000   socks_proxy_port = 0
Wed Dec 28 03:01:54 2011 us=625000   socks_proxy_retry = DISABLED
Wed Dec 28 03:01:54 2011 us=625000 Connection profiles END
Wed Dec 28 03:01:54 2011 us=625000   remote_random = DISABLED
Wed Dec 28 03:01:54 2011 us=625000   ipchange = '[UNDEF]'
Wed Dec 28 03:01:54 2011 us=625000   dev = 'tun'
Wed Dec 28 03:01:54 2011 us=625000   dev_type = '[UNDEF]'
Wed Dec 28 03:01:54 2011 us=625000   dev_node = '[UNDEF]'
Wed Dec 28 03:01:54 2011 us=625000   lladdr = '[UNDEF]'
Wed Dec 28 03:01:54 2011 us=625000   topology = 1
Wed Dec 28 03:01:54 2011 us=625000   tun_ipv6 = DISABLED
Wed Dec 28 03:01:54 2011 us=625000   ifconfig_local = '[UNDEF]'
Wed Dec 28 03:01:54 2011 us=625000   ifconfig_remote_netmask = '[UNDEF]'
Wed Dec 28 03:01:54 2011 us=625000   ifconfig_noexec = DISABLED
Wed Dec 28 03:01:54 2011 us=625000   ifconfig_nowarn = DISABLED
Wed Dec 28 03:01:54 2011 us=625000   shaper = 0
Wed Dec 28 03:01:54 2011 us=625000   tun_mtu = 48000
Wed Dec 28 03:01:54 2011 us=625000   tun_mtu_defined = ENABLED
Wed Dec 28 03:01:54 2011 us=625000   link_mtu = 1500
Wed Dec 28 03:01:54 2011 us=625000   link_mtu_defined = DISABLED
Wed Dec 28 03:01:54 2011 us=625000   tun_mtu_extra = 0
Wed Dec 28 03:01:54 2011 us=625000   tun_mtu_extra_defined = DISABLED
Wed Dec 28 03:01:54 2011 us=625000   fragment = 0
Wed Dec 28 03:01:54 2011 us=625000   mtu_discover_type = -1
Wed Dec 28 03:01:54 2011 us=625000   mtu_test = 0
Wed Dec 28 03:01:54 2011 us=625000   mlock = DISABLED
Wed Dec 28 03:01:54 2011 us=625000   keepalive_ping = 0
Wed Dec 28 03:01:54 2011 us=625000   keepalive_timeout = 0
Wed Dec 28 03:01:54 2011 us=625000   inactivity_timeout = 0
Wed Dec 28 03:01:54 2011 us=625000   ping_send_timeout = 0
Wed Dec 28 03:01:54 2011 us=625000   ping_rec_timeout = 0
Wed Dec 28 03:01:54 2011 us=625000   ping_rec_timeout_action = 0
Wed Dec 28 03:01:54 2011 us=625000   ping_timer_remote = DISABLED
Wed Dec 28 03:01:54 2011 us=625000   remap_sigusr1 = 0
Wed Dec 28 03:01:54 2011 us=625000   explicit_exit_notification = 0
Wed Dec 28 03:01:54 2011 us=625000   persist_tun = ENABLED
Wed Dec 28 03:01:54 2011 us=625000   persist_local_ip = DISABLED
Wed Dec 28 03:01:54 2011 us=625000   persist_remote_ip = DISABLED
Wed Dec 28 03:01:54 2011 us=625000   persist_key = ENABLED
Wed Dec 28 03:01:54 2011 us=625000   mssfix = 0
Wed Dec 28 03:01:54 2011 us=625000   resolve_retry_seconds = 1000000000
Wed Dec 28 03:01:54 2011 us=625000   username = '[UNDEF]'
Wed Dec 28 03:01:54 2011 us=625000   groupname = '[UNDEF]'
Wed Dec 28 03:01:54 2011 us=625000   chroot_dir = '[UNDEF]'
Wed Dec 28 03:01:54 2011 us=625000   cd_dir = '[UNDEF]'
Wed Dec 28 03:01:54 2011 us=625000   writepid = '[UNDEF]'
Wed Dec 28 03:01:54 2011 us=812000   up_script = '[UNDEF]'
Wed Dec 28 03:01:54 2011 us=812000   down_script = '[UNDEF]'
Wed Dec 28 03:01:54 2011 us=812000   down_pre = DISABLED
Wed Dec 28 03:01:54 2011 us=812000   up_restart = DISABLED
Wed Dec 28 03:01:54 2011 us=812000   up_delay = DISABLED
Wed Dec 28 03:01:54 2011 us=812000   daemon = DISABLED
Wed Dec 28 03:01:54 2011 us=812000   inetd = 0
Wed Dec 28 03:01:54 2011 us=812000   log = DISABLED
Wed Dec 28 03:01:54 2011 us=812000   suppress_timestamps = DISABLED
Wed Dec 28 03:01:54 2011 us=812000   nice = 0
Wed Dec 28 03:01:54 2011 us=812000   verbosity = 5
Wed Dec 28 03:01:54 2011 us=812000   mute = 0
Wed Dec 28 03:01:54 2011 us=812000   gremlin = 0
Wed Dec 28 03:01:54 2011 us=812000   status_file = '[UNDEF]'
Wed Dec 28 03:01:54 2011 us=812000   status_file_version = 1
Wed Dec 28 03:01:54 2011 us=812000   status_file_update_freq = 60
Wed Dec 28 03:01:54 2011 us=812000   occ = ENABLED
Wed Dec 28 03:01:54 2011 us=812000   rcvbuf = 0
Wed Dec 28 03:01:54 2011 us=812000   sndbuf = 0
Wed Dec 28 03:01:54 2011 us=828000   sockflags = 0
Wed Dec 28 03:01:54 2011 us=828000   fast_io = DISABLED
Wed Dec 28 03:01:54 2011 us=828000   lzo = 0
Wed Dec 28 03:01:54 2011 us=828000   route_script = '[UNDEF]'
Wed Dec 28 03:01:54 2011 us=828000   route_default_gateway = '[UNDEF]'
Wed Dec 28 03:01:54 2011 us=828000   route_default_metric = 0
Wed Dec 28 03:01:54 2011 us=828000   route_noexec = DISABLED
Wed Dec 28 03:01:54 2011 us=828000   route_delay = 5
Wed Dec 28 03:01:54 2011 us=828000   route_delay_window = 30
Wed Dec 28 03:01:54 2011 us=828000   route_delay_defined = ENABLED
Wed Dec 28 03:01:54 2011 us=828000   route_nopull = DISABLED
Wed Dec 28 03:01:54 2011 us=828000   route_gateway_via_dhcp = DISABLED
Wed Dec 28 03:01:54 2011 us=828000   max_routes = 100
Wed Dec 28 03:01:54 2011 us=828000   allow_pull_fqdn = DISABLED
Wed Dec 28 03:01:54 2011 us=828000   management_addr = '[UNDEF]'
Wed Dec 28 03:01:54 2011 us=828000   management_port = 0
Wed Dec 28 03:01:54 2011 us=828000   management_user_pass = '[UNDEF]'
Wed Dec 28 03:01:54 2011 us=859000   management_log_history_cache = 250
Wed Dec 28 03:01:54 2011 us=859000   management_echo_buffer_size = 100
Wed Dec 28 03:01:54 2011 us=859000   management_write_peer_info_file = '[UNDEF]'
Wed Dec 28 03:01:54 2011 us=859000   management_client_user = '[UNDEF]'
Wed Dec 28 03:01:54 2011 us=859000   management_client_group = '[UNDEF]'
Wed Dec 28 03:01:54 2011 us=859000   management_flags = 0
Wed Dec 28 03:01:54 2011 us=859000   shared_secret_file = '[UNDEF]'
Wed Dec 28 03:01:54 2011 us=859000   key_direction = 0
Wed Dec 28 03:01:54 2011 us=859000   ciphername_defined = ENABLED
Wed Dec 28 03:01:54 2011 us=859000   ciphername = 'BF-CBC'
Wed Dec 28 03:01:54 2011 us=859000   authname_defined = ENABLED
Wed Dec 28 03:01:54 2011 us=859000   authname = 'SHA1'
Wed Dec 28 03:01:54 2011 us=859000   prng_hash = 'SHA1'
Wed Dec 28 03:01:54 2011 us=859000   prng_nonce_secret_len = 16
Wed Dec 28 03:01:54 2011 us=859000   keysize = 0
Wed Dec 28 03:01:54 2011 us=890000   engine = DISABLED
Wed Dec 28 03:01:54 2011 us=890000   replay = ENABLED
Wed Dec 28 03:01:54 2011 us=890000   mute_replay_warnings = DISABLED
Wed Dec 28 03:01:54 2011 us=890000   replay_window = 64
Wed Dec 28 03:01:54 2011 us=890000   replay_time = 15
Wed Dec 28 03:01:54 2011 us=890000   packet_id_file = '[UNDEF]'
Wed Dec 28 03:01:54 2011 us=890000   use_iv = ENABLED
Wed Dec 28 03:01:54 2011 us=890000   test_crypto = DISABLED
Wed Dec 28 03:01:54 2011 us=890000   tls_server = DISABLED
Wed Dec 28 03:01:54 2011 us=890000   tls_client = ENABLED
Wed Dec 28 03:01:54 2011 us=890000   key_method = 2
Wed Dec 28 03:01:54 2011 us=890000   ca_file = 'ca.crt'
Wed Dec 28 03:01:54 2011 us=890000   ca_path = '[UNDEF]'
Wed Dec 28 03:01:54 2011 us=890000   dh_file = '[UNDEF]'
Wed Dec 28 03:01:54 2011 us=890000   cert_file = '[UNDEF]'
Wed Dec 28 03:01:54 2011 us=890000   priv_key_file = '[UNDEF]'
Wed Dec 28 03:01:54 2011 us=890000   pkcs12_file = '[UNDEF]'
Wed Dec 28 03:01:54 2011 us=921000   cryptoapi_cert = '[UNDEF]'
Wed Dec 28 03:01:54 2011 us=921000   cipher_list = '[UNDEF]'
Wed Dec 28 03:01:54 2011 us=921000   tls_verify = '[UNDEF]'
Wed Dec 28 03:01:54 2011 us=921000   tls_export_cert = '[UNDEF]'
Wed Dec 28 03:01:54 2011 us=921000   tls_remote = '[UNDEF]'
Wed Dec 28 03:01:54 2011 us=921000   crl_file = '[UNDEF]'
Wed Dec 28 03:01:54 2011 us=921000   ns_cert_type = 0
Wed Dec 28 03:01:54 2011 us=921000   remote_cert_ku[i] = 0
Wed Dec 28 03:01:54 2011 us=921000   remote_cert_ku[i] = 0
Wed Dec 28 03:01:54 2011 us=921000   remote_cert_ku[i] = 0
Wed Dec 28 03:01:54 2011 us=921000   remote_cert_ku[i] = 0
Wed Dec 28 03:01:54 2011 us=921000   remote_cert_ku[i] = 0
Wed Dec 28 03:01:54 2011 us=921000   remote_cert_ku[i] = 0
Wed Dec 28 03:01:54 2011 us=921000   remote_cert_ku[i] = 0
Wed Dec 28 03:01:54 2011 us=921000   remote_cert_ku[i] = 0
Wed Dec 28 03:01:54 2011 us=921000   remote_cert_ku[i] = 0
Wed Dec 28 03:01:54 2011 us=953000   remote_cert_ku[i] = 0
Wed Dec 28 03:01:54 2011 us=953000   remote_cert_ku[i] = 0
Wed Dec 28 03:01:54 2011 us=953000   remote_cert_ku[i] = 0
Wed Dec 28 03:01:54 2011 us=953000   remote_cert_ku[i] = 0
Wed Dec 28 03:01:54 2011 us=953000   remote_cert_ku[i] = 0
Wed Dec 28 03:01:54 2011 us=953000   remote_cert_ku[i] = 0
Wed Dec 28 03:01:54 2011 us=953000   remote_cert_ku[i] = 0
Wed Dec 28 03:01:54 2011 us=953000   remote_cert_eku = '[UNDEF]'
Wed Dec 28 03:01:54 2011 us=953000   tls_timeout = 2
Wed Dec 28 03:01:54 2011 us=953000   renegotiate_bytes = 0
Wed Dec 28 03:01:54 2011 us=953000   renegotiate_packets = 0
Wed Dec 28 03:01:54 2011 us=953000   renegotiate_seconds = 3600
Wed Dec 28 03:01:54 2011 us=953000   handshake_window = 60
Wed Dec 28 03:01:54 2011 us=953000   transition_window = 3600
Wed Dec 28 03:01:54 2011 us=953000   single_session = DISABLED
Wed Dec 28 03:01:54 2011 us=953000   push_peer_info = DISABLED
Wed Dec 28 03:01:54 2011 us=953000   tls_exit = DISABLED
Wed Dec 28 03:01:54 2011 us=968000   tls_auth_file = '[UNDEF]'
Wed Dec 28 03:01:54 2011 us=968000   pkcs11_protected_authentication = DISABLED
Wed Dec 28 03:01:54 2011 us=968000   pkcs11_protected_authentication = DISABLED
Wed Dec 28 03:01:54 2011 us=968000   pkcs11_protected_authentication = DISABLED
Wed Dec 28 03:01:54 2011 us=968000   pkcs11_protected_authentication = DISABLED
Wed Dec 28 03:01:54 2011 us=968000   pkcs11_protected_authentication = DISABLED
Wed Dec 28 03:01:54 2011 us=968000   pkcs11_protected_authentication = DISABLED
Wed Dec 28 03:01:54 2011 us=968000   pkcs11_protected_authentication = DISABLED
Wed Dec 28 03:01:54 2011 us=968000   pkcs11_protected_authentication = DISABLED
Wed Dec 28 03:01:54 2011 us=968000   pkcs11_protected_authentication = DISABLED
Wed Dec 28 03:01:54 2011 us=968000   pkcs11_protected_authentication = DISABLED
Wed Dec 28 03:01:54 2011 us=968000   pkcs11_protected_authentication = DISABLED
Wed Dec 28 03:01:54 2011 us=968000   pkcs11_protected_authentication = DISABLED
Wed Dec 28 03:01:55 2011   pkcs11_protected_authentication = DISABLED
Wed Dec 28 03:01:55 2011   pkcs11_protected_authentication = DISABLED
Wed Dec 28 03:01:55 2011   pkcs11_protected_authentication = DISABLED
Wed Dec 28 03:01:55 2011   pkcs11_protected_authentication = DISABLED
Wed Dec 28 03:01:55 2011   pkcs11_private_mode = 00000000
Wed Dec 28 03:01:55 2011   pkcs11_private_mode = 00000000
Wed Dec 28 03:01:55 2011   pkcs11_private_mode = 00000000
Wed Dec 28 03:01:55 2011   pkcs11_private_mode = 00000000
Wed Dec 28 03:01:55 2011   pkcs11_private_mode = 00000000
Wed Dec 28 03:01:55 2011   pkcs11_private_mode = 00000000
Wed Dec 28 03:01:55 2011   pkcs11_private_mode = 00000000
Wed Dec 28 03:01:55 2011   pkcs11_private_mode = 00000000
Wed Dec 28 03:01:55 2011   pkcs11_private_mode = 00000000
Wed Dec 28 03:01:55 2011   pkcs11_private_mode = 00000000
Wed Dec 28 03:01:55 2011   pkcs11_private_mode = 00000000
Wed Dec 28 03:01:55 2011   pkcs11_private_mode = 00000000
Wed Dec 28 03:01:55 2011 us=31000   pkcs11_private_mode = 00000000
Wed Dec 28 03:01:55 2011 us=31000   pkcs11_private_mode = 00000000
Wed Dec 28 03:01:55 2011 us=31000   pkcs11_private_mode = 00000000
Wed Dec 28 03:01:55 2011 us=31000   pkcs11_private_mode = 00000000
Wed Dec 28 03:01:55 2011 us=31000   pkcs11_cert_private = DISABLED
Wed Dec 28 03:01:55 2011 us=31000   pkcs11_cert_private = DISABLED
Wed Dec 28 03:01:55 2011 us=31000   pkcs11_cert_private = DISABLED
Wed Dec 28 03:01:55 2011 us=31000   pkcs11_cert_private = DISABLED
Wed Dec 28 03:01:55 2011 us=31000   pkcs11_cert_private = DISABLED
Wed Dec 28 03:01:55 2011 us=31000   pkcs11_cert_private = DISABLED
Wed Dec 28 03:01:55 2011 us=31000   pkcs11_cert_private = DISABLED
Wed Dec 28 03:01:55 2011 us=31000   pkcs11_cert_private = DISABLED
Wed Dec 28 03:01:55 2011 us=31000   pkcs11_cert_private = DISABLED
Wed Dec 28 03:01:55 2011 us=31000   pkcs11_cert_private = DISABLED
Wed Dec 28 03:01:55 2011 us=31000   pkcs11_cert_private = DISABLED
Wed Dec 28 03:01:55 2011 us=46000   pkcs11_cert_private = DISABLED
Wed Dec 28 03:01:55 2011 us=46000   pkcs11_cert_private = DISABLED
Wed Dec 28 03:01:55 2011 us=46000   pkcs11_cert_private = DISABLED
Wed Dec 28 03:01:55 2011 us=46000   pkcs11_cert_private = DISABLED
Wed Dec 28 03:01:55 2011 us=46000   pkcs11_cert_private = DISABLED
Wed Dec 28 03:01:55 2011 us=46000   pkcs11_pin_cache_period = -1
Wed Dec 28 03:01:55 2011 us=46000   pkcs11_id = '[UNDEF]'
Wed Dec 28 03:01:55 2011 us=46000   pkcs11_id_management = DISABLED
Wed Dec 28 03:01:55 2011 us=46000   server_network = 0.0.0.0
Wed Dec 28 03:01:55 2011 us=46000   server_netmask = 0.0.0.0
Wed Dec 28 03:01:55 2011 us=46000   server_bridge_ip = 0.0.0.0
Wed Dec 28 03:01:55 2011 us=46000   server_bridge_netmask = 0.0.0.0
Wed Dec 28 03:01:55 2011 us=46000   server_bridge_pool_start = 0.0.0.0
Wed Dec 28 03:01:55 2011 us=46000   server_bridge_pool_end = 0.0.0.0
Wed Dec 28 03:01:55 2011 us=78000   ifconfig_pool_defined = DISABLED
Wed Dec 28 03:01:55 2011 us=78000   ifconfig_pool_start = 0.0.0.0
Wed Dec 28 03:01:55 2011 us=78000   ifconfig_pool_end = 0.0.0.0
Wed Dec 28 03:01:55 2011 us=78000   ifconfig_pool_netmask = 0.0.0.0
Wed Dec 28 03:01:55 2011 us=78000   ifconfig_pool_persist_filename = '[UNDEF]'
Wed Dec 28 03:01:55 2011 us=78000   ifconfig_pool_persist_refresh_freq = 600
Wed Dec 28 03:01:55 2011 us=78000   n_bcast_buf = 256
Wed Dec 28 03:01:55 2011 us=78000   tcp_queue_limit = 64
Wed Dec 28 03:01:55 2011 us=78000   real_hash_size = 256
Wed Dec 28 03:01:55 2011 us=78000   virtual_hash_size = 256
Wed Dec 28 03:01:55 2011 us=78000   client_connect_script = '[UNDEF]'
Wed Dec 28 03:01:55 2011 us=78000   learn_address_script = '[UNDEF]'
Wed Dec 28 03:01:55 2011 us=78000   client_disconnect_script = '[UNDEF]'
Wed Dec 28 03:01:55 2011 us=78000   client_config_dir = '[UNDEF]'
Wed Dec 28 03:01:55 2011 us=78000   ccd_exclusive = DISABLED
Wed Dec 28 03:01:55 2011 us=93000   tmp_dir = 'C:\DOCUME~1\dhruv\LOCALS~1\Temp\'
Wed Dec 28 03:01:55 2011 us=93000   push_ifconfig_defined = DISABLED
Wed Dec 28 03:01:55 2011 us=93000   push_ifconfig_local = 0.0.0.0
Wed Dec 28 03:01:55 2011 us=93000   push_ifconfig_remote_netmask = 0.0.0.0
Wed Dec 28 03:01:55 2011 us=93000   enable_c2c = DISABLED
Wed Dec 28 03:01:55 2011 us=93000   duplicate_cn = DISABLED
Wed Dec 28 03:01:55 2011 us=93000   cf_max = 0
Wed Dec 28 03:01:55 2011 us=93000   cf_per = 0
Wed Dec 28 03:01:55 2011 us=93000   max_clients = 1024
Wed Dec 28 03:01:55 2011 us=93000   max_routes_per_client = 256
Wed Dec 28 03:01:55 2011 us=93000   auth_user_pass_verify_script = '[UNDEF]'
Wed Dec 28 03:01:55 2011 us=93000   auth_user_pass_verify_script_via_file = DISABLED
Wed Dec 28 03:01:55 2011 us=93000   ssl_flags = 0
Wed Dec 28 03:01:55 2011 us=93000   client = ENABLED
Wed Dec 28 03:01:55 2011 us=93000   pull = ENABLED
Wed Dec 28 03:01:55 2011 us=125000   auth_user_pass_file = 'pass.txt'
Wed Dec 28 03:01:55 2011 us=125000   show_net_up = DISABLED
Wed Dec 28 03:01:55 2011 us=125000   route_method = 0
Wed Dec 28 03:01:55 2011 us=125000   ip_win32_defined = DISABLED
Wed Dec 28 03:01:55 2011 us=125000   ip_win32_type = 3
Wed Dec 28 03:01:55 2011 us=125000   dhcp_masq_offset = 0
Wed Dec 28 03:01:55 2011 us=125000   dhcp_lease_time = 31536000
Wed Dec 28 03:01:55 2011 us=125000   tap_sleep = 0
Wed Dec 28 03:01:55 2011 us=125000   dhcp_options = DISABLED
Wed Dec 28 03:01:55 2011 us=125000   dhcp_renew = DISABLED
Wed Dec 28 03:01:55 2011 us=125000   dhcp_pre_release = DISABLED
Wed Dec 28 03:01:55 2011 us=125000   dhcp_release = DISABLED
Wed Dec 28 03:01:55 2011 us=125000   domain = '[UNDEF]'
Wed Dec 28 03:01:55 2011 us=125000   netbios_scope = '[UNDEF]'
Wed Dec 28 03:01:55 2011 us=125000   netbios_node_type = 0
Wed Dec 28 03:01:55 2011 us=125000   disable_nbt = DISABLED
Wed Dec 28 03:01:55 2011 us=156000 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Wed Dec 28 03:01:55 2011 us=156000 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Wed Dec 28 03:01:55 2011 us=156000 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Dec 28 03:01:55 2011 us=421000 Control Channel MTU parms [ L:48043 D:140 EF:40 EB:0 ET:0 EL:0 ]
Wed Dec 28 03:01:55 2011 us=421000 Socket Buffers: R=[8192->8192] S=[8192->8192]
Wed Dec 28 03:01:55 2011 us=421000 Data Channel MTU parms [ L:48043 D:48043 EF:43 EB:4 ET:0 EL:0 ]
Wed Dec 28 03:01:55 2011 us=421000 Local Options String: 'V4,dev-type tun,link-mtu 48043,tun-mtu 48000,proto TCPv4_CLIENT,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Wed Dec 28 03:01:55 2011 us=421000 Expected Remote Options String: 'V4,dev-type tun,link-mtu 48043,tun-mtu 48000,proto TCPv4_SERVER,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Wed Dec 28 03:01:55 2011 us=421000 Local Options hash (VER=V4): '2490557f'
Wed Dec 28 03:01:55 2011 us=421000 Expected Remote Options hash (VER=V4): '6280c707'
Wed Dec 28 03:01:55 2011 us=421000 Attempting to establish TCP connection with xxx.xxx.xxx.xxx:80
Wed Dec 28 03:01:55 2011 us=625000 TCP connection established with xxx.xxx.xxx.xxx:80
Wed Dec 28 03:01:55 2011 us=625000 TCPv4_CLIENT link local (bound): [undef]:53
Wed Dec 28 03:01:55 2011 us=625000 TCPv4_CLIENT link remote: xxx.xxx.xxx.xxx:80
Wed Dec 28 03:01:55 2011 us=796000 TLS: Initial packet from xxx.xxx.xxx.xxx:80, sid=13bb9513 e2545771
Wed Dec 28 03:01:55 2011 us=796000 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Wed Dec 28 03:01:58 2011 us=859000 VERIFY OK: depth=1, /C=US/ST=CA/L=SanFrancisco/O=Fort-Funston/CN=Fort-Funston_CA/emailAddress=me@myhost.mydomain
Wed Dec 28 03:01:58 2011 us=859000 VERIFY OK: depth=0, /C=US/ST=CA/L=SanFrancisco/O=Fort-Funston/CN=server/emailAddress=me@myhost.mydomain
Wed Dec 28 03:02:00 2011 us=250000 Connection reset, restarting [0]
Wed Dec 28 03:02:00 2011 us=250000 TCP/UDP: Closing socket
Wed Dec 28 03:02:00 2011 us=250000 SIGUSR1[soft,connection-reset] received, process restarting
Wed Dec 28 03:02:00 2011 us=250000 Restart pause, 5 second(s)
Wed Dec 28 03:02:05 2011 us=250000 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Wed Dec 28 03:02:05 2011 us=250000 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Dec 28 03:02:05 2011 us=250000 Re-using SSL/TLS context
Wed Dec 28 03:02:05 2011 us=250000 Control Channel MTU parms [ L:48043 D:140 EF:40 EB:0 ET:0 EL:0 ]
Wed Dec 28 03:02:05 2011 us=250000 Socket Buffers: R=[8192->8192] S=[8192->8192]
Wed Dec 28 03:02:05 2011 us=250000 Data Channel MTU parms [ L:48043 D:48043 EF:43 EB:4 ET:0 EL:0 ]
Wed Dec 28 03:02:05 2011 us=250000 Local Options String: 'V4,dev-type tun,link-mtu 48043,tun-mtu 48000,proto TCPv4_CLIENT,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Wed Dec 28 03:02:05 2011 us=250000 Expected Remote Options String: 'V4,dev-type tun,link-mtu 48043,tun-mtu 48000,proto TCPv4_SERVER,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Wed Dec 28 03:02:05 2011 us=250000 Local Options hash (VER=V4): '2490557f'
Wed Dec 28 03:02:05 2011 us=250000 Expected Remote Options hash (VER=V4): '6280c707'
Wed Dec 28 03:02:05 2011 us=250000 Attempting to establish TCP connection with xxx.xxx.xxx.xxx:80
Wed Dec 28 03:02:05 2011 us=437000 TCP connection established with xxx.xxx.xxx.xxx:80
Wed Dec 28 03:02:05 2011 us=437000 TCPv4_CLIENT link local (bound): [undef]:53
Wed Dec 28 03:02:05 2011 us=437000 TCPv4_CLIENT link remote: xxx.xxx.xxx.xxx:80
Wed Dec 28 03:02:05 2011 us=625000 TLS: Initial packet from xxx.xxx.xxx.xxx:80, sid=de72b692 95311843
Wed Dec 28 03:02:08 2011 us=484000 VERIFY OK: depth=1, /C=US/ST=CA/L=SanFrancisco/O=Fort-Funston/CN=Fort-Funston_CA/emailAddress=me@myhost.mydomain
Wed Dec 28 03:02:08 2011 us=484000 VERIFY OK: depth=0, /C=US/ST=CA/L=SanFrancisco/O=Fort-Funston/CN=server/emailAddress=me@myhost.mydomain
Wed Dec 28 03:02:11 2011 us=578000 Connection reset, restarting [0]
Wed Dec 28 03:02:11 2011 us=578000 TCP/UDP: Closing socket
Wed Dec 28 03:02:11 2011 us=578000 SIGUSR1[soft,connection-reset] received, process restarting
Wed Dec 28 03:02:11 2011 us=578000 Restart pause, 5 second(s)
Wed Dec 28 03:02:16 2011 us=578000 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Wed Dec 28 03:02:16 2011 us=578000 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Dec 28 03:02:16 2011 us=578000 Re-using SSL/TLS context
Wed Dec 28 03:02:16 2011 us=578000 Control Channel MTU parms [ L:48043 D:140 EF:40 EB:0 ET:0 EL:0 ]
Wed Dec 28 03:02:16 2011 us=578000 Socket Buffers: R=[8192->8192] S=[8192->8192]
Wed Dec 28 03:02:16 2011 us=578000 Data Channel MTU parms [ L:48043 D:48043 EF:43 EB:4 ET:0 EL:0 ]
Wed Dec 28 03:02:16 2011 us=578000 Local Options String: 'V4,dev-type tun,link-mtu 48043,tun-mtu 48000,proto TCPv4_CLIENT,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Wed Dec 28 03:02:16 2011 us=578000 Expected Remote Options String: 'V4,dev-type tun,link-mtu 48043,tun-mtu 48000,proto TCPv4_SERVER,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Wed Dec 28 03:02:16 2011 us=578000 Local Options hash (VER=V4): '2490557f'
Wed Dec 28 03:02:16 2011 us=578000 Expected Remote Options hash (VER=V4): '6280c707'
Wed Dec 28 03:02:16 2011 us=578000 Attempting to establish TCP connection with xxx.xxx.xxx.xxx:80
Wed Dec 28 03:02:16 2011 us=750000 TCP connection established with xxx.xxx.xxx.xxx:80
Wed Dec 28 03:02:16 2011 us=750000 TCPv4_CLIENT link local (bound): [undef]:53
Wed Dec 28 03:02:16 2011 us=750000 TCPv4_CLIENT link remote: xxx.xxx.xxx.xxx:80
Wed Dec 28 03:02:16 2011 us=937000 TLS: Initial packet from xxx.xxx.xxx.xxx:80, sid=d1eb197a 14489c9b
Wed Dec 28 03:02:19 2011 us=968000 VERIFY OK: depth=1, /C=US/ST=CA/L=SanFrancisco/O=Fort-Funston/CN=Fort-Funston_CA/emailAddress=me@myhost.mydomain
Wed Dec 28 03:02:19 2011 us=968000 VERIFY OK: depth=0, /C=US/ST=CA/L=SanFrancisco/O=Fort-Funston/CN=server/emailAddress=me@myhost.mydomain
Wed Dec 28 03:02:21 2011 us=265000 Connection reset, restarting [0]
Wed Dec 28 03:02:21 2011 us=265000 TCP/UDP: Closing socket
Wed Dec 28 03:02:21 2011 us=265000 SIGUSR1[soft,connection-reset] received, process restarting
Wed Dec 28 03:02:21 2011 us=265000 Restart pause, 5 second(s)

maikcat

post server log with verb 5

Michael.

dhruvpandit

sorry for silly questions, but where can i find server logs??
i tried /etc/openvpn/9200.log but it was blank!

dhruvpandit

i think here this is called server log , pls correct me if i am wrong.

Thu Dec 29 07:10:12 2011 MULTI: multi_create_instance called
Thu Dec 29 07:10:12 2011 Re-using SSL/TLS context
Thu Dec 29 07:10:12 2011 Control Channel MTU parms [ L:48043 D:140 EF:40 EB:0 ET                                        :0 EL:0 ]
Thu Dec 29 07:10:12 2011 Data Channel MTU parms [ L:48043 D:48043 EF:43 EB:4 ET:                                        0 EL:0 ]
Thu Dec 29 07:10:12 2011 Local Options hash (VER=V4): '6280c707'
Thu Dec 29 07:10:12 2011 Expected Remote Options hash (VER=V4): '2490557f'
Thu Dec 29 07:10:12 2011 TCP connection established with 1.22.83.112:53
Thu Dec 29 07:10:12 2011 TCPv4_SERVER link local: [undef]
Thu Dec 29 07:10:12 2011 TCPv4_SERVER link remote: 1.22.83.112:53
Thu Dec 29 07:10:12 2011 1.22.83.112:53 TLS: Initial packet from 1.22.83.112:53,                                         sid=61ce74e4 0ae83d73
Thu Dec 29 07:10:16 2011 1.22.83.112:53 TLS_ERROR: BIO read tls_read_plaintext e                                        rror: error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not retur                                        n a certificate
Thu Dec 29 07:10:16 2011 1.22.83.112:53 TLS Error: TLS object -> incoming plaint                                        ext read error
Thu Dec 29 07:10:16 2011 1.22.83.112:53 TLS Error: TLS handshake failed
Thu Dec 29 07:10:16 2011 1.22.83.112:53 Fatal TLS error (check_tls_errors_co), r                                        estarting
Thu Dec 29 07:10:16 2011 1.22.83.112:53 SIGUSR1[soft,tls-error] received, client                                        -instance restarting
Thu Dec 29 07:10:16 2011 TCP/UDP: Closing socket
Thu Dec 29 07:10:22 2011 MULTI: multi_create_instance called
Thu Dec 29 07:10:22 2011 Re-using SSL/TLS context
Thu Dec 29 07:10:22 2011 Control Channel MTU parms [ L:48043 D:140 EF:40 EB:0 ET                                        :0 EL:0 ]
Thu Dec 29 07:10:22 2011 Data Channel MTU parms [ L:48043 D:48043 EF:43 EB:4 ET:                                        0 EL:0 ]
Thu Dec 29 07:10:22 2011 Local Options hash (VER=V4): '6280c707'
Thu Dec 29 07:10:22 2011 Expected Remote Options hash (VER=V4): '2490557f'
Thu Dec 29 07:10:22 2011 TCP connection established with 1.22.83.112:53
Thu Dec 29 07:10:22 2011 TCPv4_SERVER link local: [undef]
Thu Dec 29 07:10:22 2011 TCPv4_SERVER link remote: 1.22.83.112:53
Thu Dec 29 07:10:22 2011 1.22.83.112:53 TLS: Initial packet from 1.22.83.112:53,                                         sid=bee64f03 8554b5dc
Thu Dec 29 07:10:26 2011 1.22.83.112:53 TLS_ERROR: BIO read tls_read_plaintext e                                        rror: error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not retur                                        n a certificate
Thu Dec 29 07:10:26 2011 1.22.83.112:53 TLS Error: TLS object -> incoming plaint                                        ext read error
Thu Dec 29 07:10:26 2011 1.22.83.112:53 TLS Error: TLS handshake failed
Thu Dec 29 07:10:26 2011 1.22.83.112:53 Fatal TLS error (check_tls_errors_co), r                                        estarting
Thu Dec 29 07:10:26 2011 1.22.83.112:53 SIGUSR1[soft,tls-error] received, client                                        -instance restarting
Thu Dec 29 07:10:26 2011 TCP/UDP: Closing socket
Thu Dec 29 07:10:31 2011 MULTI: multi_create_instance called
Thu Dec 29 07:10:31 2011 Re-using SSL/TLS context
Thu Dec 29 07:10:31 2011 Control Channel MTU parms [ L:48043 D:140 EF:40 EB:0 ET                                        :0 EL:0 ]
Thu Dec 29 07:10:31 2011 Data Channel MTU parms [ L:48043 D:48043 EF:43 EB:4 ET:                                        0 EL:0 ]
Thu Dec 29 07:10:31 2011 Local Options hash (VER=V4): '6280c707'
Thu Dec 29 07:10:31 2011 Expected Remote Options hash (VER=V4): '2490557f'
Thu Dec 29 07:10:31 2011 TCP connection established with 1.22.83.112:53
Thu Dec 29 07:10:31 2011 TCPv4_SERVER link local: [undef]
Thu Dec 29 07:10:31 2011 TCPv4_SERVER link remote: 1.22.83.112:53
Thu Dec 29 07:10:31 2011 1.22.83.112:53 Connection reset, restarting [0]
Thu Dec 29 07:10:31 2011 1.22.83.112:53 SIGUSR1[soft,connection-reset] received,                                         client-instance restarting
Thu Dec 29 07:10:31 2011 TCP/UDP: Closing socket

dhruvpandit

sorry for mentioning, but i am using same IP for all the UDP / TCP configs, is it ok?

actually, i am already running two UDP configs on same IP.
so i though it will be fine to run TCP also on same IP.

maikcat

from manual

--cert file
Local peer's signed certificate in .pem format -- must be signed by a certificate authority whose certificate is in --ca file. Each peer in an OpenVPN link running in TLS mode should have its own certificate and private key file. In addition, each certificate should have been signed by the key of a certificate authority whose public key resides in the --ca certificate authority file.

you *MUST* create a certificate for your client

-or-

remove cert/key directive from server conf.

Michael.

dhruvpandit

maikcat wrotefrom manual

--cert file
Local peer's signed certificate in .pem format -- must be signed by a certificate authority whose certificate is in --ca file. Each peer in an OpenVPN link running in TLS mode should have its own certificate and private key file. In addition, each certificate should have been signed by the key of a certificate authority whose public key resides in the --ca certificate authority file.
you *MUST* create a certificate for your client

-or-

remove cert/key directive from server conf.

Michael.

currently i am giving ca.crt and client.ovpn to all clients.and its working fine with UDP.
which file should i distribute for TCP port?

maikcat

as i see in your server logs

Thu Dec 29 07:10:22 2011 1.22.83.112:53 TLS: Initial packet from 1.22.83.112:53,                                         sid=bee64f03 8554b5dc
Thu Dec 29 07:10:26 2011 1.22.83.112:53 TLS_ERROR: BIO read tls_read_plaintext e                                        rror: error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not retur                                        n a certificate
Thu Dec 29 07:10:26 2011 1.22.83.112:53 TLS Error: TLS object -> incoming plaint                                        ext read error

the problem is not protocol based...

Michael.

dhruvpandit

maikcat wroteas i see in your server logs

Thu Dec 29 07:10:22 2011 1.22.83.112:53 TLS: Initial packet from 1.22.83.112:53,                                         sid=bee64f03 8554b5dc
Thu Dec 29 07:10:26 2011 1.22.83.112:53 TLS_ERROR: BIO read tls_read_plaintext e                                        rror: error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not retur                                        n a certificate
Thu Dec 29 07:10:26 2011 1.22.83.112:53 TLS Error: TLS object -> incoming plaint                                        ext read error

the problem is not protocol based...

Michael.

then whats the problem??
as currently UDP is working fine and all clients are able to use it .

maikcat

do you read this error:

>SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate

?

Michael.

dhruvpandit

maikcat wrotedo you read this error:

>SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate

?

Michael.

i already have ca.crt in the same config folder, dont know why its not sending it to server!!

i have try to create another client and edited client config to have that new client certificate, but still same problem 🙁

i still cant find the proper reason for not working TCP.

maikcat

you must create a certificate for your client

.ca file is certificate Authority file you still need a pair of .crt/.key file

use build-key script to create one on your server then copy it to your client.

Michael.

dhruvpandit

its working fine with this config.

client
dev tun
proto tcp #- protocol
remote xxx.xxx.xxx.xxx 80 #- SERVER IP and OPENVPN Port
resolv-retry infinite
tun-mtu 48000
mssfix 0
persist-key
persist-tun
ca ca.crt
cert client2.crt
key client2.key
auth-user-pass pass.txt
lport 53
verb 3

but now user/pass authentication is not working .

i must have to create saperate certificate for each client.
how could i prevent it, i want auth-user-pass like authentication.

btw , thanks for helping. 🙂

maikcat

remove cert/key directive from server/client (leave ca ONLY)

Michael.

dhruvpandit

with this server config,

local xxx.xxx.xxx.xxx #
port 80 #- port
proto tcp #- protocol
dev tun
tun-mtu 48000
mssfix 0
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
plugin /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so /etc/pam.d/login
client-cert-not-required
username-as-common-name
server 1.2.4.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 4.2.2.1"
keepalive 5 30
persist-key
persist-tun
status 80.log
verb 3

after starting on server, i can connect vpn

and when i was connected, it was not possible to surf, though i had added IP forwarding via

#echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -s 1.2.3.0/24 -j SNAT --to 123.123.123.123

etc already !!

maikcat

this means that tcp/80 is already used by someone else..

use lsof -i to see if this port is used.

you can not use the same port by different services (only openvpn with https but with special setup)

Michael.

dhruvpandit

maikcat wrotethis means that tcp/80 is already used by someone else..

use lsof -i to see if this port is used.

you can not use the same port by different services (only openvpn with https but with special setup)

Michael.

yeah, i know that , so i am always doing this before starting the server

fuser -n tcp 80


kill -9 P[b]ID_Number_Here[/b]

, and have edited above post , coz, now i can connect to server but still browsing is not possible.

maikcat

browsing...?

are you trying to redirect traffic so you can browse internet
through the vpn?

if yes...

you dont need bridging my friend
there are plenty of howtos on how to redirect all traffic using
routed mode vpn..

cheers,
Michael.