OpenVPN: connection problems / ssh_exchange_identification: read: Connection reset by peer [closed] - http

Question

Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.
Closed 5 years ago.
Improve this question
I've got issues with OpenVPN and SSH (and other services):
I can connect to the VPN without any error messages.
If I then want to connect to a computer inside the VPN via SSH i get the error: "ssh_exchange_identification: read: Connection reset by peer".
On which machine this problem occurs differs from day to day and connection to connection.
$ ssh root#storage -vvv
OpenSSH_6.9p1, OpenSSL 1.0.1k-fips 8 Jan 2015
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 56: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to storage [192.168.1.5] port 22.
debug1: Connection established.
debug1: identity file /home/ewald/.ssh/id_rsa type 1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ewald/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ewald/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ewald/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ewald/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ewald/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ewald/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ewald/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.9
ssh_exchange_identification: read: Connection reset by peer
If I can connect to a different machine inside the VPN, I can SSH to my target.
Also I tried to configure a Port Forwarding for port 22 on the Remote Router and conected from my client very often via this forwarding and it always worked, so I don't think the problem is the SSH server or client configuration.
So I tried many settings in the OpenVPN configuration (different link-mtus, tcp instead of udp, disabled lzo, ...), installed it on a different machine (default OpenVPN server is in an Ubuntu 12.04 VM. I tried to install it on bare metal too) and nothing changed.
Since the problem appeared the first time even the ISP was changed (from DSL to Fiber).
The problem exists with other client machines too: A macbook using viscosity (tunnelblick doesn't work either), several linux boxes: fedora, ubuntu, ...
Sometimes I also don't receive an answer from the HTTP-server (even when I can connect to it using SSH)
The HTTP-server itself is accessible from the internal network and via my SSH-tunnel (using it as SOCKS proxy), so the problem must be the OpenVPN connection.
Can anyone help me? How can i check, if there are problems with the connection itself?
TCP-dump:
$ sudo tcpdump -i tun0 dst port 22
15:56:17.689847 IP myclient.60920 > storage.ssh: Flags [S], seq 729708226, win 29200, options [mss 1460,sackOK,TS val 3108117687 ecr 0,nop,wscale 7], length 0
15:56:17.717556 IP myclient.60920 > storage.ssh: Flags [.], ack 2044707578, win 229, options [nop,nop,TS val 3108117714 ecr 1518717699], length 0
15:56:17.717949 IP myclient.60920 > storage.ssh: Flags [P.], seq 0:21, ack 1, win 229, options [nop,nop,TS val 3108117715 ecr 1518717699], length 21
15:56:17.945811 IP myclient.60920 > storage.ssh: Flags [P.], seq 0:21, ack 1, win 229, options [nop,nop,TS val 3108117943 ecr 1518717699], length 21

Answer 1

Maybe the POSTROUTING rule is missing, can you paste the result of this command (on the openvpn server) ?
iptables -L -t nat
If there is no rules you can try :
iptables -t nat -A POSTROUTING -j MASQUERADE
Also verify the ipv4 forwarding (on the openvpn server):
cat /proc/sys/net/ipv4/ip_forward
If the result is 0, you must add this line in '/etc/sysctl.conf':
net.ipv4.ip_forward = 1
Tell me if it helps