Hi, On 08/01/15 18:10, Alfredo Palhares wrote: > Hello, > > I am having trouble obfuscating a VPN connection. > > Problem is, that on a certain country the VPN is impossible to access. > Currently running on port 1194 and UDP, I would like to avoid changing > these settings as It would upset a lot of people. > > So after a small research I encountered obfsproxy[1] and with some > experiments, I got to some conclusions/problems that are not described > on the wiki. > > Obfsproxy only seems to support SOCKSv4 and OpenVPN only does SOCKSv5 > please correct me if I am wrong on this one. that is correct > So I used the client method like so: > > ``` > obfsproxy --log-file=obfsproxy.log --log-min-severity=debug obfs3 > --dest=myobfs-server-ip:80 client 0.0.0.0:80 > ``` > > The server side is the same but pointing to the port 1194, but the > problem is that obfsproxy sends the traffic trough TCP instead of UDP > like its on the OpenVPN client configuration. So I quiqly tried yet > another small hack. > > ``` > socat TCP-LISTEN:1194 UDP:<ipvpnserver>:1194 > ``` > > And the packet gets there, but: > > ``` > 1 0.000000 172.31.37.18 -> 172.31.9.199 OpenVPN 45 MessageType: Unknown > Messagetype[Malformed Packet] > ``` > > And then socat immediately exits. > > The OpenVPN client says: > ``` > Thu Jan 8 15:57:31 2015 socks_handshake: TCP port read timeout expired: > Operation now in progress (errno=115) > ``` > > The Malformed packed goes attached. > > Any Ideas on how can I translate the TCP to UDP so the OpenVPN server > does need to be modified to TCP ? > Another approach to the problem that does not cause breaking changes to > the server are welcome too. > > it's not possible to translate TCP to UDP for OpenVPN - there are subtle differences in the implementation of OpenVPN-over-UDP versus OpenVPN-over-TCP that prevent this. Your only resolution is to set up OpenVPN over TCP - but instead of changing your existing service you could simply add a second that runs OpenVPN over TCP. I run an OpenVPN service listening on UDP/1194, TCP/1194 and TCP/443 (using 3 different subnets, but the end-users hardly notice).
HTH, JJK ------------------------------------------------------------------------------ Dive into the World of Parallel Programming! The Go Parallel Website, sponsored by Intel and developed in partnership with Slashdot Media, is your hub for all things parallel software development, from weekly thought leadership blogs to news, videos, case studies, tutorials and more. Take a look and join the conversation now. http://goparallel.sourceforge.net _______________________________________________ Openvpn-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-users
