Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm currently in the situation of attempting to setup OpenVPN on a personal VPS, for connection primarily through an overly restrictive firewall. All of the setups mentioned below work when used through a reasonably-firewalled connection.

I have tried:

  1. OpenVPN running on the standard port
  2. OpenVPN running on port 443 (I start OpenVPN manually from the command line on the VPS and see that the server reports the connection being closed almost immediately, I assume this is a result of DPI on the firewall)
  3. STunnel running on port 443 to access OpenVPN and evade DPI. This is the most successful and allows a connection and internet access through the VPN for ~10-20 seconds, before the connection is forcibly closed.

Is there anything else I can attempt?

share|improve this question
Dear lord, what "personal VPS" provider do you have that goes to such lengths to prevent you from running a VPN?! Also, it isn't clear if you are trying to use the VPS as an OpenVPN server, or if you want to make it the client? – allquixotic Sep 25 '12 at 20:42
Woops! I should have been more clear. The VPS provider is Linode, and they definitely aren't blocking anything. ;) The problem is that I'm connecting to the VPN from a client (my laptop) whose internet access is severely firewalled. – R.L. Stine Sep 25 '12 at 20:52
A VPN solution in general is going to be fairly easily detected by anything that does stateful packet inspection, as you hinted. The forceful disconnection could be due to traffic analysis methods looking at the https connection of stunnel and going "wait a minute, standard HTTP request/response connections aren't nearly that chatty!" -- in essence you are stuck. You could try an HTTPS proxy though; maybe something where you pass the request as an HTTP body (over SSL) to a servlet and it forwards your request... o_O – allquixotic Sep 25 '12 at 21:07
You may want to keep in mind that bypassing restrictions implemented by a company firewall are likely a violation of company policy. I suggest you talk to the firewall admin about the issue. – Ansgar Wiechers Sep 25 '12 at 22:57

Connections being cut off after a length of time sometimes indicate a bytes-per-second type of limit. Try seeing if slowing down your VPN connection works. Also if you have OpenVPN configured for UDP try TCP (443 UDP may be blocked whereas 443 TCP may go undetected).

Visit a well known site that uses SSL and check the certificate. Then do the same at home. If they don't match then your location is using a transparent HTTPS SSL proxy and can actually see your HTTPS traffic.

It's possible something that isn't port 443 isn't watched so closely. Try 22.

It may sound stupid but try doing it over port 80 and see what you get. You also may try setting up an HTTP tunnel between you and the VPS to make the traffic look like HTTP requests.

If you are feeling insane, try iodine.

share|improve this answer
+1, but especially for iodine! – 0xC0000022L Mar 22 '13 at 21:56

I think i know why the stunnel methode behaves like that. It's because you net to set an "static route" for stunnel server. Let me explain that. When you connect to an openvpn server it changes your routing table and route all your packets trough the vpn ,except the openvpn packets. actualy openvpn will add a route for your server ip address. But when you using stunnel to connect to your openvpn server you will connect openvpn to a loopback interface and there is no route to your server outside your vpn, so stunnel packets want to go to server and they going to your vpn and your vpn packets going to stunnel :)

So you need to add a route to your server ip that going outside your vpn (your home router).

And for problem with method port 443 i ganna say that maybe your the firewall using SPI or DPI and the can easily make diffrent openvpn packets from https (ssl) packets. So best way is to use stunnel, or if firewall blocks ssl packets it's better to use obfsproxy or fteproxy to bypass it.

(i know that post is to old but i was looking for answer about the same problem for weeks ,so i wanted to share what i learnd about this)

share|improve this answer
This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post - you can always comment on your own posts, and once you have sufficient reputation you will be able to comment on any post. – Ramhound Sep 1 '15 at 13:03

I've never tried it (so lemme know if it works!) but give a shot @ using ssh tunneling over 443 and run your OpenVPN through the tunnel. You may need an extra remote host to listen on 443 if you don't have one but there is an example here for using their proxy service, but this is also googlable,or.r_gc.r_pw.r_cp.r_qf.&bvm=bv.41018144,d.b2U&biw=1920&bih=979.

I've also known people to use this approach as a proxy b/c their employer blocked access to job sites such as back when they were popular..

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .