Is it an mtu case?

[jbgood]

My server.cfg

Code: Select all

local my-ip
port 1194

proto udp

dev tun
tun-mtu 1200

ca keys/ca.crt
cert keys/my.crt
key keys/my.key
dh keys/dh1024.pem
crl-verify keys/crl.pem
server 10.0.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt

client-to-client
keepalive 10 120
comp-lzo
max-clients 100
user openvpn
group openvpn
persist-key
persist-tun
status openvpn-status.log
log /var/log/openvpn.log
verb 3

My client con.ovpn

Code: Select all

client
remote my-servers-ip 1194

comp-lzo yes
dev tun
proto udp
script-security 2
persist-key
persist-tun
tun-mtu 1200
verb 5

<ca>
-----BEGIN CERTIFICATE-----
ommited
-----END CERTIFICATE-----
</ca>

<cert>
-----BEGIN CERTIFICATE-----
ommited
-----END CERTIFICATE-----
</cert>

<key>
-----BEGIN RSA PRIVATE KEY-----
ommited
-----END RSA PRIVATE KEY-----
</key>

In server log i have:

Code: Select all

VERIFY OK:

and then, after timeout:

Code: Select all

TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
 TLS Error: TLS handshake failed

In client log:

Code: Select all

EVENT: CONNECTION_TIMEOUT [ERR]
EVENT: DISCONNECTED

And that's all.
It is also known that server has nothing that prevents traffic from clients.

Appreciate any help!

[maikcat]

can you connect from a different location?

can you switch to tcp for testing?

Michael.

[jbgood]

can you connect from a different location?

Nope =( I have always the same error (timeout on both sides) no-matter where from i try to connect.

can you switch to tcp for testing?

Unfortunately no. This is production VPN with many working clients.

I also noticed a total absence of traffic between iDevice-and-server on servers public interface after "VERIFY OK:" messages in log.

[maikcat]

i am a bit confused here....

Nope =( I have always the same error (timeout on both sides) no-matter where from i try to connect.

Unfortunately no. This is production VPN with many working clients.

is your setup works or no?

Michael.

[jbgood]

It works, but not with iOS app)

[maikcat]

via which network you are trying to connect from ios?

maybe someone after ios filters traffic...

Michael.

[jbgood]

via which network you are trying to connect from ios?

I tried lots of internet sources (which surely do not have any traffic limitations) - and always got same behavior.

[jbgood]

Finally i localized the problem. It is "mtu 1200".
So iOS client doesn't support mtu resize, am i right ?