1

I had an issue with running Openvpn over UDP in my college network. The firewall was dropping UDP connections. As http and https were working fine and assuming that the firewall was inspecting packet header, I tried to run Openvpn over a https tunnel using stunnel. I was not successful because Openvpn was using UDP. So, I got openvpn to use TCP and it worked. But, later I found that the firewall was allowing all TCP connections (and was not insepcting packet headers) and I was able to run Openvpn without the https tunnel.

My question is: Why Openvpn did not work over https tunnel while it was using UDP protocol? and Why did it work with TCP over the same https tunnel? Is it not the TCP packets that carry https traffic and not https carrying TCP or UDP packets? To put my question in a different way: by default https is run over TCP, so why should https make a fuss (as it just creates a transit tunnel) when it is made to carry UDP packets and not TCP?

  • You will probably need to detail how you set up the HTTPS tunnel, because that's likely to be instrumental to the answer. – Sean Reifschneider Jan 14 '12 at 9:24
  • I have mentioned a link in the question. I followed that howto exactly at it is written. – nixnotwin Jan 14 '12 at 12:06
  • 1
    Ah, there's your problem! That URL is for tunneling SSH over stunnel, not OpenVPN. :-) I've replied with my guess, if it's off, please provide more details, including the OpenVPN side of it. – Sean Reifschneider Jan 15 '12 at 2:14
2

From the stunnel FAQ :

Can I forward UDP services over stunnel?

As described thus far, no. Stunnel works with SSL, which runs only on TCP. There are ways to forward UDP packets over TCP, and in principle these should be able to work over stunnel.

SSL is a connection oriented protocol, while UDP is connection-less. Therefor you can not forward udp over TCP.

2

I'm going to go out on a limb here and guess, since the details of your configuration aren't in the question...

If you just pointed OpenVPN at the stunnel port, and OpenVPN was using UDP, but stunnel was using TCP, they would never connect. A network endpoint is identified by IP address, port and protocol. If you had stunnel listening on (127.0.0.1, 4430, tcp) and OpenVPN was trying to connect to (127.0.0.1, 4430, udp), it wouldn't be able to connect to stunnel.

I don't see that stunnel has any options for UDP operation, so this must have been what happened. This jives with what you said about how it worked when you switched OpenVPN to TCP.

UDP and TCP are completely different protocols, using different APIs. So you can't just interchange them, producers and consumers need to be written specifically for the protocol. It would be possible to proxy UDP over SSL, but it would require a tunnel software specifically written for that. I'm not aware of one that supports that.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.