Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an Ubuntu Server 12.04 running OpenVPN and OpenSSH. I've installed OpenVPN on a Windows machine at work, and created the connection. I can ping back and forth between the machines, but when I try to SSH in, the connection doesn't go through. I don't believe it is a firewall issue. If I connect directly on the public IP address, port forwarded through my router, I can connect without any problems.

When I connect through VPN, my server logs

Aug 17 17:03:21 alfred sshd[5615]: fatal: Read from socket failed: Connection reset by peer [preauth]

Putty reports

2013-08-17 17:02:49 Looking up host ""
2013-08-17 17:02:49 Connecting to port 22
2013-08-17 17:02:49 Server version: SSH-2.0-OpenSSH_5.9p1 Debian-5ubuntu1.1
2013-08-17 17:02:49 Using SSH protocol version 2
2013-08-17 17:02:49 We claim version: SSH-2.0-PuTTY_Release_0.62
2013-08-17 17:02:49 Doing Diffie-Hellman group exchange
2013-08-17 17:02:49 Doing Diffie-Hellman key exchange with hash SHA-256
2013-08-17 17:03:08 Network error: Software caused connection abort

How can I fix this problem? I hope to run multiple services on this server without having to open up lots of ports publicly.

share|improve this question
Does port 22 open ? Try to telnet first. – Raptor Aug 18 '13 at 1:01
Port 22 is open. As I said before, connecting to SSH directly works fine. It is only when I try to connect to SSH through the VPN tunnel that I encounter this problem. – Chris Burnham Aug 18 '13 at 15:19
No, I want to clarify is the port 22 of VPN tunnel is open, as VPN uses different IP, and the port 22 may not be listening with the VPN IP. – Raptor Aug 19 '13 at 2:28

I found a fix related to the MTUs of my links. I noticed on my server my eth0 interface that the mtu was 576, but openVPN defaults to 1500

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 576 qdisc mq state UP qlen 1000
link/ether 00:13:72:84:cd:49 brd ff:ff:ff:ff:ff:ff

22: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 100

I added the following to both my server.conf and client.conf

fragment 500
mssfix 500

This doesn't feel like the ideal solution, but I can now use SSH over my tunnel. Other services also work. I might experiment with fixing my eth0 interface to use a larger MTU, but I don't really understand all the implications of messing with this network stuff.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.