VPN - test cases - client to site, site to site.

[RemoveByFriction]

Dear users of forum,

Have you met with the OpenVPN configuration, which will allow you to switch automatically
conneciont from the udp tunnel to tcp?
I note that I do not mean to make that with OpenVPN Access Server.
The issue is that I would like to have such a configuration applies to restrictive firewalls.
The idea is that if it is impossible to make vpn tunel using UDP,
automatically the client try to create a connection on TCP port 443.

 

[eibgrad]

You can use the remote directive to define additional possible OpenVPN servers you're interested in.

remote 199.199.199.199 udp 5353
remote 188.188.188.188 tcp 443
...

Just add it to the Custom Config field. The OpenVPN client will traverse the list, in order, until it gets a connection. If that fails, it returns to the top and tries again. Ad infinitum.

But this only works if those servers are configured w/ the same CA cert, client certs and keys, etc. Sometimes that's the case (e.g. PIA), sometimes NOT (e.g., NordVPN).

 

[Marin]

You can use the remote directive to define additional possible OpenVPN servers you're interested in.

remote 199.199.199.199 udp 5353
remote 188.188.188.188 tcp 443
...

Just add it to the Custom Config field. The OpenVPN client will traverse the list, in order, until it gets a connection. If that fails, it returns to the top and tries again. Ad infinitum.

But this only works if those servers are configured w/ the same CA cert, client certs and keys, etc. Sometimes that's the case (e.g. PIA), sometimes NOT (e.g., NordVPN).

I am assuming the 199.xxx.....are IP’s of the VPN servers.

Also if there are more VPN servers available (and provided that CA certs/keys/etc are the same)-could your Custom Configuration lines be modified to this?

 remote 103.86.96.100 udp 1194
remote 103.86.96.100 tcp 443
remote 103.86.99.100 udp 1194
remote 103.86.99.100 tcp 443

Sent from my iPhone using Tapatalk

 

[eibgrad]

Yes to both questions.

 

[eibgrad]

Additional tip.

If you add the server-poll-timeout directive to Custom Config as well, then you can control how long to wait for a response from the current remote before moving on to the next one.

server-poll-timeout 10

In the above example, I've instructed the OpenVPN client to only wait 10 secs before moving on to the next remote. This can very handy given the OpenVPN client might wait as much as a minute (by default) before giving up on the current remote.