Decrypting OPENVPN?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Decrypting OPENVPN?

L2 Linker

Is it possible to decrypt openVPN with SSL Forward Proxy? I'm pretty sure the asnwer is no, but I figured I would ask.

 

My problem is that I have a Ubuntu Server running openVPN client behind a VM-100. I would like to continue to use openVPN, but I would like to intercept it, apply some policy on the decrypted traffic and re-encrypt. The server I basically uses:

  • sudo openvpn --config VPN_UDP-443.ovpn

Has anyone done something similar? One option (unfortunately non existent) would be implementing a opnVPN client direclty on the VM-100 and have my server just use that as the gateway... but that would be too easy! 🙂

 

Thanks!

4 REPLIES 4

Cyber Elite
Cyber Elite

Technically possible; sure.

That being said OpenVPN uses a custom encryption set and I doubt they are going to tell you what that is so that you can actually decrypt it properly. 

Yes, but the client is using an openVPN config file, which should have all that info (i.e. the .ovpn file). I can access that file... but I'm not sure what I would be looking for.

Right but your config file isn't going to show you the negotiated key; which is needed to actually intercept and reencrypt the traffic. 

Actually, I do have all the info in the config file... unfortunately I don't know how to use it though:

client
dev tun
proto udp
remote vpn.vpn.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
cipher AES-256-CBC
comp-lzo no
route-delay 5
verb 3
explicit-exit-notify 5
<ca>
-----BEGIN CERTIFICATE-----
MIIGVDCCBDygAwIBAgIJAIzYQ+/kXyADMA0GCSqGSIb3DQEBBQUAMHkxCzAJBgNV
.
.
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
MIIGnDCCBISgAwIBAgICRaAwDQYJKoZIhvcNAQEFBQAweTELMAkGA1UEBhMCSVQx
.
.
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN RSA PRIVATE KEY-----
MIIJKAIBAAKCAgEA4hKsIsb3x4LJlYL35XivJr8FE/ak47OJbmZRfXB0l5jkLqc/
.
.
.
-----END RSA PRIVATE KEY-----
</key>
key-direction 1
<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
7bb7a23a0f5f28d01e792df68f1764ab
.
.
.
-----END OpenVPN Static key V1-----
</tls-auth>

I removed the actual key, but as you can see, it is actually there on the .ovpn file.

  • 3858 Views
  • 4 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!