2
I have an Ubuntu client OpenVPN that connects to a Debian OpenVPN server.
For a while I had it setup on default port 1194 with udp and I was connecting from a network that did not filter my connections. Everything worked fine.
Then I needed to connect to it from a network that only allowed port 80 and 443 so I switched the config to use tcp on port 443. Again it worked great.
Now I'm on another network that is not directly connected to the Internet, the access I can use is an http proxy. So I switched the config on the client side to use http proxy. Since then the connection is sloppy. It connects to the server and for a short period of time the connection seems to work ok (I can access all ports on Internet, pings work...) and then suddenly the connection drops. If I do nothing then the connection does not drop! It drops after some packets are passed, so I if do ssh I have some time until it drops but if I try to load a web page it drops very quickly. I use the ubuntu network manager for the config. The routes are ok, everything goes where it is supposed to.
EDIT 1: I also have a www server on the same server. It could be that OpenVPN is receiving some packets that are not intended but I use the 'share port' option which should redirect all those packets to the www server.
For what I understand TCP packets could get corrupted during transit (most probably by the http proxy) and this would corrupt the HMAC.
EDIT 2: Running Zenmap I can see the proxy is squid and the OS is MikroTik.
EDIT 3: Just for fun, I have tried to run another openVPN on top of the first one, the second one configured to use UDP. But after reconfiguring the routes and trying to load a web page the first one keeps crashing the same way.
EDIT 4: I have installed sslh on the server to act as a multiplexer on port 443 so when it receives traffic for ssh or openvpn or https it redirects it to the corresponding service and now I am trying to connect through ssh thanks to corkscrew but it fails too (connection closed by remote host, the server actually receives the connection but drops it).
EDIT 5: I am able to configure the server through ssh thanks to a tunnel I have set up with iodine through the DNS server. It sounds stupid but it actually works very well and is very stable, the only problem is that it is terribly slow, just good enough for ssh.
EDIT 6: I have access to another http proxy with which it works instantly and it's very stable so I'll stick with that one for now. I still don't know what's wrong with the first one.
And the logs on the client say: (all of this happened in less than 2 minutes enabling the vpn and loading half a web page)
NetworkManager[1249]: <info> Starting VPN service 'openvpn'...
NetworkManager[1249]: <info> VPN service 'openvpn' started (org.freedesktop.NetworkManager.openvpn), PID 12305
NetworkManager[1249]: <info> VPN service 'openvpn' appeared; activating connections
NetworkManager[1249]: <info> VPN plugin state changed: starting (3)
NetworkManager[1249]: <info> VPN connection 'domain.com' (Connect) reply received.
nm-openvpn[12311]: OpenVPN 2.2.1 i686-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Feb 13 2013
nm-openvpn[12311]: WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
nm-openvpn[12311]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
nm-openvpn[12311]: WARNING: file '/home/user/openvpn-client-conf/ta.key' is group or others accessible
nm-openvpn[12311]: Control Channel Authentication: using '/home/user/openvpn-client-conf/ta.key' as a OpenVPN static key file
nm-openvpn[12311]: LZO compression initialized
nm-openvpn[12311]: Attempting to establish TCP connection with [AF_INET]x.x.x.x:xxxx(http proxy) [nonblock]
nm-openvpn[12311]: TCP connection established with [AF_INET]x.x.x.x:xxxx(http proxy)
nm-openvpn[12311]: TCPv4_CLIENT link local: [undef]
nm-openvpn[12311]: TCPv4_CLIENT link remote: [AF_INET]x.x.x.x:xxxx(http proxy)
nm-openvpn[12311]: [domain.com] Peer Connection Initiated with [AF_INET]x.x.x.x:xxxx(http proxy)
nm-openvpn[12311]: TUN/TAP device tun0 opened
nm-openvpn[12311]: /usr/lib/NetworkManager/nm-openvpn-service-openvpn-helper tun0 1500 1544 10.8.0.2 255.255.255.0 init
NetworkManager[1249]: SCPlugin-Ifupdown: devices added (path: /sys/devices/virtual/net/tun0, iface: tun0)
NetworkManager[1249]: SCPlugin-Ifupdown: device added (path: /sys/devices/virtual/net/tun0, iface: tun0): no ifupdown configuration found.
NetworkManager[1249]: <warn> /sys/devices/virtual/net/tun0: couldn't determine device driver; ignoring...
NetworkManager[1249]: <info> VPN connection 'domain.com' (IP4 Config Get) reply received from old-style plugin.
NetworkManager[1249]: <info> VPN Gateway: x.x.x.x(http proxy)
NetworkManager[1249]: <info> Tunnel Device: tun0
NetworkManager[1249]: <info> IPv4 configuration:
NetworkManager[1249]: <info> Internal Gateway: 10.8.0.1
NetworkManager[1249]: <info> Internal Address: 10.8.0.2
NetworkManager[1249]: <info> Internal Prefix: 24
NetworkManager[1249]: <info> Internal Point-to-Point Address: 0.0.0.0
NetworkManager[1249]: <info> Maximum Segment Size (MSS): 0
NetworkManager[1249]: <info> Forbid Default Route: no
NetworkManager[1249]: <info> Internal DNS: x.x.x.x(dns server)
NetworkManager[1249]: <info> DNS Domain: '(none)'
NetworkManager[1249]: <info> No IPv6 configuration
nm-openvpn[12311]: Initialization Sequence Completed
NetworkManager[1249]: <info> VPN connection 'domain.com' (IP Config Get) complete.
NetworkManager[1249]: <info> Policy set 'domain.com' (tun0) as default for IPv4 routing and DNS.
NetworkManager[1249]: <info> Writing DNS information to /sbin/resolvconf
dbus[975]: [system] Activating service name='org.freedesktop.nm_dispatcher' (using servicehelper)
NetworkManager[1249]: <info> VPN plugin state changed: started (4)
dbus[975]: [system] Successfully activated service 'org.freedesktop.nm_dispatcher'
ntpdate[12428]: step time server 84.104.189.253 offset 1.749623 sec
nm-openvpn[12311]: Authenticate/Decrypt packet error: packet HMAC authentication failed
nm-openvpn[12311]: Fatal decryption error (process_incoming_link), restarting
nm-openvpn[12311]: SIGUSR1[soft,decryption-error] received, process restarting
nm-openvpn[12311]: WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
nm-openvpn[12311]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
nm-openvpn[12311]: Re-using SSL/TLS context
nm-openvpn[12311]: LZO compression initialized
nm-openvpn[12311]: Attempting to establish TCP connection with [AF_INET]x.x.x.x:xxxx(http proxy) [nonblock]
nm-openvpn[12311]: TCP connection established with [AF_INET]x.x.x.x:xxxx(http proxy)
nm-openvpn[12311]: TCPv4_CLIENT link local: [undef]
nm-openvpn[12311]: TCPv4_CLIENT link remote: [AF_INET]x.x.x.x:xxxx(http proxy)
nm-openvpn[12311]: [domain.com] Peer Connection Initiated with [AF_INET]x.x.x.x:xxxx(http proxy)
nm-openvpn[12311]: Preserving previous TUN/TAP instance: tun0
nm-openvpn[12311]: /usr/lib/NetworkManager/nm-openvpn-service-openvpn-helper tun0 1500 1544 10.8.0.2 255.255.255.0 restart
NetworkManager[1249]: <warn> VPN plugin failed: 2
nm-openvpn[12311]: WARNING: Failed running command (--up/--down): external program exited with error status: 1
nm-openvpn[12311]: Exiting
avahi-daemon[1176]: Withdrawing workstation service for tun0.
NetworkManager[1249]: SCPlugin-Ifupdown: devices removed (path: /sys/devices/virtual/net/tun0, iface: tun0)
NetworkManager[1249]: <warn> VPN plugin failed: 1
NetworkManager[1249]: <info> VPN plugin state changed: stopped (6)
NetworkManager[1249]: <info> VPN plugin state change reason: 0
avahi-daemon[1176]: Withdrawing address record for x.x.x.x(local ip) on eth0.
avahi-daemon[1176]: Leaving mDNS multicast group on interface eth0.IPv4 with address x.x.x.x(local ip).
avahi-daemon[1176]: Joining mDNS multicast group on interface eth0.IPv4 with address x.x.x.x(second local ip).
avahi-daemon[1176]: Withdrawing address record for x.x.x.x(second local ip) on eth0.
avahi-daemon[1176]: Leaving mDNS multicast group on interface eth0.IPv4 with address x.x.x.x(second local ip).
avahi-daemon[1176]: Interface eth0.IPv4 no longer relevant for mDNS.
avahi-daemon[1176]: Joining mDNS multicast group on interface eth0.IPv4 with address x.x.x.x(local ip).
avahi-daemon[1176]: New relevant interface eth0.IPv4 for mDNS.
avahi-daemon[1176]: Registering new address record for x.x.x.x(local ip) on eth0.IPv4.
avahi-daemon[1176]: Registering new address record for x.x.x.x(second local ip) on eth0.IPv4.
NetworkManager[1249]: <info> Policy set 'Wired connection 1' (eth0) as default for IPv4 routing and DNS.
NetworkManager[1249]: <info> Writing DNS information to /sbin/resolvconf
dbus[975]: [system] Activating service name='org.freedesktop.nm_dispatcher' (using servicehelper)
NetworkManager[1249]: <warn> error disconnecting VPN: Could not process the request because no VPN connection was active.
NetworkManager[1249]: <warn> (7) failed to find interface name for index
NetworkManager[1249]: nm_system_iface_flush_routes: assertion `iface != NULL' failed
NetworkManager[1249]: <warn> (7) failed to find interface name for index
dbus[975]: [system] Successfully activated service 'org.freedesktop.nm_dispatcher'
NetworkManager[1249]: <info> VPN service 'openvpn' disappeared
Bastian
Posted 2013-12-14T21:53:38.653
Reputation: 151