[Openvpn-users] VirusTotal openvpn-install-2.4.3-I602.exe

2017-09-04 Thread Igor Bozovic
Hello, I downloaded openvpn-install-2.4.3-I602.exe from https://openvpn.net/index.php/open-source/downloads.html and uploaded the file to https://www.virustotal.com. Baidu and TrendMicro-HouseCall reported a virus: https://www.virustotal.com/#/file/f722ff1d187951c4e7454e2d845ba6d0d43d505112e073fa

[Openvpn-users] VPN allows unencrypted traffic but not encrypted

2017-09-04 Thread Stuart Dallas
We’ve got a very odd issue happening at a new customer’s site. The VPN is established quite happily at their site and unencrypted traffic through that VPN works perfectly (HTTP requests). However, encrypted traffic does not (HTTPS and SSH). SSH connections get this far before appearing to hang:

Re: [Openvpn-users] VPN allows unencrypted traffic but not encrypted

2017-09-04 Thread Илья Шипицин
Please, provide both server and client config. (We saw similar situation, when server was "comp-lzo yes" and client "comp-lzo no") 4 сент. 2017 г. 19:25 пользователь "Stuart Dallas" написал: > We’ve got a very odd issue happening at a new customer’s site. > > > The VPN is established quite happ

Re: [Openvpn-users] VPN allows unencrypted traffic but not encrypted

2017-09-04 Thread Stuart Dallas
Happy to provide the configs, but as noted the configuration works perfectly when the server is on another internet connection. Server: local 0.0.0.0 port [redacted_port] proto udp dev cloudvpn dev-type tun ca cloud-ca.crt cert cloud-server.crt key cloud-server.key dh cloud-dh2048.pem topology s

Re: [Openvpn-users] VPN allows unencrypted traffic but not encrypted

2017-09-04 Thread Stuart Dallas
Sorry, I meant when the CLIENT is on another internet connection. To clarify, HTTP works fine through the VPN connection. HTTPS and SSH do not work through the VPN connection. All three work outside of the VPN connection. Thanks. -Stuart On 4 Sep 2017, 15:40 +0100, Stuart Dallas , wrote: > Hap

Re: [Openvpn-users] VPN allows unencrypted traffic but not encrypted

2017-09-04 Thread Илья Шипицин
Also, we observed very rare situations when switching to tcp instead of udp resolved similar issues (did not have a chance to dig deeper) Can you try to switch to tcp? 4 сент. 2017 г. 19:40 пользователь "Stuart Dallas" написал: > Happy to provide the configs, but as noted the configuration work

Re: [Openvpn-users] VPN allows unencrypted traffic but not encrypted

2017-09-04 Thread Stuart Dallas
We’ve just tried TCP and the issue has gone away. Can anyone tell me why this happens? Also, what’s the reason for UDP being preferred over TCP? Thanks. -Stuart On 4 Sep 2017, 15:46 +0100, Илья Шипицин , wrote: > Also, we observed very rare situations when switching to tcp instead of udp > re

Re: [Openvpn-users] VPN allows unencrypted traffic but not encrypted

2017-09-04 Thread Gregory Sloop
Top Posting: UDP is preferred vs TCP because of TCP inside TCP issues - e.g. TCP sliding window ACK inside another TCP sliding window ACK. As packet loss increases, this becomes a huge problem. Essentailly, you have TCP stream inside the OVPN tunnel, and it's being ferried to the remote site/c

Re: [Openvpn-users] VPN allows unencrypted traffic but not encrypted

2017-09-04 Thread Илья Шипицин
This _might_ happen because of mtu issues. tcp has advanced level of negotiation, which udp does not have: mss It would be nice if you would have compared packet sizes in both cases (and have a deep look to mss) udp is preffered, you should not use tcp without strong reason. 4 сент. 2017 г. 20:5

Re: [Openvpn-users] VPN allows unencrypted traffic but not encrypted

2017-09-04 Thread Gert Doering
Hi, On Mon, Sep 04, 2017 at 03:25:02PM +0100, Stuart Dallas wrote: > The VPN is established quite happily at their site and unencrypted traffic > through that VPN works perfectly (HTTP requests). > > However, encrypted traffic does not (HTTPS and SSH). SSH connections get this > far before appe

Re: [Openvpn-users] VPN allows unencrypted traffic but not encrypted

2017-09-04 Thread wang yu
>I don't have any authoritative thoughts on why TCP would work when UDP doesn't, but one thing that comes to mind is MTU size. If the MTU size was too large, UDP will simply fail. TCP *should* [but may not always] get a fragmentation notification telling the sender to fragment the packets down to f