Thought I would post this one quickly…

Having trouble getting OpenVPN to start/work for you and you are seeing this error in your logs?

“TCP/UDP: Socket bind failed on local address”

The resolution is pretty simple. Try changing the port you have assigned to openVPN in your config file and restarting the service. Most likely you have bound it to a port already being used by another service. I ran into this problem because I tried to use port 443. I wasn’t running an SSL/HTTPS website on my server but what I had forgotten that I was running SSH through 443 temporarily.

It is generally good practice to use a port above 1000 for odd services if you aren’t using the default port for said service. I run into this a lot as I don’t like to use common ports as they tend to get targeted more often and hammered by bots/evil people trying to break in…

Anyhow, hope this helps!

I am not sure when OpenVPN added multi-factor support to their Access Server but I am thrilled that they did. It must have been recently (within the last few weeks or months) as I was using OpenVPN Access Server about 4 months ago as a temporary solution while my main solution was down and it did not have Multi-Factor built-in. All I have to say is, THANK YOU! (more…)

In a previous post I dealt with setting up an OpenVPN Community Edition server which is the free version of OpenVPN. I had initially hoped to use Authy for two-factor authentication in addition to LDAP but later found out that wasn’t going to work. So now I am looking at using DUO for two-factor authentication and OpenVPN Access Server.

Access Server is the “paid” version of OpenVPN and is significantly easier to install and configure vs. the open-source community edition. The two different products fulfill the same function and rely on the same technology to do so, but the underlying structure of Access Server is significantly different from the community edition.

Just to be clear, if you don’t need two-factor authentication, and don’t mind applying a bit of digital elbow grease, I highly recommend going with the community edition of OpenVPN as it is extremely scalable with no licensing fees. That being said, Access Server is decently economical, especially compared to putting in a hardware device like a Fortigate or Cyberroam UTM box.

This guide assumes you have an Ubuntu 13 box to work with, have full root access, know your way around the linux command-line, and have a basic understanding of networking concepts including VPN.

Let’s dive in!

Before you go any further, if you plan on using LDAP/Microsoft Active Directory, you need to make sure all of the proper ports are open between your Active Directory Domain Controller and your OpenVPN server. You can see which ports are needed for AD traffic here: What ports on the firewall should be open between Domain Controllers and Member Servers?

(more…)

After having already gotten a full page into writing a walkthrough (not to mention hours already spent with Authy) I found out that Authy will NOT WORK with OpenVPN and LDAP authentication unless the folks at Authy customize the ldap module for you. Which requires enterprise support, at a retail price of $500/month! Which was quoted to me at a “discounted” rate of $350/month. I really appreciate what the folks at authy are trying to build and they have a decent product on their hands but it was a bit frustrating that they advertise working LDAP authentication when in fact it requires their dev team to get in and hack the code for you. I am now trying DUO with OpenVPN Access Server and hoping for better results… This is not going to be free but will at the least only run us somewhere between $75 – $350/ YEAR… considerably more affordable…

INTRODUCTION

I wrestled with getting OpenVPN to work with Microsoft Active Directory authentication better part of 2 days. I was surprised that it was so hard to find a straightfoward tutorial on the topic that actually worked! I had to do a lot of Google-Fu and look at many different pages to put together what I needed to get this done. So… to hopefully save myself and others some future headache. I endeavor to put most of it all together here. This guide assume a few things about the audience though that you should know up front…
(more…)