Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to configure openvpn, I used a config and certificate/key example that comes with OpenVPN. It works perfectly when I use with UDP but it doesn't works with TCP


# OpenVPN config "server-tls.conf"
# test using: openvpn –-config server-tls.conf

proto tcp #default
dev tun   #default
port 8080 #default
management 8080

# Tunnel IP-number plan:
# network:    all tunnel-endpoints (TEPs)
# IP:       server
# IP:       server   p2p address (not-used)
# IP:       client-1 p2p address (not-used)
# IP:       client-1
# IP:       client-2 p2p address (not-used)
# IP:      client-2
# IP:      client-3 p2p address (not-used)
# IP:      client-3
# etc...                  This setup allows (2^(32-24)/4)-1=63 clients

server # the server Tunnel-IP will be .1

# Maintain a record of client <-> virtual IP address
# associations in this file.  If OpenVPN goes down or
# is restarted, reconnecting clients can be assigned
# the same virtual IP address from the pool that was
# previously assigned.
ifconfig-pool-persist ipp.txt

# The 'server' command also established a pool of Tunnel-IPs for the clients (like DHCP)

#route # this command is implicit with 'server' command

cd /etc/openvpn/
log /var/log/openvpn.log

ca       ca.crt
cert     server.crt
key      server.key
dh       dh1024.pem
tls-auth ta.key 0 # Use 0=server, 1=client

verb 3
keepalive 10 60

duplicate-cn # needed if all clients use same client.crt/key

# Uncomment following line if you want to allow client-to-client traffic:
# (dont use this option if you want to filter the client-to-client packets via iptables)

#push "route" # this is done automatically with client-to-client command (else do specify)

# end of "server-tls.conf"


# OpenVPN config "client-tls.conf"
# run with: openvpn –config client-tls.conf

proto tcp #default
dev tun   #default
remote x.x.x.x 8080

#cd /etc/openvpn/
#log /var/log/openvpn.log
#log openvpn.log

ca       ca.crt
cert     client.crt
key      client.key
tls-auth ta.key 1 # Use 0=server, 1=client

# Verify that we are connected with the correct server:

tls-remote "Test-Server"
ns-cert-type    server

verb 3
keepalive 10 60
explicit-exit-notify 2

# end of "client-tls.conf"

Server log:

cat /var/log/openvpn.log
Tue Dec 11 17:36:18 2012 OpenVPN 2.2.0 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Jul  4 2011
Tue Dec 11 17:36:18 2012 MANAGEMENT: TCP Socket listening on [AF_INET]
Tue Dec 11 17:36:18 2012 WARNING: --ifconfig-pool-persist will not work with --duplicate-cn
Tue Dec 11 17:36:18 2012 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Tue Dec 11 17:36:18 2012 Diffie-Hellman initialized with 1024 bit key
Tue Dec 11 17:36:18 2012 WARNING: file 'server.key' is group or others accessible
Tue Dec 11 17:36:18 2012 WARNING: file 'ta.key' is group or others accessible
Tue Dec 11 17:36:18 2012 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Tue Dec 11 17:36:18 2012 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Dec 11 17:36:18 2012 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Dec 11 17:36:18 2012 TLS-Auth MTU parms [ L:1544 D:168 EF:68 EB:0 ET:0 EL:0 ]
Tue Dec 11 17:36:18 2012 Socket Buffers: R=[87380->131072] S=[16384->131072]
Tue Dec 11 17:36:18 2012 TCP/UDP: Socket bind failed on local address [undef]: Address already in use
Tue Dec 11 17:36:18 2012 Exiting

Client log:

Options error: --explicit-exit-notify can only be used with --proto udp
Use --help for more information.

Why it doesn't work in TCP mode?

share|improve this question
Can you paste the server logs, which shows the error you are getting. – GeekRide Dec 11 '12 at 13:25
You will get much better performance out of UDP - why are you trying to use TCP if you can test UDP working? – deed02392 Dec 11 '12 at 13:36
@deed02392 I tested in home as udp but at office udp connection is being blocked by firewall – Rafael Dec 11 '12 at 13:37
@GeekRide I am getting can't connect..."Options error: --explicit-exit-notify can only be used with --proto udp Use --help for more information." in my OpenVPN GUI client. In the server I was getting address already used but I guess I fixed, changing port 8080 and management port 8081, It started but the client not yet – Rafael Dec 11 '12 at 13:52
The server not starting is explained in the answers below but you have other problems in your config. Your certificates private keys are not secured only to owner (chmod 600 to root on them should be better) and you need to remove the option explicit-exit-notify on the client config if you use tcp instead of udp. – laurent Dec 11 '12 at 15:15

The server log is very clear on why it's not working.

TCP/UDP: Socket bind failed on local address [undef]: Address already in use

You've got something else running on that combination of protocol/port. You can take a look what it is by doing netstat -nlp | grep 1234 (change port number accordingly) and kill that process or move that to another port.

share|improve this answer

First of all, are you sure TCP connectivity between the client(s) and the server is ok? You can test it by simply telnetting to the server (make sure the OpenVPN server is running):

telnet x.x.x.x 8080

If it does not connect, it's not an OpenVPN problem, you should like in firewalls and the like. Port 8080 is sometimes used by HTTP service, and is thus being blocked by some firewalls and/or intercepted by some transparent HTTP proxies. If you have TCP connectivity problems on port 8080, try a different port - maybe port 1194/tcp which is the IANA reserved port for OpenVPN.

If telnet does connect, TCP connectivity is probably ok and the problem could be in OpenVPN. You should improve your question by adding some OpenVPN logs.

And, by the way, why don't you stick with the UDP protocol? Why do you think you need TCP?

share|improve this answer
Hi, I am able to telnetting to the server. I just can't connect to the server with OpenVPN GUI client and neither running openvpn --config client-tls.conf. I get "Options error: --explicit-exit-notify can only be used with --proto udp Use --help for more information." – Rafael Dec 11 '12 at 13:59
And your telnet to 8080 reaches the openvpn server? or another server like a webserver already running on this port? The server log says it couldn't start openvpn because the port is already in use. You need to change the port 8080 you are running openvpn or the other server running there. Why don't you use the default 1194 port? (tcp should work if you can't use udp because it is blocked) – laurent Dec 11 '12 at 15:04
hum looking better at your config, you have already the management listening on port 8080 and the openvpn server trying to use the same port... – laurent Dec 11 '12 at 15:11
@Rafael: there you go, this is the solution: you can't use that option with tcp (on the client side). Remove it if you don't need it. Read the manual if you don't know what it does or if you actually need it. – Luke404 Dec 12 '12 at 14:18
@Rafael: on the server side, as gertvdijk pointed out, you already have something else listening on port 8080/tcp, so you either shut the other thing off or you change port for OpenVPN. – Luke404 Dec 12 '12 at 14:20
up vote 0 down vote accepted

I solved the issue in server, changing the management port to different port of openvpn port.

port 8080 
management 8081

And in the client removing the following line, since it is not supported in TCP mode.

explicit-exit-notify 2
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.