Help using Stunnel

[psil0cybe 0]

I get this error: C:\Users\Administrator>openvpn "AirVPN - SSL AirVPN_CA-Cephei_SSL-443.ovpn" Options error: In [CMD-LINE]:1: Error opening configuration file: AirVPN - SSL AirVPN_CA-Cephei_SSL-443.ovpn Use --help for more information when trying to connect using Stunnel. I believe it's the wrong file name according to another post here on these forums regarding Stunnel but can't figure out the proper file name. Please help by posting the commands verbatim.

 

Thanks.

[retiredpilot 6]

In addition to the OP's very valid question, I would like to add another.  Your webpage says that SSL/stunnel will/should be available soon via your windows client.  Is there a timetable for soon?  I have been wanting this available for when I travel but have been holding off thinking that your windows client is going to be released with it ready to go.  Just a rough idea would be nice.

 

I am also stuck on the exact command line to enter.  I am using your portable stunnel and it appears to be working correctly.

 

Paste from my stunnel log:

 

2013.12.30 16:25:53 LOG5[3712:2712]: stunnel 4.53 on x86-pc-mingw32-gnu platform
2013.12.30 16:25:53 LOG5[3712:2712]: Compiled/running with OpenSSL 0.9.8s-fips 4 Jan 2012
2013.12.30 16:25:53 LOG5[3712:2712]: Threading:WIN32 SSL:+ENGINE+OCSP+FIPS Auth:none Sockets:SELECT+IPv6
2013.12.30 16:25:53 LOG5[3712:2712]: Reading configuration from file stunnel.conf
2013.12.30 16:25:53 LOG5[3712:2712]: FIPS mode is enabled
2013.12.30 16:25:53 LOG6[3712:2712]: Initializing service section [openvpn]
2013.12.30 16:25:53 LOG5[3712:2712]: Configuration successful

 

As an example I used the config generator and got this file: AirVPN_NL-Ophiuchi_SSL-443 along with the one I renamed to stunnel.conf.

 

For some reason I am not grasping the command line to type and I am using it in Admin mode.

 

As you can see you will be helping TWO members here immediately if you can clarify this for us.

 

 

 

note;  I did not delete the Air client or re-install openvpn.  I am assuming that stunnel finds it fine as the log above indicates.  By leaving the Air client I should easily be able to simply use SSL/stunnel for those times I am traveling and wondering about the ISP where I am.

[psil0cybe 0]

I get this error: C:\Users\Administrator>openvpn "AirVPN - SSL AirVPN_CA-Cephei_SSL-443.ovpn" Options error: In [CMD-LINE]:1: Error opening configuration file: AirVPN - SSL AirVPN_CA-Cephei_SSL-443.ovpn Use --help for more information when trying to connect using Stunnel. I believe it's the wrong file name according to another post here on these forums regarding Stunnel but can't figure out the proper file name. Please help by posting the commands verbatim.

 

Thanks.

No one wants to help?

[OpenSourcerer 1441]

No one wants to help?

I get this error: C:\Users\Administrator>openvpn "AirVPN - SSL AirVPN_CA-Cephei_SSL-443.ovpn" Options error: In [CMD-LINE]:1: Error opening configuration file: AirVPN - SSL AirVPN_CA-Cephei_SSL-443.ovpn Use --help for more information when trying to connect using Stunnel. I believe it's the wrong file name according to another post here on these forums regarding Stunnel but can't figure out the proper file name. Please help by posting the commands verbatim.

 

Thanks.

 

No one can.

Where is the .ovpn file saved? Try to rename it not using spaces and edit the command accordingly.

[amnesty 18]

I haven't been in the Forum in a while so this might be too late...

 

You can run the OpenVPN Gui (wrapper) and select the SSL .ovpn

 

or from a command line:

 

 

The %program files%\OpenVPN\bin directory is in your path but the .\config directory is not.

 

where %program files% = your program files directory, where ever that may be.

 

Run openvpn "AirVPN - SSL AirVPN_CA-Cephei_SSL-443.ovpn" from the directory your .ovpn file is located

 

So if it is in the .\config directory, you could create a batch file like this:

 

@echo off

c:

cd\%program files%\openvpn\config

openvpn "AirVPN - SSL AirVPN_CA-Cephei_SSL-443.ovpn"

[secure1 1]

SOB!  I guess Comcast was throttling me too. 

 

I normally get 10 up / 55 down with no VPN, but was getting 9up /5-10 down using airVPN. : I just bought an annual sub the other day and was thinking I made a big mistake because of the speeds.   I've been pulling my hair out for the last two days over this. 

 

I saw this thread and gave stunnel a try.  I got 7up/46down using stunnel!

 

FYI... I thought the web site directions were a bit confusing as well. The filename with the spaces makes it look like - SSL is an option to stunnel

 

Here's what I did

The configurator gave me two files in a zip

AirVPN_US-Alkaid_SSL-443.ovpn

AirVPN_US-Alkaid_SSL-443.ssl

 

I downloaded stunnel portable to my desktop and it unzipped there

I renamed the "AirVPN_US-Alkaid_SSL-443.ssl" file to stunnel.conf in that directory

double-clicked stunnel.exe

it started and minimized to the system tray

 

I copied the "AirVPN_US-Alkaid_SSL-443.ovpn" file to the c:\program files\openvpn\config directory

opened cmd.exe as administrator

cd c:\program files\openvpn\config

run "openvpn "AirVPN_US-Alkaid_SSL-443.ovpn"

 

All good now with speed. Hopefully this can be integrated into the client.

[secure1 1]

It appears this only happens for port 443 with my comcast connections.  I gave 53 udp a try and it works fine; awesome speed.  Would have been much less work to try that first

[pfSense_fan 181]

SOB!  I guess Comcast was throttling me too. 

 

I normally get 10 up / 55 down with no VPN, but was getting 9up /5-10 down using airVPN. : I just bought an annual sub the other day and was thinking I made a big mistake because of the speeds.   I've been pulling my hair out for the last two days over this. 

 

 

 

I can confirm this, connections to BOTH Chicago servers are throttled. I normally get 54-60 down.... only can manage a rock solid 5 down on UDP 443.  Got 50 on TCP SSL. Upload speeds seem unaffected.

 

I first noticed this 6 or more months ago, but thought it was something on my end.

[Staff 10014]

No one wants to help?

 

I get this error: C:\Users\Administrator>openvpn "AirVPN - SSL AirVPN_CA-Cephei_SSL-443.ovpn" Options error: In [CMD-LINE]:1: Error opening configuration file: AirVPN - SSL AirVPN_CA-Cephei_SSL-443.ovpn Use --help for more information when trying to connect using Stunnel. I believe it's the wrong file name according to another post here on these forums regarding Stunnel but can't figure out the proper file name. Please help by posting the commands verbatim.

 

Thanks.

 

Hello!

 

The file "C:\Users\Administrator\AirVPN - SSL AirVPN_CA-Cephei_SSL-443.ovpn" does not exist. Either it is in some other directory, the name is wrong or both. Type the command dir to display the files in the command prompt current working directory. Use the command cd to change the current working directory. Note that our Configuration Generator does not generate files with that name. The correct name should be

"AirVPN_CA-Cephei_SSL-443.ovpn"

 

Kind regards

[codscratcher 0]

I have generated an .ovpn file set to use the udp port 53 - can anyone walk me through what I need to do to use this type of setting??

 

I have tried a .bat and .ovpn for another server using two cmd windows (one as administrator) as previously advised - is it something similar I need to be doing??

 

thanks

[amnesty 18]

If you are trying to run OpenVPN on UDP port 53 try this:

Copy you .ovpn file in %Program Files%\openvpn\config
Execute the 'OpenVPN GUI' with administrative rights (openvpn-gui.exe, not openvpn.exe)
Right-click 'OpenVPN GUI' in System Tray (gray monitor with lock)
Go to < your AirVPN_config-file_53 > Select 'Connect'
The Status window should open during connection process.
You are connected when the 'OpenVPN GUI' icon turns green.
You are not connected when the 'OpenVPN GUI' icon turns yellow or gray.
Gray just means you are not connected, yellow means you are not connected and it is trying to connect.
If either happens unexpectedly, check the log file.


If you are trying to run OpenVPN over SSL  (stunnel) , (once stunnel is installed/configured and ovpn file is in config directory) this is easier than the batch file:

Execute 'stunnel' (worked as a Power User. I do not logon with Administrative rights)
An 'stunnel' icon should appear on System Tray (blue - if you hover over it, it should say, 'Server is idle'.
Run OpenVPN GUI with admin rights
Right-click 'OpenVPN GUI' in System Tray (gray monitor with lock) >
Go to < AirVPN_config-file_SSL-443 > Select 'Connect'
You are connected when the 'OpenVPN GUI' icon turns green.

[codscratcher 0]

Amnesty.. thanks for the answer - I have just got back from holiday so did not see your reply till today!  I will work through your answer and hopefully get sorted.  I will let you know how I get on!  Thanks again for taking the time to reply.

[codscratcher 0]

okay... I am still having problems trying to connect via SSL.  I followed instructions and had Stunnel working for a couple of days now all I can get is the openvpn window staying yellow and the following message:

 

Sun Sep 07 15:36:51 2014 OpenVPN 2.3.4 x86_64-w64-mingw32 [sSL (OpenSSL)] [LZO] [PKCS11] [iPv6] built on Aug  7 2014

Sun Sep 07 15:36:51 2014 library versions: OpenSSL 1.0.1i 6 Aug 2014, LZO 2.05

Sun Sep 07 15:36:51 2014 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340

Sun Sep 07 15:36:51 2014 Need hold release from management interface, waiting...

Sun Sep 07 15:36:52 2014 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340

Sun Sep 07 15:36:52 2014 MANAGEMENT: CMD 'state on'

Sun Sep 07 15:36:52 2014 MANAGEMENT: CMD 'log all on'

Sun Sep 07 15:36:52 2014 MANAGEMENT: CMD 'hold off'

Sun Sep 07 15:36:52 2014 MANAGEMENT: CMD 'hold release'

Sun Sep 07 15:36:52 2014 Control Channel Authentication: tls-auth using INLINE static key file

Sun Sep 07 15:36:52 2014 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication

Sun Sep 07 15:36:52 2014 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication

Sun Sep 07 15:36:52 2014 Socket Buffers: R=[8192->8192] S=[8192->8192]

Sun Sep 07 15:36:52 2014 Attempting to establish TCP connection with [AF_INET]127.0.0.1:1413

Sun Sep 07 15:36:52 2014 MANAGEMENT: >STATE:1410100612,TCP_CONNECT,,,

Sun Sep 07 15:36:52 2014 TCP connection established with [AF_INET]127.0.0.1:1413

Sun Sep 07 15:36:52 2014 TCPv4_CLIENT link local: [undef]

Sun Sep 07 15:36:52 2014 TCPv4_CLIENT link remote: [AF_INET]127.0.0.1:1413

Sun Sep 07 15:36:52 2014 MANAGEMENT: >STATE:1410100612,WAIT,,,

Sun Sep 07 15:37:52 2014 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)

Sun Sep 07 15:37:52 2014 TLS Error: TLS handshake failed

Sun Sep 07 15:37:52 2014 Fatal TLS error (check_tls_errors_co), restarting

Sun Sep 07 15:37:52 2014 SIGUSR1[soft,tls-error] received, process restarting

Sun Sep 07 15:37:52 2014 MANAGEMENT: >STATE:1410100672,RECONNECTING,tls-error,,

Sun Sep 07 15:37:52 2014 Restart pause, 5 second(s)

Sun Sep 07 15:37:57 2014 Socket Buffers: R=[8192->8192] S=[8192->8192]

Sun Sep 07 15:37:57 2014 Attempting to establish TCP connection with [AF_INET]127.0.0.1:1413

Sun Sep 07 15:37:57 2014 MANAGEMENT: >STATE:1410100677,TCP_CONNECT,,,

Sun Sep 07 15:37:57 2014 TCP connection established with [AF_INET]127.0.0.1:1413

Sun Sep 07 15:37:57 2014 TCPv4_CLIENT link local: [undef]

Sun Sep 07 15:37:57 2014 TCPv4_CLIENT link remote: [AF_INET]127.0.0.1:1413

Sun Sep 07 15:37:57 2014 MANAGEMENT: >STATE:1410100677,WAIT,,,

 

after getting quite good speeds before I am gutted now to only be getting 1 to 2 mbps speeds via udp - there must surely be a better/easier way to connect and get decent speeds??  This is giving me sleepless nights (no joke!) PLEASE someone give me a hand with this?

[Diraj 1]

There seem to be a problem with SSL connections at the moment. So it is probably not due to a bad configuratiom from your end. Hopefully in a couple of days it will work again.

[Staff 10014]

There seem to be a problem with SSL connections at the moment. So it is probably not due to a bad configuratiom from your end. Hopefully in a couple of days it will work again.

 

Hello!

 

We confirm it. In the last hours we have solved the problem with OpenVPN over SSL in 25 servers. If you find anything wrong, please feel free to report the name of the server not accepting OpenVPN over SSL connections.

 

Kind regards

[amnesty 18]

 

after getting quite good speeds before I am gutted now to only be getting 1 to 2 mbps speeds via udp - there must surely be a better/easier way to connect and get decent speeds??  This is giving me sleepless nights (no joke!) PLEASE someone give me a hand with this?

 

I didn't get the TLS error.

 

Generally (theoretically) there will be more latency (slower speeds) using VPN over SSH, then VPN over SSL, then VPN using TCP. then VPN using UDP. It really depends on the end-users' environment including (but not completely) the circuit (ISP speed).

 

You can try running VPN over SSL a few ways:

 

A - You can try the AirVPN client v-2.4 beta code name Eddie

https://airvpn.org/topic/12067-eddie-24beta-available/?p=19651

 

B - If you'd like to use the stable version of OpenVPN with stunnel try B (the 2nd option) below.

 

 

A-  Install AirVPN client v-2.4 beta

 

1- From Overview tab, login.

 

2- If you prefer certain servers, from the Countries or Servers tab, select your prefered connections.

 

3- From AirVPN dropdown (upper-left), select Preferences

 

4- From the Protocols tab, select the SSL Tunnel Port 443 radio button

 

5- You may want to customize the Advanced option

https://airvpn.org/faq/software_advanced/

 

That's a little beyond the scope of this thread.

 

 

 

B - It looks like AirVPN's portable, terminal version of stunnel is verion 5.01

 

From the Config Generator >

 

1. Select OS

 

2. Select Single Server (cannot use country, continent)

 

3. Connection Modes > Advanced, SSL Tunnel > port 443 (*)

 

4. Terms of Service >

Check, I have read and I accept the Terms of Service

Check, I HEREBY EXPLICITLY ACCEPT POINTS 8, 10, 11

 

5. Select Generate button

 

6. Download both (Single Files) or an archive

 

7. If you downloaded an archive, extract the archive.

 

8. Rename your AirVPN <..> - SSL <..>.ssl to AirVPN <..> - SSL <..>.ssl.conf

ie. AirVPN_DE-Velorum_SSL-443.ssl to AirVPN_DE-Velorum_SSL-443.conf

 

9. Copy your .conf file into the directory where stunnel is running from.

note: Don't forget, if you change servers you need to change this file as well.

 

10. Copy your AirVPN <..> - SSL <..>.ovpn to your OpenVPN config directory

ie. copy AirVPN_DE-Velorum_SSL-443.ovpn "c:\Program Files\OpenVPN\config\AirVPN_DE-Velorum_SSL-443.ovpn"

 

11. Execute 'stunnel' (works as a Power User)

An 'stunnel' icon should appear on System Tray (blue - if you hover over it, it should say, 'Server is idle'.

 

12. Run OpenVPN GUI with admin rights

Right-click 'OpenVPN GUI' in System Tray (gray monitor with lock) >

Go to < AirVPN_config-file_SSL-443 > Select 'Connect'

 

You are connected when the 'OpenVPN GUI' icon turns green.

 

If you are not satisfied with the speeds, try other types of connections and/or ports.

 

I didn't sit down and try these. So if I missed something, please let me know so I am not sending people down the wrong path.

 

[codscratcher 0]

Guys... thanks for taking the time to help!!  I will be logging in over the next couple of days using some of the info above!

 

While I am here what is the preferred connection method that gives the best results (speed)??

[Staff 10014]

 

Guys... thanks for taking the time to help!!  I will be logging in over the next couple of days using some of the info above!

 

While I am here what is the preferred connection method that gives the best results (speed)??

 

Hello!

 

Assuming that there's no traffic shaping or any other discrimination against UDP or OpenVPN itself, the most efficient mode is OpenVPN direct in UDP for sure.

 

Kind regards

[Kawsarazim 0]

Hi
im facing sleep mode issues on my openconnect apps Android version, when i connected with ssl, if screen turn off after 3 or 5 minutes vpn going to sleep mode so if anyone can solve it please reply to me Email itsebasoft@gmail.com