search

MicrosoftDocs / azure-docs

Open source documentation of Microsoft Azure
https://docs.microsoft.com/azure
Creative Commons Attribution 4.0 International
10.31k stars 21.49k forks source link

OpenVPN 2.6 client can't connect to Azure Virtual Network Gateway Point-to-Site VPN - Connection Reset #104854

Closed itstrategic-gh closed 1 year ago

itstrategic-gh commented 1 year ago

We are experiencing issues connecting to the Azure VNG OpenVPN (SSL) Point-To-Site VPN after updating the OpenVPN client to version2.6.0 on Windows clients

Client details:

image

Connection log (redacted):

Tue Feb  7 10:31:13 2023 Note: ovpn-dco-win driver is missing, disabling data channel offload.
Tue Feb  7 10:31:13 2023 OpenVPN 2.6.0 [git:v2.6.0/b999466418dddb89] Windows-MSVC [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] [DCO] built on Jan 25 2023
Tue Feb  7 10:31:13 2023 Windows version 10.0 (Windows 10 or greater), amd64 executable
Tue Feb  7 10:31:13 2023 library versions: OpenSSL 3.0.7 1 Nov 2022, LZO 2.10
Tue Feb  7 10:31:13 2023 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25344
Tue Feb  7 10:31:13 2023 Need hold release from management interface, waiting...
Tue Feb  7 10:31:13 2023 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:20365
Tue Feb  7 10:31:13 2023 MANAGEMENT: CMD 'state on'
Tue Feb  7 10:31:13 2023 MANAGEMENT: CMD 'log on all'
Tue Feb  7 10:31:13 2023 MANAGEMENT: CMD 'echo on all'
Tue Feb  7 10:31:13 2023 MANAGEMENT: CMD 'bytecount 5'
Tue Feb  7 10:31:13 2023 MANAGEMENT: CMD 'state'
Tue Feb  7 10:31:13 2023 MANAGEMENT: CMD 'hold off'
Tue Feb  7 10:31:13 2023 MANAGEMENT: CMD 'hold release'
Tue Feb  7 10:31:19 2023 MANAGEMENT: CMD 'username "Auth" "xxxxx.xxxxxx"'
Tue Feb  7 10:31:19 2023 MANAGEMENT: CMD 'password [...]'
Tue Feb  7 10:31:19 2023 Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Tue Feb  7 10:31:19 2023 Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Tue Feb  7 10:31:19 2023 MANAGEMENT: >STATE:1675726279,RESOLVE,,,,,,
Tue Feb  7 10:31:19 2023 TCP/UDP: Preserving recently used remote address: [AF_INET]xxx.xxx.xxx.xxx:443
Tue Feb  7 10:31:19 2023 Socket Buffers: R=[65536->65536] S=[65536->65536]
Tue Feb  7 10:31:19 2023 Attempting to establish TCP connection with [AF_INET]xxx.xxx.xxx.xxx:443
Tue Feb  7 10:31:19 2023 MANAGEMENT: >STATE:1675726279,TCP_CONNECT,,,,,,
Tue Feb  7 10:31:19 2023 TCP connection established with [AF_INET]xxx.xxx.xxx.xxx:443
Tue Feb  7 10:31:19 2023 TCPv4_CLIENT link local: (not bound)
Tue Feb  7 10:31:19 2023 TCPv4_CLIENT link remote: [AF_INET]xxx.xxx.xxx.xxx:443
Tue Feb  7 10:31:19 2023 MANAGEMENT: >STATE:1675726279,WAIT,,,,,,
Tue Feb  7 10:31:19 2023 MANAGEMENT: >STATE:1675726279,AUTH,,,,,,
Tue Feb  7 10:31:19 2023 TLS: Initial packet from [AF_INET]xxx.xxx.xxx.xxx:443, sid=83ee9c91 06a05be5
Tue Feb  7 10:31:19 2023 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Tue Feb  7 10:31:19 2023 Connection reset, restarting [0]
Tue Feb  7 10:31:19 2023 SIGUSR1[soft,connection-reset] received, process restarting
Tue Feb  7 10:31:19 2023 MANAGEMENT: >STATE:1675726279,RECONNECTING,connection-reset,,,,,

Document Details

⚠ Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.

ManoharLakkoju-MSFT commented 1 year ago

@itstrategic-gh Thanks for your feedback! We will investigate and update as appropriate.

ManoharLakkoju-MSFT commented 1 year ago

@itstrategic-gh It would be great if you could add a link to the documentation you are following for these steps? This would help us redirect the issue to the appropriate team. Thanks!

itstrategic-gh commented 1 year ago

https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-openvpn

Akhisar commented 1 year ago

We too faced similar issue and restriction is documented as per Azure support. A fix would be very much appreciated.

FYR: https://learn.microsoft.com/en-us/azure/virtual-wan/howto-openvpn-clients#windows


Download and install the OpenVPN client (version 2.4 or higher) from the official OpenVPN website. Version 2.6 is not yet supported.```
cherylmc commented 1 year ago

Updated - 2.6 isn't yet supported. #please-close

InDoNax commented 9 months ago

Are there any plans to support the newer versions of OpenVPN?

Sylphe88 commented 1 month ago

OpenVPN is moving on and 2.6 has been out for almost 2 years (let alone the 3.x version for macOS...) and users at my company are really asking why we're stuck with an old client version. Any news?

JustinGrote commented 2 weeks ago

For anyone coming here like me, these docs are out of date. OpenVPN connect 3+ works just fine, here is mine working with ca-based cert auth image

Here's the proper docs: https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-vpn-client-certificate-windows-openvpn-client-version-3

To be clear this is for Virtual Network Gateway, I think Virtual WAN may still have these restrictions.