Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to configure openvpn, I used a config and certificate/key example that comes with OpenVPN. It works perfectly when I use with UDP but it doesn't works with TCP

server-tls.conf

# OpenVPN config "server-tls.conf"
#
# test using: openvpn –-config server-tls.conf

proto tcp #default
dev tun   #default
port 8080 #default
management 127.0.0.1 8080

# Tunnel IP-number plan:
# network: 10.4.0.0/24    all tunnel-endpoints (TEPs)
# IP:      10.4.0.1       server
# IP:      10.4.0.2       server   p2p address (not-used)
# IP:      10.4.0.5       client-1 p2p address (not-used)
# IP:      10.4.0.6       client-1
# IP:      10.4.0.9       client-2 p2p address (not-used)
# IP:      10.4.0.10      client-2
# IP:      10.4.0.13      client-3 p2p address (not-used)
# IP:      10.4.0.14      client-3
# etc...                  This setup allows (2^(32-24)/4)-1=63 clients

server 10.4.0.0 255.255.255.0 # the server Tunnel-IP will be .1

# Maintain a record of client <-> virtual IP address
# associations in this file.  If OpenVPN goes down or
# is restarted, reconnecting clients can be assigned
# the same virtual IP address from the pool that was
# previously assigned.
ifconfig-pool-persist ipp.txt

# The 'server' command also established a pool of Tunnel-IPs for the clients (like DHCP)

#route 10.4.0.0 255.255.255.0 # this command is implicit with 'server' command

cd /etc/openvpn/
log /var/log/openvpn.log

ca       ca.crt
cert     server.crt
key      server.key
dh       dh1024.pem
tls-auth ta.key 0 # Use 0=server, 1=client

verb 3
keepalive 10 60
persist-tun
persist-key
persist-local-ip
comp-lzo

duplicate-cn # needed if all clients use same client.crt/key

# Uncomment following line if you want to allow client-to-client traffic:
# (dont use this option if you want to filter the client-to-client packets via iptables)
#client-to-client

#push "route 10.4.0.0 255.255.255.0" # this is done automatically with client-to-client command (else do specify)

# end of "server-tls.conf"

client-tls.conf

# OpenVPN config "client-tls.conf"
#
# run with: openvpn –config client-tls.conf

proto tcp #default
dev tun   #default
client
remote x.x.x.x 8080

#cd /etc/openvpn/
#log /var/log/openvpn.log
#log openvpn.log

ca       ca.crt
cert     client.crt
key      client.key
tls-auth ta.key 1 # Use 0=server, 1=client

# Verify that we are connected with the correct server:

tls-remote "Test-Server"
ns-cert-type    server

nobind
verb 3
keepalive 10 60
comp-lzo
explicit-exit-notify 2

# end of "client-tls.conf"

Server log:

cat /var/log/openvpn.log
Tue Dec 11 17:36:18 2012 OpenVPN 2.2.0 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Jul  4 2011
Tue Dec 11 17:36:18 2012 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:8080
Tue Dec 11 17:36:18 2012 WARNING: --ifconfig-pool-persist will not work with --duplicate-cn
Tue Dec 11 17:36:18 2012 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Tue Dec 11 17:36:18 2012 Diffie-Hellman initialized with 1024 bit key
Tue Dec 11 17:36:18 2012 WARNING: file 'server.key' is group or others accessible
Tue Dec 11 17:36:18 2012 WARNING: file 'ta.key' is group or others accessible
Tue Dec 11 17:36:18 2012 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Tue Dec 11 17:36:18 2012 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Dec 11 17:36:18 2012 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Dec 11 17:36:18 2012 TLS-Auth MTU parms [ L:1544 D:168 EF:68 EB:0 ET:0 EL:0 ]
Tue Dec 11 17:36:18 2012 Socket Buffers: R=[87380->131072] S=[16384->131072]
Tue Dec 11 17:36:18 2012 TCP/UDP: Socket bind failed on local address [undef]: Address already in use
Tue Dec 11 17:36:18 2012 Exiting

Client log:

Options error: --explicit-exit-notify can only be used with --proto udp
Use --help for more information.

Why it doesn't work in TCP mode?

share|improve this question
1  
Can you paste the server logs, which shows the error you are getting. –  GeekRide Dec 11 '12 at 13:25
1  
You will get much better performance out of UDP - why are you trying to use TCP if you can test UDP working? –  deed02392 Dec 11 '12 at 13:36
    
@deed02392 I tested in home as udp but at office udp connection is being blocked by firewall –  Rafael Dec 11 '12 at 13:37
    
@GeekRide I am getting can't connect..."Options error: --explicit-exit-notify can only be used with --proto udp Use --help for more information." in my OpenVPN GUI client. In the server I was getting address already used but I guess I fixed, changing port 8080 and management port 8081, It started but the client not yet –  Rafael Dec 11 '12 at 13:52
    
The server not starting is explained in the answers below but you have other problems in your config. Your certificates private keys are not secured only to owner (chmod 600 to root on them should be better) and you need to remove the option explicit-exit-notify on the client config if you use tcp instead of udp. –  laurent Dec 11 '12 at 15:15
add comment

3 Answers

The server log is very clear on why it's not working.

TCP/UDP: Socket bind failed on local address [undef]: Address already in use

You've got something else running on that combination of protocol/port. You can take a look what it is by doing netstat -nlp | grep 1234 (change port number accordingly) and kill that process or move that to another port.

share|improve this answer
add comment

First of all, are you sure TCP connectivity between the client(s) and the server is ok? You can test it by simply telnetting to the server (make sure the OpenVPN server is running):

telnet x.x.x.x 8080

If it does not connect, it's not an OpenVPN problem, you should like in firewalls and the like. Port 8080 is sometimes used by HTTP service, and is thus being blocked by some firewalls and/or intercepted by some transparent HTTP proxies. If you have TCP connectivity problems on port 8080, try a different port - maybe port 1194/tcp which is the IANA reserved port for OpenVPN.

If telnet does connect, TCP connectivity is probably ok and the problem could be in OpenVPN. You should improve your question by adding some OpenVPN logs.

And, by the way, why don't you stick with the UDP protocol? Why do you think you need TCP?

share|improve this answer
    
Hi, I am able to telnetting to the server. I just can't connect to the server with OpenVPN GUI client and neither running openvpn --config client-tls.conf. I get "Options error: --explicit-exit-notify can only be used with --proto udp Use --help for more information." –  Rafael Dec 11 '12 at 13:59
    
And your telnet to 8080 reaches the openvpn server? or another server like a webserver already running on this port? The server log says it couldn't start openvpn because the port is already in use. You need to change the port 8080 you are running openvpn or the other server running there. Why don't you use the default 1194 port? (tcp should work if you can't use udp because it is blocked) –  laurent Dec 11 '12 at 15:04
    
hum looking better at your config, you have already the management listening on port 8080 and the openvpn server trying to use the same port... –  laurent Dec 11 '12 at 15:11
    
@Rafael: there you go, this is the solution: you can't use that option with tcp (on the client side). Remove it if you don't need it. Read the manual if you don't know what it does or if you actually need it. –  Luke404 Dec 12 '12 at 14:18
    
@Rafael: on the server side, as gertvdijk pointed out, you already have something else listening on port 8080/tcp, so you either shut the other thing off or you change port for OpenVPN. –  Luke404 Dec 12 '12 at 14:20
show 2 more comments
up vote 0 down vote accepted

I solved the issue in server, changing the management port to different port of openvpn port.

port 8080 
management 127.0.0.1 8081

And in the client removing the following line, since it is not supported in TCP mode.

explicit-exit-notify 2
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.