Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to check that an OpenVPN (UDP) server is up and accessible on a given host:port.

I only have a plain Windows XP computer with no OpenVPN client (and no chance to install it) and no keys needed to connect to the server - just common WinXP command line tools, a browser and PuTTY are in my disposition.

If I was testing something like an SMTP or POP3 servert I'd use telnet and see if it responds, but how to do this with OpenVPN (UDP)?

share|improve this question
    
if openvpn is running via tcp, you could telnet as well –  rvs Apr 22 '11 at 9:21
    
OpenVPN is running via UDP –  Ivan Apr 22 '11 at 10:06
1  
Can you elaborate on why you would want to solve this from an obsolete Windows system and not from a real monitoring system? –  Alex Holst Apr 22 '11 at 13:40

6 Answers 6

if you have setup openvpn on a tcp listen then its as simple as

telnet vpnserver 1194

assuming 1194 is the port you have it listening on

this should give you a response of some sort to show that the openvpn server is listening

share|improve this answer
    
Are you 100% sure? When I do this, I get "Could not open connection to the host, on port 1194: Connect failed" after some waiting. Isn't a client meant to say something first, before an OpenVPN server responds? –  Ivan Apr 22 '11 at 10:02
1  
Note that by default OpenVPN is UDP-only and telnet is meant to use TCP. –  Ivan Apr 22 '11 at 10:05

You should be able to connect to it with Netcat.

share|improve this answer
1  
I'm quite sure that OpenVPN won't answer to a wrong packet. Unfortunately can't test it, all my servers are running on TCP. It's still the simplest option I can think of. –  Hubert Kario Apr 22 '11 at 17:34

You can try to run the following at the CLI

#netstat -ltnup

This should list all processes that are listening on your server/system. Grep for the port number you want

#netstat -ltnup | grep 1194
share|improve this answer
    
OP only has windows XP tools. –  Iain Apr 22 '11 at 13:18

If you can get an pcap of valid OpenVPN Client to OpenVPN server interaction, you could model the initial set of packets with something like netcat, as suggested by TiZon.

Basically, you want enough of a valid first packet to get the server to respond with at least an error message, so it doesn't have to be perfect, just good enough.

I tried going to http://pcapr.net, but I didn't see an OpenVPN example there. Perhaps, if someone else is claiming the service is up, you could get that other person to grab a pcap of the transaction.

share|improve this answer

Sorry if I'm a bit late with my answer ;)
Send an udp packet with the following content:
$38$01$00$00$00$00$00$00$00
The server must respond something.
You can forge udp packets with python like this:

import socket
senddata= "\x38\x01\x00\x00\x00\x00\x00\x00\x00"

def checkserver(ip,port):
   print('Checking %s:%s' %(ip,port)) 
   sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
   sock.settimeout(5) # in seconds
   sock.connect((ip, port))
   print("Sending request...")
   sock.send(senddata)
   try:
      dta=sock.recv(100)
      print("Server reply: %s" %(dta))
   except:
      print("Server not responding")
   sock.close()
   print("###########################################################")

def main():
   checkserver("addr.of.server1",1194)
   checkserver("addr.of.server2",1195)

if __name__ == "__main__":
   main()
share|improve this answer

Here is a shell one-liner:

echo -e "\x38\x01\x00\x00\x00\x00\x00\x00\x00" | 
   timeout 10 nc -u openvpnserver.com 1194 | cat -v

if there is an openvpn on the other end the output will be

@$M-^HM--LdM-t|M-^X^@^@^@^@^@@$M-^HM--LdM-t|M-^X^@^@^@^@^@@$M-^HM--LdM-t|M-^X...

otherwise it will just be mute and timeout after 10 seconds or display something different.

share|improve this answer
    
I get something bit different, but I do get something. Thanks. –  artfulrobot Feb 6 '13 at 16:27
2  
Just to state the obvious, this is for Linux/Unix, not for Windows. And it requires netcat (not installed by default in some distros). Also, if your Linux distro does not have the "timeout" command, just use the netcat "-w" parameter, like "nc -w 10 -u openvpnserver.com 1194". –  MV. May 5 '13 at 0:48
    
I am wondering, did that work for anybody? I've tried it against a number of OpenVPN servers, but received no response. –  ayaz May 29 '13 at 13:57
    
This is fscking awesome. –  dmourati Jun 10 '13 at 18:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.