Openvpn Server - External access Windows computers [ Error ]

maciej12203 · Post by **maciej12203** » Sun Oct 08, 2017 8:38 pm

'm sorry, I'm new here on this forum. Thank you for all the help. My English language may not be so accurate. I am from Poland and sorry if there will be any language errors.

I have a problem with which I can not handle myself, so I am asking for help to you. I put in my local cloud a cloud and try to access it through OpenVPN. Everything would be great if I had not encountered any problems while connecting to the VPN server. I started the installation of Openvpn, followed by a dozen guides. Installation was possible with 3.4 times.

The connection problem is only with Windows computers. On the local side, computers will connect seamlessly with both local and external IP addresses. But if I am already a remote user then I am not able to connect to the server at an external IP address. ( Android devices connect seamlessly to an external IP address. The configuration is the same as for Windows clients )

I tried to change the protocol using which Windows clients connect to the server, but both the UDP protocol and the TCP console showed some error so that the connection could not be established.

I have a public IP address purchased from the provider. Unfortunately, the provider blocks access and use of most ports, but the standard port 80 is unlocked. I had to come up with something to bypass this method of blocking ports. That's why I'm connecting out to the server via port 80 and on router I have redirected from port 80 (externally) to port 1194 (internally). At the moment this is the best solution in my situation.

Both client-side and server-side firewalls for the test are disabled (later if the connection is established it will be governed by appropriate rules)

Client-side configuration: client.ovpn

client

client
dev tun
proto udp
sndbuf 0
rcvbuf 0
remote ( PUBLIC IP ADDRESS ) 80
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
auth SHA512
cipher AES-256-CBC
comp-lzo
setenv opt block-outside-dns
key-direction 1
verb 3
<ca>
-----BEGIN CERTIFICATE-----
MIIDKzCCAhOgAwIBAgIJALtjHl8KB25AMA0GCSqGSIb3DQEBCwUAMBMxETAPBgNV
BAMMCENoYW5nZU1lMB4XDTE3MTAwNDE3NDE1N1oXDTI3MTAwMjE3NDE1N1owEzER
MA8GA1UEAwwIQ2hhbmdlTWUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
AQDGmIbSg+Z/NAFlJTkct/nJ2CqLlWWLv1dcRTOCIEmv1u1uuaGSqlOPosfV1eD6
MIpqd66Xq/NBWWp5v6nXlHtHWwtIM7t6Z89zGEwqSGuDQibM0PGVmBIveSXPS6VI
KJy7uEvyMQGwmPxTWorX3U/g3fE0FM1r95YIYEkbfa7BsYGTkm6OQH+f4oKW0clC
wDrlj7VaFCSiAj2OPSzyj+MoG6mMx7b6vy7wGiRatSikmcO05bXDaP0YAmrSy8Kw
1g2/9dWxGvHKyNx1G2HXgk/DAAB9M63LVfPTZTnCvHVe74vi0WiW6g18FzIEzjCS
/wLdOfD3Sou+hZiw8wmGUhYvAgMBAAGjgYEwfzAdBgNVHQ4EFgQUb7a/RD71aCpM
+qbR/VO3FibmFcIwQwYDVR0jBDwwOoAUb7a/RD71aCpM+qbR/VO3FibmFcKhF6QV
MBMxETAPBgNVBAMMCENoYW5nZU1lggkAu2MeXwoHbkAwDAYDVR0TBAUwAwEB/zAL
BgNVHQ8EBAMCAQYwDQYJKoZIhvcNAQELBQADggEBAIqP9qwYoXcHm598RiZppitW
YKAXXlelPPUpkoqMuir3pG2oEE7eg+/TLU/abomvHC0MIE5g+sOu8RqK+OBZ1Fhs
DBeyBQUba9DblVfVWXsHmNNptEzQZthzJ/HnxGhffMiow8RHcLInqf0+G5sNh1W3
Dwp0OlZOAi8k1XubbPRAtqck7AX6mH1RQUJcdLZRQKNbJ7FvpR36jX256lznQGAO
TOo+xaAnBfpWI7Q3SGaIa7TrkCOzHRDYbM/fKpDXoBtMxBJKswBcyI7fihMPCx6G
Zq0XioD928lLuzvaSRkh48w+mJo70JloK5iczS+LTy95dvX1K3/kVMHN+Fo6olo=
-----END CERTIFICATE-----
</ca>
<cert>
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
49:88:67:08:77:e0:f2:bc:a4:7d:b1:3b:86:6c:e0:21
Signature Algorithm: sha256WithRSAEncryption
Issuer: CN=ChangeMe
Validity
Not Before: Oct 4 17:43:16 2017 GMT
Not After : Oct 2 17:43:16 2027 GMT
Subject: CN=client
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:cf:42:84:b8:f8:d1:14:95:6c:21:73:02:5a:eb:
6a:a6:a3:5f:42:3a:30:99:30:58:9c:d7:ea:5b:92:
81:2c:8d:2f:ac:ae:44:58:15

3e:eb:18:7c:52:
37:57:a9:5b:f1:f6:ff:be:3f:4b:e2:16:64

d2:
f1:85:98:72:13:67:79:0b:e0:90:89:ee:0c:9f:53:
d3:95:cf:51:b6:c6:be:d7:d2:e3:a2:bf:3f:cb:19:
97:24:e0:f4:a1:15:9e:b6:75:d9:9f:4e:7f:c8:b5:
9c:9a:37:5c:f2:63:c8:10:e6:d4:96:f8:08:01:9e:
68:25:c7:0d:6a:67:1e:89:3d:2a:da:1e:b0:91:04:
f4:e1:ce:f5:fa:76:6a:ef:f1:cf:7e:41:ed:45:57:
94:55:c1:d7:c3:a0:56:0c

fa:27:97:0d:29:5d:
51:bd:b8:b7:36:06:21:ce:3d:1c:a8:61:8c:f8:01:
3f:56:1f:d1:15:41:14:a0:4c:ae:6d:8b:c7:32:c2:
a6:e3:db:b4:83:0d:90:7f:aa:7a:b6:ee:ea:31:a7:
e8:e6:27:80:1f:ee:25:a7:e0:80:cb:60:55:ad:a1:
35:1f:50:7a:18:cc:76:92:a7:94:43:61:8b:b6:47:
ff:3c:3f:5a:dc:7c:28:17:d2:5b:98:a0:db:f2:54:
3a:3f
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
X509v3 Subject Key Identifier:
C8:14:B9:59:0F:55:C4:A8:0F:0C:B7:07:88:C3:BD:88:03:CE:85:F9
X509v3 Authority Key Identifier:
keyid:6F:B6:BF:44:3E:F5:68:2A:4C:FA:A6:D1:FD:53:B7:16:26:E6:15:C2
DirName:/CN=ChangeMe
serial:BB:63:1E:5F:0A:07:6E:40

X509v3 Extended Key Usage:
TLS Web Client Authentication
X509v3 Key Usage:
Digital Signature
Signature Algorithm: sha256WithRSAEncryption
38:3e:f3:a7:7a:5c:74:a7:9b:2d:42:f7:8d:bb:2c:c1:4f:82:
e7:1f:c4:15:33:59:ca:41:56:a1:c4:6b:96:8f:2c:ed:95:bb:
79:a8:a5:90:c5:0c:a4:f1:53:42:86:c9:44:55:67:55:8f:7d:
e2:66:b6:91:ee:ea:01:41:88:07:89:50:c3:fa:32:72:21:4d:
09:14:10:a9:22:e3:c6:2f:b9:43:ca:5a:dc:d1:a8:47:bc:bb:
fd:50:fe:80:76:33:0b:93:69:88:a5:b4:19:e8:7d:79:55:90:
6d:5c:f0:55:f5:ef:0e:85:b4:ff:89:1d:98:02:00:81:9b:88:
98:58:c0:8d:e9:7d:26:15:9b:c5:d1:5a:f5:b1:69:86:f9:0e:
b9:3b:94:a3:3b:d9:4a:fd:79:3d

51:6f:3e:0d:26:77:a8:
49:44:66:6e:cb:8c:8f:74:d0:ff:4e:9e:cf:c7:b0:17:38:b5:
f3:1d:44:b1:91:be:0c:d9:d6:65:a8:00:d2:7d:19:84:c8:97:
18:98:b1:14:7f:4f:25:82:cb:f6:76:17:97:2f:e3:fc:3b:f0:
02:c6:a6:10:b3:ff:ae:43:22:e1:19:8f:c4:a1:da:09:21:70:
38:a3:9e:78:41:bc:05:ef:b4:6e:d8:04:af:76:bc:a6:66:a8:
9e:18:ea:bc
-----BEGIN CERTIFICATE-----
MIIDQzCCAiugAwIBAgIQSYhnCHfg8rykfbE7hmzgITANBgkqhkiG9w0BAQsFADAT
MREwDwYDVQQDDAhDaGFuZ2VNZTAeFw0xNzEwMDQxNzQzMTZaFw0yNzEwMDIxNzQz
MTZaMBExDzANBgNVBAMMBmNsaWVudDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
AQoCggEBAM9ChLj40RSVbCFzAlrraqajX0I6MJkwWJzX6luSgSyNL6yuRFgV3j7r
GHxSN1epW/H2/74/S+IWZKvS8YWYchNneQvgkInuDJ9T05XPUbbGvtfS46K/P8sZ
lyTg9KEVnrZ12Z9Of8i1nJo3XPJjyBDm1Jb4CAGeaCXHDWpnHok9KtoesJEE9OHO
9fp2au/xz35B7UVXlFXB18OgVgyr+ieXDSldUb24tzYGIc49HKhhjPgBP1Yf0RVB
FKBMrm2LxzLCpuPbtIMNkH+qerbu6jGn6OYngB/uJafggMtgVa2hNR9QehjMdpKn
lENhi7ZH/zw/Wtx8KBfSW5ig2/JUOj8CAwEAAaOBlDCBkTAJBgNVHRMEAjAAMB0G
A1UdDgQWBBTIFLlZD1XEqA8MtweIw72IA86F+TBDBgNVHSMEPDA6gBRvtr9EPvVo
Kkz6ptH9U7cWJuYVwqEXpBUwEzERMA8GA1UEAwwIQ2hhbmdlTWWCCQC7Yx5fCgdu
QDATBgNVHSUEDDAKBggrBgEFBQcDAjALBgNVHQ8EBAMCB4AwDQYJKoZIhvcNAQEL
BQADggEBADg+86d6XHSnmy1C9427LMFPgucfxBUzWcpBVqHEa5aPLO2Vu3mopZDF
DKTxU0KGyURVZ1WPfeJmtpHu6gFBiAeJUMP6MnIhTQkUEKki48YvuUPKWtzRqEe8
u/1Q/oB2MwuTaYiltBnofXlVkG1c8FX17w6FtP+JHZgCAIGbiJhYwI3pfSYVm8XR
WvWxaYb5Drk7lKM72Ur9eT2rUW8+DSZ3qElEZm7LjI900P9Ons/HsBc4tfMdRLGR
vgzZ1mWoANJ9GYTIlxiYsRR/TyWCy/Z2F5cv4/w78ALGphCz/65DIuEZj8Sh2gkh
cDijnnhBvAXvtG7YBK92vKZmqJ4Y6rw=
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDPQoS4+NEUlWwh
cwJa62qmo19COjCZMFic1+pbkoEsjS+srkRYFd4+6xh8UjdXqVvx9v++P0viFmSr
0vGFmHITZ3kL4JCJ7gyfU9OVz1G2xr7X0uOivz/LGZck4PShFZ62ddmfTn/ItZya
N1zyY8gQ5tSW+AgBnmglxw1qZx6JPSraHrCRBPThzvX6dmrv8c9+Qe1FV5RVwdfD
oFYMq/onlw0pXVG9uLc2BiHOPRyoYYz4AT9WH9EVQRSgTK5ti8cywqbj27SDDZB/
qnq27uoxp+jmJ4Af7iWn4IDLYFWtoTUfUHoYzHaSp5RDYYu2R/88P1rcfCgX0luY
oNvyVDo/AgMBAAECggEAZCPensTRuKFNoofAHo/acvNCxmv5KTr7xaRpPp91vEHn
RAbbTLgcLshGh2LuDHPu0eUmwhQxJObu8zozqfnzPD7ldICnNY2IGb9V3u9Rqv8y
HHNvuyWuvAH8TjxG1kHs8nnUkS1Lfn2JUdXoGdFuTARLuTnUHHweFAquB7gVP/co
NQTPvJkLsF3WiU2TcHVmDR9uvlmn3FLTwcioSo2onPlzQnwS3RQdP0DeY34+qyW1
xDl9vLiiDe/kZiyGoI3mdAcbLS9mg1l8ugJDD3XocLsnEC/zni0qL9z/xR748EAT
s783b0V/4lmCs08wgVKgCG61CdksMQ0Ah+UDSxFhQQKBgQDt8Y4GkKN57o3fTMn0
3Tlv2rSq5pH4Es1SBgL20UKOU5+Z9iLz53uhjYFOn2Oultf/LnIkDY3XVb1YxULb
BvekWhC8FgNI0lfzEkaTiGpScP7TqMfEyJxLk4PaYORcpm8T5dsCnQD1CFhejXNY
Pjaue0y2iwsFi9tuUFfTSfT5nwKBgQDe/OGyxzEbikNN99VIWq7QPMrK4Yu28OYM
3tTGgOZPskkWNg4PV4c+Cb5mBXV+lQ4cORWgjITCTqEWHrtNI3SrsAZV16GX1ZuS
33LJS4ixR1iBS9ZVwbDoeE+OUI8VmO/7TxX+aYYx9uQWhYdVaYnav/jAAviDCPnI
vZrp2sY7YQKBgQCvxKyBtP7N56btuS/GrlTrh8fGJyTU+C6r1L0Dznk34hYYCXaw
beMp5/oJNjzQj6VnX8v5Tfnlg/SnSrCkU3VD9zQ9fJVYielmKa3w9eh0lfvoJtnL
R9YNDh9shf6rYlbTgAxU1d4LI+sDjcITAYIrSfHVNskhg7rItpjp/8vzSQKBgQCa
DANz+W4wg20JwQvkJ1mbXFQQoo5dvMCA5bQCymvRZO5e3MsLyEETF7IkUuMfpqOP
1dPeDRVuEtnwKRzmJndkYH+P8B6fgR8v8RQgggEVz58R+60/o0au4ua6/2ZJ2lT3
vWQJVScy/0gFUwvycq2cpICZTbQW+i1tg6cwpUXLIQKBgCBnD+GQ3VVMTyzkE31O
3TSpMFfu3nxvBng/Xjf2WwmHbZd7ocj5auD9u7b2rdittonWzZ8stqlQwuRqNCMF
kTmuSVDLExcomtlCWZjG3+gDYbLiH+esdonuwKHrwoiCLkrsCcmDnVzAU+57oYbr
/E5+d843kAofgaTZvPcQ6hHY
-----END PRIVATE KEY-----
</key>
<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
#
# Moderator removed
#
-----END OpenVPN Static key V1-----
</tls-auth>

Server-side configuration: server.conf

server

port 1194
proto udp
dev tun
sndbuf 0
rcvbuf 0
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-auth ta.key 0
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
cipher AES-256-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
crl-verify crl.pem

Below I am pasting pictures of errors that pop up when joining in OpenVPN. This may allow you to understand the problem. If something is not clear please ask this I will continue, because my description of this situation can be slightly complicated.

(Photos will show UDP and TCP connections. Why? Because I tested the connection using both UDP and TCP. Calmly, the protocol configuration was changed in both server.conf and client.ovpn so that the protocol connection was consistent.)

( If I put a topic in the wrong section then of course I apologize for it. )

Windows computer: attempt to connect to an external IP address server (UDP)
[/u][/i][/b]

Windows computer_2: attempt to connect to an external IP address server (TCP)

My network diagram

TinCanTech · Post by **TinCanTech** » Sun Oct 08, 2017 9:30 pm

I do not understand what the problem is ..

Please set --verb 4 in your configs and then post the log files.

Please see:
HOWTO: Request Help ! {2}

maciej12203 · Post by **maciej12203** » Mon Oct 09, 2017 2:51 pm

TinCanTech wrote: ↑
Sun Oct 08, 2017 9:30 pm
I do not understand what the problem is ..

Please set --verb 4 in your configs and then post the log files.

Please see:
HOWTO: Request Help ! {2}

The problem is that despite the good configuration still on Windows machines I can not connect to the VPN server.
As you can see the configuration of the server itself and the client.ovpn file is correct and the problem is that I still can not connect.

Command output on Windows client