Remote access SSL VPN not working

Question

Hi folks. I am trying to establish a Remote Access VPN tunnel on my newly deployed UTM 9 Home. The configuration for the SSL VPN is pretty straightforward and I've followed all of the instructions that Sophos published here.

The remote browser gives a different error message depending on the browser used, but I found this in the Live Log while trying to connect. I've sanitized the output. 1.1.1.1 is the remote client browser and 2.2.2.2 is the public IP of the UTM.

I'm not sure what the MTU would have to do with anything. Strangely the MTU on my external interface was 576. I upped it to 1475.

10:23-22:20:59 home-utm openvpn[1574]: TCP connection established with [AF_INET]1.1.1.1:2652 (via [AF_INET]2.2.2.2:443)

2016:10:23-22:20:59 home-utm openvpn[1574]: 1.1.1.1:2652 WARNING: Bad encapsulated packet length from peer (5635), which must be > 0 and <= 1563 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...]

2016:10:23-22:20:59 home-utm openvpn[1574]: 1.1.1.1:2652 Connection reset, restarting [0]

2016:10:23-22:20:59 home-utm openvpn[1574]: 1.1.1.1:2652 SIGUSR1[soft,connection-reset] received, client-instance restarting

2016:10:23-22:20:59 home-utm openvpn[1574]: TCP connection established with [AF_INET]1.1.1.1:2317 (via [AF_INET]2.2.2.2:443)

2016:10:23-22:20:59 home-utm openvpn[1574]: 1.1.1.1:2317 WARNING: Bad encapsulated packet length from peer (5635), which must be > 0 and <= 1563 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...]

2016:10:23-22:20:59 home-utm openvpn[1574]: 1.1.1.1:2317 Connection reset, restarting [0]

2016:10:23-22:20:59 home-utm openvpn[1574]: 1.1.1.1:2317 SIGUSR1[soft,connection-reset] received, client-instance restarting

This thread was automatically locked due to age.

zaphod · Accepted Answer

Hi Mike, 
 maybe you run into a bug with mtu size of the external interface. do you use a cable provider? 
 check your mtu of external again. think you cant change it with the webinterface.. 
 in this post there is fix described 
 https://community.sophos.com/products/unified-threat-management/f/hardware-installation-up2date-licensing/80641/sophos-utm-9-407-3-released 
 check that first and check your external mtu then to get a stable connection. after that can check ssl-vpn

BAlfson · Answer

Thanks, Vibhor, that really madee it easy to help you. 
 Since there was no indication in the logs, I anticipated finding a routing problem. I suspect that adding "LR Subnet" to 'Local Networks' in the SSL VPN Profile will cause WebAdmin to create the necessary routes. This will also make firewall rule #4 redundant. 
 I don't think the SNAT has any effect. 
 The "Internal Networks" group must include the "VPN Pool (SSL)" object or another masq rule is needed for it. 
 Firewall rule #2 is redundant if the following conditions are met: 
 
 DNS Forwarders are set correctly 
 The "VPN Pool (SSL) and "LR Subnet" objects are in DNS 'Allowed Networks' 
 'Remote Access >> Advanced' is configured correctly 
 
 Cheers - Bob

MikeJeffers · Answer

I'm such a ding dong. I was able to leverage that thread and disable the MTU auto-discover allowing me to manually set it to 1500 from 576. So that solved many other problems, I'm sure. The error message continued in the LiveLog: WARNING: Bad encapsulated packet length from peer (5635), which must be > 0 and <= 1563 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...] The problem was completely unrelated to MTU. I failed to enable the User Portal. I enabled it and boom.... the SSL VPN answered and I was able to remotely connect.

Remote access SSL VPN not working

Submitted a Tech Support Case lately from the Support Portal?