我正在尝试配置 openvpn，我使用了 OpenVPN 附带的配置和证书/密钥示例。当我使用 UDP 时，它运行良好，但使用 TCP 时则不行
服务器-tls.conf
# OpenVPN config "server-tls.conf"
#
# test using: openvpn –-config server-tls.conf
proto tcp #default
dev tun #default
port 8080 #default
management 127.0.0.1 8080
# Tunnel IP-number plan:
# network: 10.4.0.0/24 all tunnel-endpoints (TEPs)
# IP: 10.4.0.1 server
# IP: 10.4.0.2 server p2p address (not-used)
# IP: 10.4.0.5 client-1 p2p address (not-used)
# IP: 10.4.0.6 client-1
# IP: 10.4.0.9 client-2 p2p address (not-used)
# IP: 10.4.0.10 client-2
# IP: 10.4.0.13 client-3 p2p address (not-used)
# IP: 10.4.0.14 client-3
# etc... This setup allows (2^(32-24)/4)-1=63 clients
server 10.4.0.0 255.255.255.0 # the server Tunnel-IP will be .1
# Maintain a record of client <-> virtual IP address
# associations in this file. If OpenVPN goes down or
# is restarted, reconnecting clients can be assigned
# the same virtual IP address from the pool that was
# previously assigned.
ifconfig-pool-persist ipp.txt
# The 'server' command also established a pool of Tunnel-IPs for the clients (like DHCP)
#route 10.4.0.0 255.255.255.0 # this command is implicit with 'server' command
cd /etc/openvpn/
log /var/log/openvpn.log
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
tls-auth ta.key 0 # Use 0=server, 1=client
verb 3
keepalive 10 60
persist-tun
persist-key
persist-local-ip
comp-lzo
duplicate-cn # needed if all clients use same client.crt/key
# Uncomment following line if you want to allow client-to-client traffic:
# (dont use this option if you want to filter the client-to-client packets via iptables)
#client-to-client
#push "route 10.4.0.0 255.255.255.0" # this is done automatically with client-to-client command (else do specify)
# end of "server-tls.conf"
客户端-tls.conf
# OpenVPN config "client-tls.conf"
#
# run with: openvpn –config client-tls.conf
proto tcp #default
dev tun #default
client
remote x.x.x.x 8080
#cd /etc/openvpn/
#log /var/log/openvpn.log
#log openvpn.log
ca ca.crt
cert client.crt
key client.key
tls-auth ta.key 1 # Use 0=server, 1=client
# Verify that we are connected with the correct server:
tls-remote "Test-Server"
ns-cert-type server
nobind
verb 3
keepalive 10 60
comp-lzo
explicit-exit-notify 2
# end of "client-tls.conf"
服务器日志：
cat /var/log/openvpn.log
Tue Dec 11 17:36:18 2012 OpenVPN 2.2.0 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Jul 4 2011
Tue Dec 11 17:36:18 2012 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:8080
Tue Dec 11 17:36:18 2012 WARNING: --ifconfig-pool-persist will not work with --duplicate-cn
Tue Dec 11 17:36:18 2012 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Tue Dec 11 17:36:18 2012 Diffie-Hellman initialized with 1024 bit key
Tue Dec 11 17:36:18 2012 WARNING: file 'server.key' is group or others accessible
Tue Dec 11 17:36:18 2012 WARNING: file 'ta.key' is group or others accessible
Tue Dec 11 17:36:18 2012 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Tue Dec 11 17:36:18 2012 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Dec 11 17:36:18 2012 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Dec 11 17:36:18 2012 TLS-Auth MTU parms [ L:1544 D:168 EF:68 EB:0 ET:0 EL:0 ]
Tue Dec 11 17:36:18 2012 Socket Buffers: R=[87380->131072] S=[16384->131072]
Tue Dec 11 17:36:18 2012 TCP/UDP: Socket bind failed on local address [undef]: Address already in use
Tue Dec 11 17:36:18 2012 Exiting
客户端日志：
Options error: --explicit-exit-notify can only be used with --proto udp
Use --help for more information.
为什么它在TCP模式下不起作用？
答案1
服务器日志非常清楚地说明了它无法正常工作的原因。
TCP/UDP: Socket bind failed on local address [undef]: Address already in use
您在协议/端口组合上运行了其他程序。您可以通过执行以下操作（相应地更改端口号）来查看它是什么，netstat -nlp | grep 1234然后终止该进程或将其移动到另一个端口。
答案2
我解决了服务器中的问题，将管理端口更改为 openvpn 端口的不同端口。
port 8080
management 127.0.0.1 8081
并且在客户端中删除以下行，因为它在 TCP 模式下不受支持。
explicit-exit-notify 2
答案3
首先，您确定客户端和服务器之间的 TCP 连接正常吗？您可以通过简单地 telnet 到服务器来测试它（确保 OpenVPN 服务器正在运行）：
远程登录 xxxx 8080
如果无法连接，则不是 OpenVPN 的问题，您应该是防火墙之类的问题。端口 8080 有时由 HTTP 服务使用，因此被某些防火墙阻止和/或被某些透明 HTTP 代理拦截。如果您在端口 8080 上遇到 TCP 连接问题，请尝试其他端口 - 可能是端口 1194/tcp，这是 IANA 为 OpenVPN 保留的端口。
如果 telnet 确实连接，则 TCP 连接可能正常，问题可能出在 OpenVPN 上。您应该通过添加一些 OpenVPN 日志来改进您的问题。
顺便问一下，你为什么不坚持使用 UDP 协议呢？你为什么认为你需要 TCP？