0

I work for a small company that has an off-site Windows 2012 server which hosts two other virtual servers via VirtualBox; one of these is an Ubuntu 12.04 server which runs OpenVPN. The set-up was configured before I joined the company, and the previous tech guy has since left.

I got news this morning that users cannot connect to our VPN. I confirmed from my own PC that connection to the VPN was being refused (AUTH_FAILED - it is configured to authenticate against active directory on the Win2012 server and I triple-checked my credentials are correct).

I suspected the failure may have been due to the recent Heartbleed bug and that any updated OpenVPN clients might require the host be updated too, so I logged into the Ubuntu server and issued "sudo apt-get update" and "sudo apt-get upgrade" - OpenVPN was one of the packages to get updated.

I issued a "sudo reboot" on the Ubuntu server and tried to connect via OpenVPN again but it still fails (AUTH_FAILED).

I then suspected that because the server and clients had been updated that I might need to issue everyone new certificates (though I hope this won't be necessary!), so I tried to administer OpenVPN users & certificates via webmin... however, opening the webmin web-interface also failed (connection timed out on "https :// (ubuntu-server-ip) :10000"). I have issued a "sudo service webmin restart" and it reports "Stopping Webmin server in /usr/share/webmin", "Starting Webmin server in /usr/share/webmin", "Pre-loaded WebminCore"; but further attempts to connect from the the Win2012 host PC still time out (I have also temporarily disabled the firewall and tried different browsers, but the results are the same)

Both of these services were working fine when I last tried a few weeks ago, and no-one has made any manual changes to the server settings in the intervening time.

Any ideas what might have caused these issues, and what I can do to fix them?

  • The update process which I described above was not sufficient to update OpenVPN to v233, I needed to add swupdate.openvpn.net to my sources.list and then issue 'apt-get update && apt-get install openvpn' - so I'm now running v233 but the AUTH_FAILED issue still remains – Martin Apr 24 '14 at 9:08
  • I issued the following command "cat /var/log/syslog | grep VPN" and found the following "LDAP bind failed immediately: Can't contact LDAP server", "Unable to bind as CN=.....", "LDAP connect failed." The OpenVPN & ldap configurations have not been manually changed and everything was working fine two weeks ago; given that we're also experiencing timeout errors with Webmin I think this might come down to VirtualBox network issues... but I'm stuck for ideas at this point - any suggestion how I can diagnose further? – Martin Apr 24 '14 at 10:02
0

I eventually found the problem was the virtualbox host-only network adapter on Windows 2012 had reverted to its default ip address (though I'm not sure why), so the ubuntu guest which had a public ip on eth0 (bridged) and local ip on eth1 (host-only) could no longer communicate via eth1 and as such could accept connection requests via the public IP but could not make a ldap binding via eth1 in order to authenticate users - hence the AUTH_FAILED messages. This is also why I could not access the webmin interface from the host server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.