0

I have an external OpenVPN server running Ubuntu 20.04 and 3 clients:

  • Client1 (Android 11)
  • Client2 (Windows 10 and Virtualbo host)
  • Client3 (Ubuntu 20.04 Virtualbox guest)

All 3 clients are able to SSH connect to the server but only client 1 and 2 can connect to the server OpenVPN. This is driving me crazy: client 3 can connect to the server via SSH but can't via OpenVPN.

I focus on client3 since 1 & 2 are ok. This is my attempt to connect:

$ openvpn --config leaf9.ovpn
Mon Feb  8 18:56:56 2021 Unrecognized option or missing or extra parameter(s) in leaf9.ovpn:14: block-outside-dns (2.4.7)
Mon Feb  8 18:56:56 2021 OpenVPN 2.4.7 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Sep  5 2019
Mon Feb  8 18:56:56 2021 library versions: OpenSSL 1.1.1g  21 Apr 2020, LZO 2.10
Mon Feb  8 18:56:56 2021 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Mon Feb  8 18:56:56 2021 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Mon Feb  8 18:56:56 2021 TCP/UDP: Preserving recently used remote address: [AF_INET]123.123.123.0:1194
Mon Feb  8 18:56:56 2021 Socket Buffers: R=[131072->131072] S=[16384->16384]
Mon Feb  8 18:56:56 2021 Attempting to establish TCP connection with [AF_INET]123.123.123.0:1194 [nonblock]
Mon Feb  8 18:57:00 2021 TCP: connect to [AF_INET]123.123.123.0:1194 failed: Connection refused
Mon Feb  8 18:57:00 2021 SIGUSR1[connection failed(soft),init_instance] received, process restarting
Mon Feb  8 18:57:00 2021 Restart pause, 5 second(s)
^CMon Feb  8 18:57:00 2021 SIGINT[hard,init_instance] received, process exiting

On the server OpenVPN logs nothing happens (with client 1 & 2 I can see the successful connection) It seems that client3 OpenVPN packets don't reach the server but its SSH packets do.

tcpdump connecting via OpenVPN

18:58:22.229266 IP leaf9.51870 > 123.123.123.0.1194: Flags [S], seq 1069973754, win 64240, options [mss 1460,sackOK,TS val 4103806626 ecr 0,nop,wscale 7], length 0
18:58:22.233116 IP leaf9.56081 > fritz.box.domain: 56163+ PTR? 15.2.0.10.in-addr.arpa. (40)
18:58:22.298298 IP fritz.box.domain > leaf9.56081: 56163 NXDomain 0/0/0 (40)
18:58:22.301063 IP leaf9.51370 > fritz.box.domain: 3433+ PTR? 1.1.168.192.in-addr.arpa. (42)
18:58:22.302352 IP fritz.box.domain > leaf9.51370: 3433* 10/1/1 PTR fritz.box., PTR www.fritz.box., PTR myfritz.box., PTR www.myfritz.box., PTR fritz.nas., PTR www.fritz.nas., PTR fritz-nas.fritz.box., PTR fritz-nas.box., PTR wpad.box., PTR wpad.fritz.box. (336)
18:58:23.247988 IP leaf9.51870 > 123.123.123.0.1194: Flags [S], seq 1069973754, win 64240, options [mss 1460,sackOK,TS val 4103807645 ecr 0,nop,wscale 7], length 0
18:58:24.460201 IP 123.123.123.0.1194 > leaf9.51870: Flags [R.], seq 0, ack 1069973755, win 0, length 0

tcpdump connecting via SSH

18:57:53.793395 IP leaf9.43942 > 123.123.123.0.22: Flags [S], seq 4052391502, win 64240, options [mss 1460,sackOK,TS val 4103778190 ecr 0,nop,wscale 7], length 0
18:57:53.798315 IP leaf9.34189 > fritz.box.domain: 26719+ PTR? 15.2.0.10.in-addr.arpa. (40)
18:57:53.848711 IP fritz.box.domain > leaf9.34189: 26719 NXDomain 0/0/0 (40)
18:57:53.851454 IP leaf9.60906 > fritz.box.domain: 64354+ PTR? 1.1.168.192.in-addr.arpa. (42)
18:57:53.852491 IP fritz.box.domain > leaf9.60906: 64354* 10/1/1 PTR fritz.box., PTR www.fritz.box., PTR myfritz.box., PTR www.myfritz.box., PTR fritz.nas., PTR www.fritz.nas., PTR fritz-nas.fritz.box., PTR fritz-nas.box., PTR wpad.box., PTR wpad.fritz.box. (336)
18:57:53.864247 IP 123.123.123.0.22 > leaf9.43942: Flags [S.], seq 32768001, ack 4052391503, win 65535, options [mss 1460], length 0
18:57:53.864341 IP leaf9.43942 > 123.123.123.0.22: Flags [.], ack 1, win 64240, length 0
18:57:53.955395 IP 123.123.123.0.22 > leaf9.43942: Flags [P.], seq 1:42, ack 1, win 65535, length 41
18:57:53.955439 IP leaf9.43942 > 123.123.123.0.22: Flags [.], ack 42, win 64199, length 0

Any idea please?

Christian Toffolo
  • 131
  • 4
  • 1
    Do client1 and client2 use TCP as well? UDP is the default, so unless you specifically configured them to use TCP, the answer is "no". – Lacek Feb 08 '21 at 19:31
  • @Lacek you helped me finding the problem. I used a script found online to install openvpn and generate the .ovpn files. Those files have set the protocol to tcp but the server is set to udp but the files worked fot client 1 & 2!? Maybe they have some sort of fallback. Btw, changing the protocol to udp solved the problem. Do you want to write an answer? – Christian Toffolo Feb 08 '21 at 19:57

1 Answers1

0

Problem solved changing the protocol to udp in the client .ovpn file.

The protocol set in the .ovpn file was tcp because I used a script found online to install openvpn and generate these .ovpn files.

The strange thing is that client 1 & 2 are working fine even with protocol set to tcp. Maybe they have some sort of fallback.

Christian Toffolo
  • 131
  • 4