Set up OpenConnect VPN Server (ocserv) on Ubuntu 16.04/18.04 with Let’s Encrypt
This tutorial is going to show you how to install OpenConnect VPN server on Ubuntu 16.04/18.04. OpenConnect VPN server, aka ocserv, is an open-source implementation of Cisco AnyConnnect VPN protocol, which is popular among businesses and universities. AnyConnect is a SSL-based VPN protocol that allows individual users to connect to a remote network.
Features of OpenConnect VPN server:
- Lightweight and fast. In my test, I can watch YouTube in 4k with OpenConnect VPN. YouTube is blocked in my country.
- Compatible with Cisco AnyConnect client
- Supports password authentication and certificate authentication
- Easy to set up
I particularly like that fact that compared to other VPN technologies, it is very easy and convenient for the end-user to use OpenConnect VPN. Whenever I install a Debian-based Linux distro on my computer and want to quickly unblock websites or hide my IP address, I install OpenConnect client and connect to the server with just two lines of commands:
sudo apt install openconnect
sudo openconnect -b vpn.mydomain.com
The gnutls-bin
software package provides tools to create your own CA and server certificate, but we will obtain and install Let’s Encrypt certificate. The advantage of using Let’s Encrypt certificate is that it’s free, easier to set up and trusted by VPN client software.
Prerequisites
To follow this tutorial, you will need:
- A VPS (Virtual Private Server) that can access blocked websites freely (Outside of your country or Internet filtering system). I recommend Vultr. They offer 512M memory high performance KVM VPS for just $2.5 per month, which is perfect for your private VPN server. Once you have a VPS, install Ubuntu 16.04 or Ubuntu 18.04 on it and follow the instructions below.
- You also need a domain name. I registered my domain name from NameCheap because the price is low and they give whois privacy protection free for life.
Installing OpenConnect VPN Server on Ubuntu 16.04/18.04
Log into your Ubuntu 16.04/18.04 server. Then use apt
to install the ocserv
package,which is included in Ubuntu repository since 16.04.
sudo apt install ocserv
Once installed, the OpenConnect VPN server is automatically started. You can check its status with:
systemctl status ocserv
Sample output:
● ocserv.service - OpenConnect SSL VPN server Loaded: loaded (/lib/systemd/system/ocserv.service; enabled; vendor preset: enabled Active: active (running) since Thu 2017-11-30 05:45:07 UTC; 11s ago Docs: man:ocserv(8) Main PID: 19235 (ocserv-main) CGroup: /system.slice/ocserv.service ├─19235 ocserv-main └─19242 ocserv-secm
If it’s not running, then you can start it with:
sudo systemctl start ocserv
By default OpenConnect VPN server listens on TCP and UDP port 443. If it’s being used by web server, then the VPN server can’t be started. We will see how to change the port in OpenConnect VPN configuration file later.
Installing Let’s Encrypt Client (Certbot) on Ubuntu 16.04/18.04 Server
Run the following commands to install the latest version of certbot from the official PPA. software-properties-common is required if you want to install packages from PPA. It may be missing on your Ubuntu server.
sudo apt install software-properties-common sudo add-apt-repository ppa:certbot/certbot sudo apt update sudo apt install certbot
To check version number, run
certbot --version
Sample output:
certbot 0.26.1
Obtaining a TLS Certificate from Let’s Encrypt
Standalone Plugin
If there’s no web server running on your Ubuntu 16.04/18.04 server and you want OpenConnect VPN server to use port 443, then you can use the standalone plugin to obtain TLS certificate from Let’s Encrypt. Run the following command. Don’t forget to set A record for your domain name.
sudo certbot certonly --standalone --preferred-challenges http --agree-tos --email your-email-address -d vpn.example.com
Explanation:
certonly
: Obtain a certificate but don’t install it.--standalone
: Use the standalone plugin to obtain a certificate--preferred-challenges http
: Perform http-01 challenge to validate our domain, which will use port 80. By default the standalone plugin will perform tls-sni challenge, which uses port 443. Since port 443 is already used by OpenConnect VPN server, we need to change the default behavior.--agree-tos
: Agree to Let’s Encrypt terms of service.--email
: Email address is used for account registration and recovery.-d
: Specify your domain name.
As you can see the from the following screenshot, I successfully obtained the certificate.
Using webroot Plugin
If your Ubuntu 16.04/18.04 server has a web server listening on port 80 and 443, and you want OpenConnect VPN server to use a different port, then it’s a good idea to use the webroot plugin to obtain a certificate because the webroot plugin works with pretty much every web server and we don’t need to install the certificate in the web server.
First, you need to create a virtual host for vpn.example.com.
Apache
If you are using Apache, then
sudo nano /etc/apache2/sites-available/vpn.example.com.conf
And paste the following lines into the file.
<VirtualHost *:80> ServerName vpn.example.com DocumentRoot /var/www/vpn.example.com </VirtualHost>
Save and close the file. Then create the web root directory.
sudo mkdir /var/www/vpn.example.com
Set www-data (Apache user) as the owner of the web root.
sudo chown www-data:www-data /var/www/vpn.example.com -R
Enable this virtual host.
sudo a2ensite vpn.example.com
Reload Apache for the changes to take effect.
sudo systemctl reload apache2
Once virtual host is created and enabled, run the following command to obtain Let’s Encrypt certificate using webroot plugin.
sudo certbot certonly --webroot --agree-tos --email your-email-address -d vpn.example.com -w /var/www/vpn.example.com
Nginx
If you are using Nginx, then
sudo nano /etc/nginx/conf.d/vpn.example.com.conf
Paste the following lines into the file.
server { listen 80; server_name vpn.example.com; root /var/www/vpn.example.com/; location ~ /.well-known/acme-challenge { allow all; } }
Save and close the file. Then create the web root directory.
sudo mkdir /var/www/vpn.example.com
Set www-data (Nginx user) as the owner of the web root.
sudo chown www-data:www-data /var/www/vpn.example.com -R
Reload Nginx for the changes to take effect.
sudo systemctl reload nginx
Once virtual host is created and enabled, run the following command to obtain Let’s Encrypt certificate using webroot plugin.
sudo certbot certonly --webroot --agree-tos --email your-email-address -d vpn.example.com -w /var/www/vpn.example.com
Editing OpenConnect VPN Server Configuration File
Edit ocserv configuration file.
sudo nano /etc/ocserv/ocserv.conf
First, configure password authentication. By default, password authentication through PAM (Pluggable Authentication Modules) is enabled, which allows you to use Ubuntu system accounts to login from VPN clients. This behavior can be disabled by commenting out the following line.
auth = "pam[gid-min=1000]"
If we want users to use separate VPN accounts instead of system accounts to login, we need to add the following line to enable password authentication with a password file.
auth = "plain[passwd=/etc/ocserv/ocpasswd]"
After finishing editing this config file, we will see how to use ocpasswd
tool to generate the /etc/ocserv/ocpasswd
file, which contains a list of usernames and encoded passwords.
Note: Ocserv supports client certificate authentication, but Let’s Encrypt does not issue client certificate. You need to set up your own CA to issue client certificate.
Next, if you don’t want ocserv to use TCP and UDP port 443, then find the following two lines and change the port number. Otherwise leave them alone.
tcp-port = 443 udp-port = 443
Then find the following two lines. We need to change them.
server-cert = /etc/ssl/certs/ssl-cert-snakeoil.pem server-key = /etc/ssl/private/ssl-cert-snakeoil.key
Replace the default setting with the path of Let’s Encrypt server certificate and server key file.
server-cert = /etc/letsencrypt/live/vpn.example.com/fullchain.pem server-key = /etc/letsencrypt/live/vpn.example.com/privkey.pem
Then, set the maximal number of clients. Default is 16. Set to zero for unlimited.
max-clients = 16
Set the number of devices a user is able to login from at the same time. Default is 2. Set to zero for unlimited.
max-same-clients = 2
Next, find the following line. Change false
to true
to enable MTU discovery, which can optimize VPN performance.
try-mtu-discovery = false
After that, set the default domain to vpn.example.com.
default-domain = vpn.example.com
The IPv4 network configuration is as follows by default. This will cause problems because most home routers also set the IPv4 network range to 192.168.1.0/24
.
ipv4-network = 192.168.1.0 ipv4-netmask = 255.255.255.0
We can use another private IP address range (10.10.10.0/24) to avoid IP address collision, so change the value of ipv4-network
to
ipv4-network = 10.10.10.0
Now uncomment the following line to tunnel all DNS queries via the VPN.
tunnel-all-dns = true
Change DNS resolver address. You can use Google’s public DNS server.
dns = 8.8.8.8
Note: It’s a good practice to run your own DNS resolver on the same server, especially if you are a VPN provider. If there’s a DNS resolver running on the same server, then specify the DNS as
dns = 10.10.10.1
10.10.10.1 is the IP address of OpenConnect VPN server in the VPN LAN. This will speed up DNS lookups a little bit for clients because the network latency between the VPN server and the DNS resolver is eliminated.
Then comment out all the route parameters (add # symbol at the beginning of the following four lines), which will set the server as the default gateway for the clients.
route = 10.10.10.0/255.255.255.0 route = 192.168.0.0/255.255.0.0 route = fef4:db8:1000:1001::/64 no-route = 192.168.5.0/255.255.255.0
Save and close the file Then restart the VPN server for the changes to take effect.
sudo systemctl restart ocserv
Fixing DTLS Handshake Failure
On Ubuntu 16.04 and Ubuntu 18.04, ocserv daemon ocserv.socket
does not respect “listen-host” value from configuration file, which will cause the following error when clients connect to VPN server.
DTLS handshake failed: Resource temporarily unavailable, try again.
To fix this error, we need to edit the ocserv.service file. We first copy the original file in /lib/systemd/system/
directory to /etc/systemd/system/
directory, then edit it, because we don’t want new version of ocserv package to override our modifications. (To learn more about systemd unit files, run man systemd.unit
.)
sudo cp /lib/systemd/system/ocserv.service /etc/systemd/system/ocserv.service sudo nano /etc/systemd/system/ocserv.service
Comment out the following two lines.
Requires=ocserv.socket Also=ocserv.socket
Save and close the file. Then reload systemd
sudo systemctl daemon-reload
Stop ocserv.socket and disable it.
sudo systemctl stop ocserv.socket sudo systemctl disable ocserv.socket
Restart ocserv service.
sudo systemctl restart ocserv.service
The ocserv systemd service won’t output any message if it fails to restart, so we need to check the status to make sure it’s actually running.
systemctl status ocserv
Creating VPN Accounts
Now use the ocpasswd tool to generate VPN accounts.
sudo ocpasswd -c /etc/ocserv/ocpasswd username
You will be asked to set a password for the user and the information will be saved to /etc/ocserv/ocpasswd
file. To reset password, simply run the above command again.
Enable IP Forwarding
In order for the VPN server to route packets between VPN client and the outside world, we need to enable IP forwarding. Edit sysctl.conf
file.
sudo nano /etc/sysctl.conf
Add the following line at the end of this file.
net.ipv4.ip_forward = 1
Save and close the file. Then apply the changes with the below command. The -p option will load sysctl settings from /etc/sysctl.conf file. This command will preserve our changes across system reboots.
sudo sysctl -p
Configure Firewall for IP Masquerading
Find the name of your server’s main network interface.
ip addr
As you can see, it’s named ens3
on my Ubuntu server.
Then run the following command to configure IP masquerading. Replace ens3 with your own network interface name.
sudo iptables -t nat -A POSTROUTING -o ens3 -j MASQUERADE
The above command append (-A) a rule to the end of of POSTROUTING chain of nat table. It will link your virtual private network with the Internet. And also hide your network from the outside world. So the Internet can only see your VPN server’s IP, but can’t see your VPN client’s IP, just like your home router hides your private home network.
Now if you list the rules in the POSTROUTING chain of the NAT table by using the following command:
sudo iptables -t nat -L POSTROUTING
You can see the Masquerade rule.
Open Port 443 in Firewall
Run the following command to open TCP and UDP port 443. If you configured a different port for ocserv, then open your preferred port.
sudo iptables -I INPUT -p tcp --dport 443 -j ACCEPT sudo iptables -I INPUT -p udp --dport 443 -j ACCEPT
Preserving Iptables Rules
By default, iptables ruls are lost after reboot. To preserve them, you can switch to root user and then save your rules to a file.
su - iptables-save > /etc/iptables.rules
Then create a systemd service file so that we can restore iptables rules at boot time.
nano /etc/systemd/system/iptables-restore.service
Put the following lines into the file.
[Unit] Description=Packet Filtering Framework Before=network-pre.target Wants=network-pre.target [Service] Type=oneshot ExecStart=/sbin/iptables-restore /etc/iptables.rules ExecReload=/sbin/iptables-restore /etc/iptables.rules RemainAfterExit=yes [Install] WantedBy=multi-user.target
Save and close the file. Then reload systemd daemon and enable iptables-restore service.
sudo systemctl daemon-reload sudo systemctl enable iptables-restore
Remember to save iptables rules to the file after making changes.
How to Install and Use OpenConnect VPN client on Ubuntu 16.04/18.04 Desktop
Run the following command to install OpenConnect VPN command line client on Ubuntu desktop.
sudo apt install openconnect
You can Connect to VPN from the command line like below. -b
flag will make it run in the background after connection is established.
sudo openconnect -b vpn.example.com:port-number
You will be asked to enter VPN username and password. If connection is successfully established, you will see the following message.
Got CONNECT response: HTTP/1.1 200 CONNECTED CSTP connected. DPD 90, Keepalive 32400 Connected tun0 as 192.168.1.139, using SSL Established DTLS connection (using GnuTLS). Ciphersuite (DTLS1.2)-(RSA)-(AES-256-GCM).
To stop the connection, run:
sudo pkill openconnect
To run the client non-interactively, use the following syntax.
echo -n password | sudo openconnect -b vpn.example.com -u username --passwd-on-stdin
If you want to use Network Manager to manage VPN connection, then you also need to install these packages.
sudo apt install network-manager-openconnect network-manager-openconnect-gnome
If you are successfully connected to the VPN server, but your public IP address doesn’t change, that’s because IP forwarding or IP masquerading is not working. I once had a typo in my iptables command, which caused my computer not being able to browse the Internet. Another time, my iptables restore service failed after a reboot.
Auto-Connect on System Startup
To let OpenConnect VPN client automatically connect to the server at boot time, we can create a systemd service unit.
sudo nano /etc/systemd/system/openconnect.service
Put the following lines to the file. Replace the red text.
[Unit] Description=OpenConnect VPN Client After=network-online.target Wants=network-online.target [Service] Type=simple ExecStart=/bin/bash -c '/bin/echo -n password | /usr/sbin/openconnect vpn.example.com -u username --passwd-on-stdin' ExecStop=/usr/bin/pkill openconnect Restart=always RestartSec=2 [Install] WantedBy=multi-user.target
Save and close the file. Then enable this service so that it will start at boot time.
sudo systemctl enable openconnect.service
Explanation of the file content:
After=network-online.target
andWants=network-online.target
make this service run after network is up.- In reality, this service can still run before network is up. We add
Restart=always
andRestartSec=2
to restart this service after 2 seconds if this service fails. - Systemd doesn’t recognise pipe redirection. So in the
ExecStart
directive, we wrap the comand in single quotes and run it with the Bash shell. - Since OpenConnect VPN client will run as a systemd service, which runs in the background, there’s no need to add
-b
flag to theopenconnect
command.
OpenConnect GUI Client for Windows and MacOS
They can be downloaded from OpenConnect GUI Github Page.
Speed
OpenConnect VPN is pretty fast. I can use it to watch 4k videos on YouTube.
Auto-Renew Let’s Encrypt Certificate
Edit root user’s crontab file.
sudo crontab -e
Add the following line at the end of the file. It’s necessary to restart ocserv service for the VPN server to pick up new certificate and key file.
@daily certbot renew --quiet && systemctl restart ocserv
Optimization
OpenConnect by default uses TLS over UDP protocol (DTLS) to achieve faster speed, but UDP can’t provide reliable transmission. TCP is slower than UDP but can provide reliable transmission. One optimization tip I can give you is to disable DTLS, use standard TLS (over TCP), then enable TCP BBR to boost TCP speed.
To disable DTLS, comment out (add # symbol at the beginning) the following line in ocserv configuration file.
udp-port = 443
Save and close the file. Then restart ocserv service.
sudo systemctl restart ocserv.service
To enable TCP BBR, please check out the following tutorial.
In my test, standard TLS with TCP BBR enabled is two times faster than DTLS.
Troubleshooting
Note that if you are using OpenVZ VPS, make sure you enable the TUN virtual networking device in VPS control panel.
If you encounter any problem, then check OpenConnect VPN server log.
sudo journalctl -xe -u ocserv.service
I found that if I change port 443 to a different port, the great firewall of China will block this VPN connection. Sometimes the speed drops to around 1Mbps, probably due to the fact that the great firewall of China is interrupting VPN connections because if I use Shadowsocks proxy on the same server, I can watch YouTube at 50Mbps.
Let OpenConnect VPN server and web server use port 443 at the same time
Normally a port can only be used by one process. However, we can use HAproxy (High Availability Proxy) and SNI (Server Name Indication) to make ocserv and Apache/Nginx use port 443 at the same time.
First, edit ocserv configuration file.
sudo nano /etc/ocserv/ocserv.conf
Uncomment the following line. This will allow ocserv to obtain the client IP address instead of HAproxy IP address.
listen-proxy-proto = true
Then find the following line.
#listen-host = [IP|HOSTNAME]
Change it to
listen-host = 127.0.0.1
This will make ocserv listen on 127.0.0.1 because later HAproxy will need to listen on the public IP address. Save and close the file. Then restart ocserv.
sudo systemctl restart ocserv
Next, we also need to make the web server listen on localhost only, instead of listening on public IP address. If you use Nginx, edit the server block file.
sudo nano /etc/nginx/conf.d/www.example.com.conf
In the SSL server block, find the following directive.
listen 443 ssl;
Change it to
listen 127.0.0.2:443 ssl;
This time we make it listen on 127.0.0.2:443
because 127.0.0.1:443
is already taken by ocserv. Save and close the file. Then restart Nginx.
sudo systemctl restart nginx
Now install HAproxy.
sudo apt install haproxy
Edit configuration file.
sudo nano /etc/haproxy/haproxy.cfg
Copy and paste the following lines to the end of the file. Replace 12.34.56.78
with the public IP address of your server. Replace vpn.example.com
with the domain name used by ocserv and www.example.com
with the domain name used by your web server.
frontend https bind 12.34.56.78:443 mode tcp tcp-request inspect-delay 5s tcp-request content accept if { req_ssl_hello_type 1 } use_backend ocserv if { req_ssl_sni -i vpn.example.com } use_backend nginx if { req_ssl_sni -i www.example.com } use_backend nginx if { req_ssl_sni -i example.com } default_backend ocserv backend ocserv mode tcp option ssl-hello-chk server ocserv 127.0.0.1:443 send-proxy-v2 backend nginx mode tcp option ssl-hello-chk server nginx 127.0.0.2:443 check
Save and close the file. Then restart HAproxy.
sudo systemctl restart haproxy
In the configuration above, we utilized the SNI (Server Name Indication) feature in TLS to differentiate VPN traffic and normal HTTPS traffic.
- When
vpn.example.com
is in the TLS Client Hello, HAProxy redirect traffic to the ocserv backend. - When
www.example.com
is in the TLS Client Hello, HAProxy redirect traffic to the nginx backend. - If the client doesn’t specify the server name in TLS Client Hello, then HAproxy will use the default backend (ocserv).
You can test this setup with the openssl
tool. First, run the following command multiple times.
echo | openssl s_client -connect your-server-IP:443 | grep subject
We didn’t specify server name in the above command, so HAproxy will always pass the request to the default backend (ocserv), and its certificate will be sent to the client. Next, run the following two commands.
echo | openssl s_client -servername www.example.com -connect your-server-IP:443 | grep subject echo | openssl s_client -servername vpn.example.com -connect your-server-IP:443 | grep subject
Now we specified the server name in the commands, so HAproxy will pass request accordingly. Note that the Cisco AnyConnect App doesn’t support TLS SNI, so it’s better to set ocserv
as the default backend in HAProxy configuration file.
When renewing Let’s Encrypt certificate for your website, it’s recommended that you use the http-01
chanllenge instead of tls-sni-01
chanllege, because HAproxy is listening on port 443 of the public IP address, so it can interfere with the renew process.
sudo certbot renew --preferred-challenges http-01
Fixing HAproxy Error
If your Nginx web server doesn’t show up in your browser and you see the following messages in haproxy log (/var/log/haproxy.log
)
Server nginx/nginx is DOWN, reason: Socket error, info: "Connection reset by peer backend nginx has no server available! Layer6 invalid response
It maybe because your backend Nginx web server is using a TLS certificate with OCSP must staple extension. Nginx doesn’t send the OCSP staple information on the first HTTP request. To make it work, be sure to add a resolver in your Nginx virtual host configuration like below.
{ .... ssl_trusted_certificate /etc/letsencrypt/live/www.example/chain.pem; ssl_stapling on; ssl_stapling_verify on; resolver 8.8.8.8; .... }
Save and close the file. Then restart Nginx.
sudo systemctl restart nginx
Also consider removing health check for the backend server in HAproxy. So change
server nginx 127.0.0.2:443 check
To
server nginx 127.0.0.2:443
Save and close the file. Then restart HAproxy.
sudo systemctl restart haproxy
Upgrading to the latest version of HAproxy can help too. Previously when I was using HAproxy 1.6 from the default Ubuntu repository, the log file didn’t show much information. To install the latest version, run the following commands:
sudo add-apt-repository ppa:vbernat/haproxy-1.8 sudo apt update sudo apt install haproxy
How to Disable TLS 1.0 and TLS 1.1 in ocserv
The PCI council deprecated TLS 1.0 in June 30, 2018 and main stream web browsers are going to disable TLS 1.0 and TLS 1.1 in 2020. We should do the same with VPN server. Edit the main configuration file.
sudo nano /etc/ocserv/ocserv.conf
Find the following line:
tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-VERS-SSL3.0"
To disable TLS 1.0 and TLS 1.1 in OpenConnect VPN server, just add -VERS-TLS1.0
and -VERS-TLS1.1
in the line.
tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-VERS-SSL3.0:-VERS-TLS1.0:-VERS-TLS1.1"
Save and close the file. Then restart ocserv.
sudo systemctl restart ocserv
Now ocserv will only accept TLS 1.2. For further information on configuring the TLS parameter in ocserv, please see GnuTLS priority strings.
To check if TLS 1.0 is supported in your OpenConnect VPN server, run the following command.
openssl s_client -connect vpn.your-domain.com:443 -tls1
And check TLS 1.1
openssl s_client -connect vpn.your-domain.com:443 -tls1_1
If you see the following message in the output, that means the TLS version is not supported.
New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported
I tried to enable TLS 1.3, but it is not supported yet in the ocserv package on Ubuntu.
That’s it! I hope this tutorial helped you install and configure OpenConnect VPN on Ubuntu 16.04 and Ubuntu 18.04. As always, if you found this post useful, then subscribe to our free newsletter.
I follow your instruction but still receive this error on client
DTLS handshake failed: Resource temporarily unavailable, try again.
what else I can do
“I found that if I change port 443 to a different port, the Internet filtering system of my country will block this VPN connection.”
So what is your country?
China.
Ubuntu 16 has and old version of ocserv.
It’s version (0.10.11-1build1) and there are a lot of improvements since that version in the current one (0.12.2)
Now I’m working on compiling it to work on ubuntu, but seems like ocserv is more compatible with debian. Still I got some errors if I want to run it as service using systemctl.
Is this the only vpn working in china? Microsoft SSTP is working? OpenVPN port 443 working?
I now only use self-hosted OpenConnect VPN and Shadowsocks proxy in China. They are very stable.
I used OpenVPN before with a VPN provider. It worked but can be easily interrupted by the great firewall. I have never used Microsoft SSTP.
also I wanted to tell you that the email your system sends, is going to spam folder.
My email server complies with all legitimate email-sending practices. It takes time to build a good email reputation. Microsoft is very strict on accepting emails. Initially the emails are likely to go into spam folder. If many people mark my emails as not spam, then my emails are more likely to go to inbox.
Shadowsocks proxy is not blocked in China? You can make OpenVPN connects to it and then it can work without being filtered by the great firewall?
Shadowsocks is working. I don’t know the state of OpenVPN now because I haven’t used it for a long time.
Greetings, friend. great tutorial. I stayed here: sudo openconnect -b vpn.example.com:port-number. When the command is issued, the message:
Got inappropriate HTTP CONNECT response: HTTP/1.1 401 Unauthorized
Creating SSL connection failed
What I can do? tks
thank you very much
I’m getting an error.
error: unknown user: nobody
Could you please guide me on what could be the problem?
This article does not require running a service as the nobody user. At which step did you see this error?
I fixed it. Thanks for your help anyways.
i just set up OpenConnect VPN server on ubuntu 18.04. Users are able to connect and get an IP address assigned by the OpenConnect server. Corp network is 172.16.4.0/23 OpenConnect server is 172.16.4.10 vpn clients get 10.1.1.0/24 addresses. From the vpn client i can ping 10.1.1.1 and 172.16.4.10, but can’t ping any other corp servers on the 17.16.4.0/23 network
ICMP packets get to the corp servers, but get dropped because the corp servers don’t know how to route to 10.1.1.0/24 subnet
any help is greatly appreciated
if I do route add 10.1.1.0 mask 255.255.255.0 172.16.4.10 on any of the corp servers I am able to communicate with the corp servers from the VPN client
Hello,
How can we disable TLS 1.0 in the OpenConnect VPN server config?
I just added instruction on how to disable TLS 1.0 in OpenConnect VPN server. Please see the end of this article.
Xiao,
Thanks for the TLS disablement update.
There is a few more things we would like to disable. Are you able to assist with disabling elliptic curves? P-192 (prime192v1) (192 bits) to be specific and a list of ciphers
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256
TLS_DHE_RSA_WITH_AES_256_CCM
Thanks
I have set up the server successfully but I can’t route traffic through the VPN server. I can only ping the server successfully but can’t ping any other IP.
Double check your sysctl config and iptables firewall config.
Jan 29 11:52:02 ip-172-31-30-232 ocserv[5028]: sec-mod: sec-mod initialized (socket: /var/run/ocserv-socket.5018)
Jan 29 11:52:02 ip-172-31-30-232 ocserv[5018]: main: tlslib.c:854: error loading file ‘/etc/letsencrypt/live//fullchain.pem ‘
Jan 29 11:52:02 ip-172-31-30-232 systemd[1]: ocserv.service: Main process exited, code=exited, status=1/FAILURE
Jan 29 11:52:02 ip-172-31-30-232 ocserv[5018]: main: tlslib.c:1000: error loading the certificate or key file
Jan 29 11:52:02 ip-172-31-30-232 ocserv[5028]: sec-mod: error receiving msg head from main
Jan 29 11:52:02 ip-172-31-30-232 ocserv[5028]: sec-mod: error processing sync command from main
Jan 29 11:52:02 ip-172-31-30-232 systemd[1]: ocserv.service: Failed with result ‘exit-code’.
Jan 29 11:52:02 ip-172-31-30-232 systemd[1]: ocserv.service: Start request repeated too quickly.
Jan 29 11:52:02 ip-172-31-30-232 systemd[1]: ocserv.service: Failed with result ‘exit-code’.
Jan 29 11:52:02 ip-172-31-30-232 systemd[1]: Failed to start OpenConnect SSL VPN server.
Hi,
I am following your instructions to the letter but I run into this issue when trying to setup ocserv server.
Has something changed since this guide was posted?
Thanks
This line:
indicates that you didn’t correctly specify the path to TLS certificate. If you go to the /etc/letsencrypt/live/ directory, you will understand what went wrong.
Hi Guo An,
Thanks for the speedy response. I should have mentioned that I removed the site’s domain from the nginx log.
* From the ocserv log before posting it.
Because of the execution of the certbot command as sudo, I suspect that this may be a permissions issue, because as a regular user I cannot access the certificates directory.
However, I have tried the following:
– Running ocserv as a root user (just for testing)
– changing permissions and owner of the certificates.
ocserv is still unable to read the certificates, at this point I’m not sure if it’s an issue with the certificate.
The problem is that ocserv can’t load the TLS certificate file. Please make sure the TLS certificate exist in the /etc/letsencrypt/live/vpn.example.com/ directory and double check your /etc/ocserv/ocserv.conf file.
From the log, I suspect that you added a whitespace at the end of the TLS certificate path.
What do you think about outline vpn
I haven’t set up outline VPN yet. From I have learned, Outline is based on Shadowsocks, which is a SOCKS5 proxy, not a VPN. Shadowsocks is very popular with Chinese netizens, used as a tool to bypass the Great Firewall. I have been using Shadowsocks for 3 years. It’s super fast.
it is super easy to set up. Can you please write a review about it
Thank you, real detailed guide.