I run a VPN from my Linode VM for v

I run a VPN from my Linode VM for various reasons, the most important of which is so that I and other family members can submit email over SMTP without having to worry about braindead networks that block outgoing port 587 for makey-uppey “security” reasons. Since my brother and I both have jobs that entail connecting to random corporate wireless networks, this is critical.

The problem was that I was running openvpn over the standard port 1194, which is also blocked by many networks – including my own employer’s. Openvpn uses a mock-HTTP protocol that will work over HTTP proxies, so I configured squid on the server’s port 8080 to forward packets to localhost:1194 and told the laptop openvpn client to use myserver:8080 as a proxy.

This worked well for my employer’s network, but did not agree with the guest wireless network of one of my clients, which had absolutely no problem with port 1194, but uses its own transparent proxy that doesn’t play nice with daisychained proxies. I kept having to comment and uncomment the proxy directive in my laptop’s openvpn.conf and restart, depending on location.

So I decided to do it the proper way, by connecting directly to openvpn on port 8080. My employer’s network would allow this through directly, and the client’s network should route through its transparent proxy without complaint. I don’t want to turn off port 1194 though, as this would rudely nobble all my brother’s devices, so I configured the server’s iptables to masquerade 8080->1194. I could then remove the proxy config from the laptop, change its connecting port to 8080 and restart the vpn client.

Problem solved! Except then I started getting the following error in my server logs:

Apr 28 13:02:43 xxx ovpn-server[13110]: xxx.xxx.xxx.xxx:57458 WARNING: Bad encapsulated packet length from peer (17231), which must be > 0 and

Hasil (Bahasa Indonesia) 1:

I run a VPN from my Linode VM for various reasons, the most important of which is so that I and other family members can submit email over SMTP without having to worry about braindead networks that block outgoing port 587 for makey-uppey “security” reasons. Since my brother and I both have jobs that entail connecting to random corporate wireless networks, this is critical.The problem was that I was running openvpn over the standard port 1194, which is also blocked by many networks – including my own employer’s. Openvpn uses a mock-HTTP protocol that will work over HTTP proxies, so I configured squid on the server’s port 8080 to forward packets to localhost:1194 and told the laptop openvpn client to use myserver:8080 as a proxy.This worked well for my employer’s network, but did not agree with the guest wireless network of one of my clients, which had absolutely no problem with port 1194, but uses its own transparent proxy that doesn’t play nice with daisychained proxies. I kept having to comment and uncomment the proxy directive in my laptop’s openvpn.conf and restart, depending on location.So I decided to do it the proper way, by connecting directly to openvpn on port 8080. My employer’s network would allow this through directly, and the client’s network should route through its transparent proxy without complaint. I don’t want to turn off port 1194 though, as this would rudely nobble all my brother’s devices, so I configured the server’s iptables to masquerade 8080->1194. I could then remove the proxy config from the laptop, change its connecting port to 8080 and restart the vpn client.Problem solved! Except then I started getting the following error in my server logs:Apr 28 13:02:43 xxx ovpn-server[13110]: xxx.xxx.xxx.xxx:57458 WARNING: Bad encapsulated packet length from peer (17231), which must be > 0 and <= 1560 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...]It turned out this was being generated by another client which had also been configured to use the proxy, but which had slipped my mind. The error stems from the client connecting to an openvpn port directly but sending requests formatted for a web proxy. Not sure why it shows up as an MTU error, but changing the other client config to match the laptop solved it.

Hasil (Bahasa Indonesia) 2:

Saya menjalankan VPN dari saya Linode VM untuk berbagai alasan, yang paling penting adalah agar saya dan anggota keluarga lainnya dapat mengirimkan email melalui SMTP tanpa harus khawatir tentang jaringan braindead yang menghalangi keluar port 587 untuk-uppey makey alasan "keamanan" . Karena saya dan adik saya keduanya memiliki pekerjaan yang memerlukan koneksi ke jaringan nirkabel acak perusahaan, ini sangat penting. Masalahnya adalah bahwa aku berlari openvpn melalui port standar 1194, yang juga diblokir oleh banyak jaringan - termasuk majikan saya sendiri. OpenVPN menggunakan-HTTP mock protokol yang akan bekerja melalui HTTP proxy, jadi saya dikonfigurasi squid pada port server 8080 untuk meneruskan paket ke localhost: 1194 dan mengatakan klien openvpn laptop menggunakan myserver:. 8080 sebagai proxy ini bekerja dengan baik untuk saya jaringan majikan, tapi tidak setuju dengan jaringan nirkabel tamu salah satu klien saya, yang benar-benar tidak masalah dengan port 1194, tetapi menggunakan transparent proxy sendiri yang tidak bermain baik dengan proxy daisychained. Aku terus mengalami untuk komentar dan tanda komentar direktif proxy openvpn.conf laptop saya dan restart, tergantung pada lokasi. Jadi saya memutuskan untuk melakukannya dengan cara yang tepat, dengan menghubungkan langsung ke OpenVPN pada port 8080. Jaringan saya majikan akan membiarkan ini melalui langsung , dan jaringan klien harus rute melalui transparent proxy tanpa keluhan. Saya tidak ingin mematikan pelabuhan 1194 meskipun, karena hal ini akan kasar menyuap semua perangkat adikku, jadi aku dikonfigurasi iptables server untuk menyamar 8080-> 1194. Saya kemudian bisa menghapus konfigurasi proxy dari laptop, mengubah port koneksi ke 8080 dan restart vpn klien. Masalah dipecahkan! Kecuali kemudian saya mulai mendapatkan error berikut di saya log server: 28 April 13:02:43 xxx ovpn server [13110]: xxx.xxx.xxx.xxx:57458 PERINGATAN: Bad dikemas panjang paket dari rekan (17231), yang harus> 0 dan <= 1.560 - pastikan bahwa --tun-mtu atau link-mtu sama pada kedua rekan - kondisi ini juga bisa menunjukkan serangan aktif mungkin pada link TCP - [Mencoba restart. ..] Ternyata ini yang dihasilkan oleh klien lain yang juga telah dikonfigurasi untuk menggunakan proxy, tapi yang telah menyelinap pikiran saya. Kesalahan berasal dari klien yang menghubungkan ke port openvpn langsung tetapi mengirimkan permintaan diformat untuk web proxy. Tidak yakin mengapa itu muncul sebagai kesalahan MTU, tetapi mengubah konfigurasi klien lainnya untuk mencocokkan laptop dipecahkan itu.