This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SSL VPN not working

Hi!

I can't get my SSL-VPN to work, I followed Sophos own guide for setting this up, only changing the port.

See below for settings.

The log outputs the following:

2017:11:10-14:47:05 openvpn[25581]: TCP connection established with [AF_INET]x.x.x.x:54078 (via [AF_INET]x.x.x.x:4443)
2017:11:10-14:47:05 openvpn[25581]: x.x.x.x:54078 WARNING: Bad encapsulated packet length from peer (5635), which must be > 0 and <= 1607 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...]
2017:11:10-14:47:05 openvpn[25581]: x.x.x.x:54078 Connection reset, restarting [0]
2017:11:10-14:47:05 openvpn[25581]: x.x.x.x:54078 SIGUSR1[soft,connection-reset] received, client-instance restarting

ssl-vpn-profile:

ssl-vpn-settings:

ssl-vpn-advanced:

What could be causing this issue?

The user-portal is enabled.

Thanks in advance!

This thread was automatically locked due to age.

Parents

0 giomoda over 7 years ago

Your config looks good. Try changing "protocol" on "settings" tab to UDP and redownload the VPN configuration.

Also, how is your WAN connected? Do you have a routable IP on the WAN interface or are you receiving a private IP and setting up a DMZ o your modem/router forwarding everything to the UTM?

Regards,

Giovani
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 giomoda over 7 years ago

Your config looks good. Try changing "protocol" on "settings" tab to UDP and redownload the VPN configuration.

Also, how is your WAN connected? Do you have a routable IP on the WAN interface or are you receiving a private IP and setting up a DMZ o your modem/router forwarding everything to the UTM?

Regards,

Giovani
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 EricNilsson over 7 years ago in reply to giomoda

Tried changing from TCP to UDP, it makes no difference.

I have a routable IP-address on the WAN interface connected directly to the ISPs router.
Cancel
Vote Up 0 Vote Down

Cancel
0 Ole Heydt over 7 years ago in reply to EricNilsson

You could try to enter your public IP into the "override hostname" field.

Some problems can be solved by that.

Regards,

Ole
Cancel
Vote Up 0 Vote Down

Cancel
0 giomoda over 7 years ago in reply to EricNilsson

Well, then it's most likely an MTU issue. Try lowering the MTU on the WAN interface to something like 1350 and see if it helps.

Regards,

Giovani
Cancel
Vote Up 0 Vote Down

Cancel
0 DouglasFoster over 7 years ago in reply to giomoda

I think you have the right idea but the wtong Interface

VPN adds overhead to each packet, so you want a smaller MTU on LAN than on WAN, to avoid fragmentstion.
Cancel
Vote Up 0 Vote Down

Cancel
0 EricNilsson over 7 years ago in reply to DouglasFoster

Thank you for all your replies!

Unfortunately nothing works.

I tried changing the MTU on both LAN and WAN interface in the following combinations:
WAN: 1400, LAN: 1500.
WAN: 1350, LAN: 1500
WAN: 1500, LAN: 1350
WAN: 1500, LAN: 1400
WAN: 1350, LAN: 1350
WAN: 1400, LAN: 1400

Also tried overriding the hostname in SSL VPN settings, didn't work.
I still get the same error messages as I originally posted.

What is wrong or what did I do wrong?
Cancel
Vote Up 0 Vote Down

Cancel