1

I have a computer at work that is behind a firewall with an internal ip address of 192.168.12.13... the firewall maps ports 40000 - 40019 to matching ports on this local machine. (e.g. 40000 - 40000, 40001 - 40001, etc...) And, let's define the external ip as 12.34.56.78.

I want to setup my home computer to connect to this work computer.

Work computer stunnel.config:

[brianserver]
client = no
accept = 127.0.0.1:40020
connect = 192.168.12.13:40000
ciphers = PSK
PSKsecrets = psk1.txt

Home computer stunnel.config:

[brianclient]
client = yes
accept = 127.0.0.1:40020
connect = 12.34.56.78:40000
PSKsecrets = psk1.txt

I am using a product called "Hercules SETUP utility" to listen on the work machine:

enter image description here

And, I am using "Hercules SETUP utility" to initiate a connection from the home machine:

enter image description here

As you can see I am getting a connection refused message.

Home computer stunnel.log: (these messages occurred during connection attempt)

2019.04.10 23:36:09 LOG7[main]: Found 1 ready file descriptor(s)
2019.04.10 23:36:09 LOG7[main]: FD=616 ifds=r-x ofds = ---
2019.04.10 23:36:09 LOG7[main]: FD=624 ifds=r-x ofds = ---
2019.04.10 23:36:09 LOG7[main]: Service[brianclient] accepted(FD= 768) from 127.0.0.1:56795
2019.04.10 23:36:09 LOG7[main]: Creating a new thread
2019.04.10 23:36:09 LOG7[main]: New thread created
2019.04.10 23:36:09 LOG7[2]: Service[brianclient] started
2019.04.10 23:36:09 LOG7[2]: Setting local socket options(FD= 768)
2019.04.10 23:36:09 LOG7[2]: Option TCP_NODELAY set on local socket
2019.04.10 23:36:09 LOG5[2]: Service[brianclient] accepted connection from 127.0.0.1:56795
2019.04.10 23:36:09 LOG6[2]: s_connect: connecting 12.34.56.78:40000
2019.04.10 23:36:09 LOG7[2]: s_connect: s_poll_wait 12.34.56.78:40000: waiting 10 seconds
2019.04.10 23:36:10 LOG3[2]: s_connect: connect 12.34.56.78:40000: Connection refused(WSAECONNREFUSED) (10061)
2019.04.10 23:36:10 LOG3[2]: No more addresses to connect
2019.04.10 23:36:10 LOG5[2]: Connection reset: 0 byte (s) sent to TLS, 0 byte (s) sent to socket
2019.04.10 23:36:10 LOG7[2]: Local descriptor(FD= 768) closed
2019.04.10 23:36:10 LOG7[2]: Service[brianclient] finished(0 left)

Work computer stunnel.log: (ran at startup... no messages on connection attempt)

2019.04.10 21:24:55 LOG7[main]: Running on Windows 6.2
2019.04.10 21:24:55 LOG7[main]: No limit detected for the number of clients
2019.04.10 21:24:55 LOG5[main]: stunnel 5.51 on x64-pc-mingw32-gnu platform
2019.04.10 21:24:55 LOG5[main]: Compiled/running with OpenSSL 1.1.1b  26 Feb 2019
2019.04.10 21:24:55 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI
2019.04.10 21:24:55 LOG7[main]: errno: (* _errno())
2019.04.10 21:24:55 LOG7[service]: GUI message loop initialized
2019.04.10 21:24:55 LOG7[main]: Running on Windows 6.2
2019.04.10 21:24:55 LOG5[main]: Reading configuration from file stunnel.conf
2019.04.10 21:24:55 LOG5[main]: UTF-8 byte order mark detected
2019.04.10 21:24:55 LOG7[main]: Compression disabled
2019.04.10 21:24:55 LOG7[main]: No PRNG seeding was required
2019.04.10 21:24:55 LOG6[main]: Initializing service[brianserver]
2019.04.10 21:24:55 LOG6[main]: PSK identities: 1 retrieved
2019.04.10 21:24:55 LOG7[main]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK
2019.04.10 21:24:55 LOG7[main]: TLSv1.3 ciphersuites: TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256
2019.04.10 21:24:55 LOG7[main]: TLS options: 0x02100004 (+0x00000000, -0x00000000)
2019.04.10 21:24:55 LOG7[main]: No certificate or private key specified
2019.04.10 21:24:55 LOG6[main]: DH initialization not needed
2019.04.10 21:24:55 LOG7[main]: ECDH initialization
2019.04.10 21:24:55 LOG7[main]: ECDH initialized with curves X25519:P-256:X448:P-521:P-384
2019.04.10 21:24:55 LOG5[main]: Configuration successful
2019.04.10 21:24:55 LOG7[main]: Binding service[brianserver]
2019.04.10 21:24:55 LOG7[main]: Listening file descriptor created(FD= 716)
2019.04.10 21:24:55 LOG7[main]: Setting accept socket options(FD= 716)
2019.04.10 21:24:55 LOG7[main]: Option SO_EXCLUSIVEADDRUSE set on accept socket
2019.04.10 21:24:55 LOG6[main]: Service[brianserver] (FD=716) bound to 127.0.0.1:40020
2019.04.10 21:24:55 LOG7[cron]: Cron thread initialized
2019.04.10 21:25:55 LOG6[cron]: Executing cron jobs
2019.04.10 21:25:55 LOG6[cron]: Cron jobs completed in 0 seconds
2019.04.10 21:25:55 LOG7[cron]: Waiting 86400 seconds

Also, psk1.txt has matching content:

brianskey:a3...6r

Also, on work computer:

C:\Program Files (x86)\stunnel\bin>netstat -ano|findstr 40020
   TCP    0.0.0.0:40020          0.0.0.0:0              LISTENING       71888
   TCP    127.0.0.1:40020        0.0.0.0:0              LISTENING       34728

Note: the line with "0.0.0.0:40020" shows up after I start the Hercules listener.

  • Don't know if that solves the problem, but the stunnel PSK example has a line ciphers = PSK in the server config. – Freddy Apr 14 at 19:08
  • I had hopes... but still the same behavior. – Brian Rice Apr 15 at 5:15
0
+100

Accept tells stunnel to listen on that port. Connect tells stunnel to open a connection to that port. You are having both computers listen on localhost:40020 (which is local loopback) and try to initiate a connection externally. You want your work computer (server) to listen on 192.168.12.13:40000 and then tunnel the connection to 127.0.0.1 40020 and have your remote computer connect to your 12.34.56.78:40000 address and listen locally on 40020 (127.0.0.1:40020). That will tunnel your port 40020 on your home computer to the 40020 port on your work computer.

[brianserver]
client = no
accept = 192.168.12.13:40000
connect = 127.0.0.1:40020
ciphers = PSK
PSKsecrets = psk1.txt

[brianclient]
client = yes
accept = 127.0.0.1:40020
connect = 12.34.56.78:40000
PSKsecrets = psk1.txt

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.