-1

I'm trying to connect to an OpenVPN server through Tor Socks Proxy.

I have edited the .ovpn file adding socks-proxy 127.0.0.1 and socks-proxy-retry options but without success.

Here is the problem: All goes well and I see Initialization Sequence Completed message but after a few seconds openvpn client tries to reconnect many times and gives an error 115 timeout,

I'm currently using Ubuntu 16.04

Here is the log:

Sat Sep 17 16:38:08 2016 DEPRECATED OPTION: http-proxy-retry and socks-proxy-retry: In OpenVPN 2.4 proxy connection retries are handled like regular connections. Use connect-retry-max 1 to get a similar behavior as before.
Sat Sep 17 16:38:08 2016 OpenVPN 2.3_git x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [IPv6] built on Sep 17 2016
Sat Sep 17 16:38:08 2016 library versions: OpenSSL 1.0.2g-fips  1 Mar 2016, LZO 2.08
Sat Sep 17 16:38:08 2016 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Sat Sep 17 16:38:08 2016 TCP/UDP: Preserving recently used remote address: [AF_INET]127.0.0.1:9050
Sat Sep 17 16:38:08 2016 Socket Buffers: R=[87380->87380] S=[16384->16384]
Sat Sep 17 16:38:08 2016 Attempting to establish TCP connection with [AF_INET]127.0.0.1:9050 [nonblock]
Sat Sep 17 16:38:08 2016 TCP connection established with [AF_INET]127.0.0.1:9050
Sat Sep 17 16:38:08 2016 TCP_CLIENT link local: (not bound)
Sat Sep 17 16:38:08 2016 TCP_CLIENT link remote: [AF_INET]127.0.0.1:9050
Sat Sep 17 16:38:09 2016 TLS: Initial packet from [AF_INET]127.0.0.1:9050, sid=8f81fa06 41348202
Sat Sep 17 16:38:10 2016 VERIFY OK: depth=0, CN=49njfbdc.com, O=m4jhl x3avvp9iijj, C=US
Sat Sep 17 16:38:12 2016 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Sat Sep 17 16:38:12 2016 [49njfbdc.com] Peer Connection Initiated with [AF_INET]127.0.0.1:9050
Sat Sep 17 16:38:13 2016 SENT CONTROL [49njfbdc.com]: 'PUSH_REQUEST' (status=1)
Sat Sep 17 16:38:14 2016 PUSH: Received control message: 'PUSH_REPLY,ping 3,ping-restart 10,ifconfig 10.211.1.73 10.211.1.74,dhcp-option DNS 10.211.254.254,dhcp-option DNS 8.8.8.8,route-gateway 10.211.1.74,redirect-gateway def1'
Sat Sep 17 16:38:14 2016 OPTIONS IMPORT: timers and/or timeouts modified
Sat Sep 17 16:38:14 2016 OPTIONS IMPORT: --ifconfig/up options modified
Sat Sep 17 16:38:14 2016 OPTIONS IMPORT: route options modified
Sat Sep 17 16:38:14 2016 OPTIONS IMPORT: route-related options modified
Sat Sep 17 16:38:14 2016 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sat Sep 17 16:38:14 2016 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sat Sep 17 16:38:14 2016 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Sep 17 16:38:14 2016 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sat Sep 17 16:38:14 2016 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Sep 17 16:38:14 2016 ROUTE_GATEWAY 192.168.1.254/255.255.255.0 IFACE=*hidden* HWADDR=*hidden*
Sat Sep 17 16:38:14 2016 TUN/TAP device tun0 opened
Sat Sep 17 16:38:14 2016 TUN/TAP TX queue length set to 100
Sat Sep 17 16:38:14 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sat Sep 17 16:38:14 2016 /sbin/ifconfig tun0 10.211.1.73 pointopoint 10.211.1.74 mtu 1500
Sat Sep 17 16:38:14 2016 /sbin/route add -net 127.0.0.1 netmask 255.255.255.255 gw 192.168.1.254
Sat Sep 17 16:38:14 2016 /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw 10.211.1.74
Sat Sep 17 16:38:14 2016 /sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw 10.211.1.74
Sat Sep 17 16:38:14 2016 Initialization Sequence Completed
Sat Sep 17 16:38:24 2016 [49njfbdc.com] Inactivity timeout (--ping-restart), restarting
Sat Sep 17 16:38:24 2016 SIGUSR1[soft,ping-restart] received, process restarting
Sat Sep 17 16:38:24 2016 Restart pause, 5 second(s)
Sat Sep 17 16:38:29 2016 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Sat Sep 17 16:38:29 2016 TCP/UDP: Preserving recently used remote address: [AF_INET]127.0.0.1:9050
Sat Sep 17 16:38:29 2016 Socket Buffers: R=[87380->87380] S=[16384->16384]
Sat Sep 17 16:38:29 2016 Attempting to establish TCP connection with [AF_INET]127.0.0.1:9050 [nonblock]
Sat Sep 17 16:38:29 2016 TCP connection established with [AF_INET]127.0.0.1:9050
Sat Sep 17 16:38:34 2016 recv_socks_reply: TCP port read timeout expired: Operation now in progress (errno=115)
Sat Sep 17 16:38:34 2016 SIGUSR1[soft,init_instance] received, process restarting
Sat Sep 17 16:38:34 2016 Restart pause, 5 second(s)
^CSat Sep 17 16:38:36 2016 /sbin/route del -net 127.0.0.1 netmask 255.255.255.255
Sat Sep 17 16:38:36 2016 /sbin/route del -net 0.0.0.0 netmask 128.0.0.0
Sat Sep 17 16:38:36 2016 /sbin/route del -net 128.0.0.0 netmask 128.0.0.0
Sat Sep 17 16:38:36 2016 Closing TUN/TAP interface
Sat Sep 17 16:38:36 2016 /sbin/ifconfig tun0 0.0.0.0
Sat Sep 17 16:38:36 2016 SIGINT[hard,init_instance] received, process exiting

Here is the .ovpn file:

socks-proxy 127.0.0.1 9150
socks-proxy-retry
###############################################################################
# OpenVPN 2.0 Sample Configuration File
# for PacketiX VPN / SoftEther VPN Server
# 
# !!! AUTO-GENERATED BY SOFTETHER VPN SERVER MANAGEMENT TOOL !!!
# 
# !!! YOU HAVE TO REVIEW IT BEFORE USE AND MODIFY IT AS NECESSARY !!!
# 
# This configuration file is auto-generated. You might use this config file
# in order to connect to the PacketiX VPN / SoftEther VPN Server.
# However, before you try it, you should review the descriptions of the file
# to determine the necessity to modify to suitable for your real environment.
# If necessary, you have to modify a little adequately on the file.
# For example, the IP address or the hostname as a destination VPN Server
# should be confirmed.
# 
# Note that to use OpenVPN 2.0, you have to put the certification file of
# the destination VPN Server on the OpenVPN Client computer when you use this
# config file. Please refer the below descriptions carefully.


###############################################################################
# Specify the type of the layer of the VPN connection.
# 
# To connect to the VPN Server as a "Remote-Access VPN Client PC",
#  specify 'dev tun'. (Layer-3 IP Routing Mode)
#
# To connect to the VPN Server as a bridging equipment of "Site-to-Site VPN",
#  specify 'dev tap'. (Layer-2 Ethernet Bridgine Mode)

dev tun


###############################################################################
# Specify the underlying protocol beyond the Internet.
# Note that this setting must be correspond with the listening setting on
# the VPN Server.
# 
# Specify either 'proto tcp' or 'proto udp'.

proto tcp


###############################################################################
# The destination hostname / IP address, and port number of
# the target VPN Server.
# 
# You have to specify as 'remote <HOSTNAME> <PORT>'. You can also
# specify the IP address instead of the hostname.
# 
# Note that the auto-generated below hostname are a "auto-detected
# IP address" of the VPN Server. You have to confirm the correctness
# beforehand.
# 
# When you want to connect to the VPN Server by using TCP protocol,
# the port number of the destination TCP port should be same as one of
# the available TCP listeners on the VPN Server.
# 
# When you use UDP protocol, the port number must same as the configuration
# setting of "OpenVPN Server Compatible Function" on the VPN Server.

remote 180.183.122.187 1639


###############################################################################
# The HTTP/HTTPS proxy setting.
# 
# Only if you have to use the Internet via a proxy, uncomment the below
# two lines and specify the proxy address and the port number.
# In the case of using proxy-authentication, refer the OpenVPN manual.

;http-proxy-retry
;http-proxy [proxy server] [proxy port]


###############################################################################
# The encryption and authentication algorithm.
# 
# Default setting is good. Modify it as you prefer.
# When you specify an unsupported algorithm, the error will occur.
# 
# The supported algorithms are as follows:
#  cipher: [NULL-CIPHER] NULL AES-128-CBC AES-192-CBC AES-256-CBC BF-CBC
#          CAST-CBC CAST5-CBC DES-CBC DES-EDE-CBC DES-EDE3-CBC DESX-CBC
#          RC2-40-CBC RC2-64-CBC RC2-CBC
#  auth:   SHA SHA1 MD5 MD4 RMD160

cipher AES-128-CBC
auth SHA1


###############################################################################
# Other parameters necessary to connect to the VPN Server.
# 
# It is not recommended to modify it unless you have a particular need.

resolv-retry infinite
nobind
persist-key
persist-tun
client
verb 3
#auth-user-pass


###############################################################################
# The certificate file of the destination VPN Server.
# 
# The CA certificate file is embedded in the inline format.
# You can replace this CA contents if necessary.
# Please note that if the server certificate is not a self-signed, you have to
# specify the signer's root certificate (CA) here.
  • YO!!! Delete the certs from your example above!!! You will compromise your security . also change the host IP address to something fake – Xavier J Sep 17 '16 at 14:49
  • @codenoir no problem the openvpn config file is of a free public openvpn server – ewwew ewewe Sep 17 '16 at 14:51
  • But your client certificate should NEVER be shared – Xavier J Sep 17 '16 at 14:51
  • the .ovpn file is downloaded complete from vpngate.net and i have only edited it adding socks proxy options – ewwew ewewe Sep 17 '16 at 14:53
  • Doesn't matter that it's the actual file. You are missing the point. With what you posted above, anyone can impersonate YOU via the openvpn server. Effectively, it's like posting your Social Security number or bank password. Go to the example you gave above, and delete the section that reads "The client certificate file (dummy)." – Xavier J Sep 17 '16 at 15:00
0

Test the socks proxy with other programs that use socks. If they work, and OpenVPN doesn't, then it's your OpenVPN configuration that's the problem. Your log entry with [*.opengw.net] looks a little suspect - that's not a valid host name! You may wish to post at least part of your config file here so we can see if anything's fishy. (I've been using OpenVPN for about 8 years now).

Example: You open a telnet connection via the socks proxy (proxychains?). Open a session to the host address in your example, using the appropriate port number. The protocol is TCP. If the telnet connection works (you should see "garbage" characters at the prompt), that means that the socks proxy is working properly.

If openvpn can't connect, but telnet can, then you may be missing authentication information for the socks proxy in your OVPN file, or the socks versions/implementations are not compatible.

  • I have updated answer with .ovpn content, I have currently tried too to compile lastest openvpn client from official git repo but i have the same problem – ewwew ewewe Sep 17 '16 at 14:27
  • Also if I use it with http/https proxy it works like a charm, the problem is only with socks4/5 proxy like Tor – ewwew ewewe Sep 17 '16 at 14:28
  • I have to say too that Tor socks proxy is working because i have tried it with firefox – ewwew ewewe Sep 17 '16 at 14:29
  • Tried, I used proxychains to connect telnet with proxy, It works showing escape character – ewwew ewewe Sep 17 '16 at 15:00
  • I'm going to be crazy, in Windows all works like a charm, with all Linux Distros no work, how is possible? Please help me with this i don't want to reinstall windows only for this problem... – ewwew ewewe Sep 17 '16 at 15:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.