Hand Shake failes

cscadmin

Hello everyone I have another problem that I did not see before, I recently had a post about an iptables rule but due to the fact this has nothing to do with Iptables i made a new thread. I have been all over the internet and this forum to find the solution but I have not found it. I have read some community documentation http://openvpn.net/index.php/open-source/faq/79-client/253-tls-error-tls-key-negotiation-failed-to-occur-within-60-seconds-check-your-network-connectivity.html and I have double checked everything I have made sure the firewall is off on my laptop with is ubuntu linux and that the router is forwarding 1194 and made sure the the debian server accepts traffic on that port. They try to talk but the hand shake fails every time. As for a slow conntection this is not, the belkin router and the debian server on the same switch with gigabyte nics.

#####################################################################################################################
error--cleint terminal------------version 2.1.0
me@me-laptop:~$ sudo su
[sudo] password for me:
root@me:/home/william# openvpn --config /etc/openvpn/cient1.conf
Thu Apr 12 11:01:33 2012 OpenVPN 2.1.0 i686-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Jul 12 2010
Thu Apr 12 11:01:33 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Thu Apr 12 11:01:33 2012 WARNING: file '/etc/openvpn/keys/cleint1.key' is group or others accessible
Thu Apr 12 11:01:33 2012 /usr/bin/openssl-vulnkey -q -b 2048 -m <modulus omitted>
Thu Apr 12 11:01:33 2012 WARNING: file '/etc/openvpn/keys/ta.key' is group or others accessible
Thu Apr 12 11:01:33 2012 Control Channel Authentication: using '/etc/openvpn/keys/ta.key' as a OpenVPN static key file
Thu Apr 12 11:01:33 2012 UDPv4 link local: [undef]
Thu Apr 12 11:01:33 2012 UDPv4 link remote: [AF_INET]97.*.*.11:1194
//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
##################error
Thu Apr 12 11:02:33 2012 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Thu Apr 12 11:02:33 2012 TLS Error: TLS handshake failed
Thu Apr 12 11:02:33 2012 SIGUSR1[soft,tls-error] received, process restarting
//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
Thu Apr 12 11:02:35 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Thu Apr 12 11:02:35 2012 WARNING: file '/etc/openvpn/keys/csccleint1.key' is group or others accessible
Thu Apr 12 11:02:35 2012 /usr/bin/openssl-vulnkey -q -b 2048 -m <modulus omitted>
Thu Apr 12 11:02:35 2012 WARNING: file '/etc/openvpn/keys/ta.key' is group or others accessible
Thu Apr 12 11:02:35 2012 Control Channel Authentication: using '/etc/openvpn/keys/ta.key' as a OpenVPN static key file
Thu Apr 12 11:02:35 2012 UDPv4 link local: [undef]
Thu Apr 12 11:02:35 2012 UDPv4 link remote: [AF_INET]97.*.*.11:1194
#####################################################################################################################
###server config##########DEBIAN####Directly on the internet port 1194 open to all incoming traffic---version 2.1.3
tls-server
proto udp
port 1194
dev tap
server 192.168.71.0 255.255.255.0
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh2048.pem
tls-auth /etc/openvpn/keys/ta.key 0
push "route 192.168.71.0 255.255.255.0"
user nobody
group nobody
daemon
log-append /var/log/openvpn.log
#####################################################################################################################
#######client#############UBTUNU behind a belkin router port 1194 forwarded

client
proto udp
remote 97.*.*.11
port 1194
dev tap
nobind
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/client1.crt
key /etc/openvpn/keys/client1.key
tls-auth /etc/openvpn/keys/ta.key 1
ns-cert-type server
###############################################################################################
:? Any ideas?
Thank You to anyone who responds.

janjust

for debugging, try using

proto tcp

as well - some routers are bad at forwarding UDP traffic.

Also, make sure the router is forwarding UDP traffic in both directions - an inbound rule sometimes is not enough.

For more debugging, run

tcpdump -nnel -i eth0 udp port 1194

and watch for any inbound and outbound traffic.

cscadmin

Thank you I checked it even tried to running it on port 443 tcp i figured beginning how https using it the traffic would be allowed by default in the firewalls I'd also be more mobile. I decided to try to build my keys again and I keep skipping the ./build-dh I fear that is is to late now because it woun't let me do a build-dh without a ./clean-all. So to be on the safe side I'm going to just write a bash script for making the keys and try again. I think I might keep screwing up there so It might be a possibility. Now when it says "Sign the certificate?" and it writes it the the bata base does that mean on your guy's database you have a bunch of entries for me? I've already done it once or twice but I have not got one working yet. Sometimes it is just easier to start over. I was just wondering.
Anyway thank you for your help I'll keep trying.

janjust

the key signing is all done locally - nothing is sent to central services.
Post the connection logs of both client and server with 'verb 4' set.

cscadmin

Hello sorry it took so long to get back to you, I will grab the log file in a sec but I was wondering first I found user errors I had and changed all the certs but right now it is trying but with not a new error but a little more. I seems the server fires right up but I get this in the log once I connect.

Wed Apr 18 14:25:16 2012 97.*.*.11:41639 TLS_ERROR: BIO read tls_read_plaintext error: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned
Wed Apr 18 14:25:16 2012 97.*.*.11:41639 TLS Error: TLS object -> incoming plaintext read error
Wed Apr 18 14:25:16 2012 97.*.*.11:41639 TLS Error: TLS handshake failed
Wed Apr 18 14:26:10 2012 97.*.*.11:51779 Re-using SSL/TLS context
Wed Apr 18 14:26:10 2012 97.*.*.11:51779 VERIFY ERROR: depth=0, error=unsupported certificate purpose: /C=US/ST=MYst/L=MyCounty/O=My_BIZg/CN=client1/emailAddress=my@email.net
I am not trying to connect on port 24 udp and have it forwarded thru the little router my laptop is behind. I'm going to do some googling I have no Idea what I'm doing wrong, Does this error help us narrow it down a little better?

janjust

yep , the warning

VERIFY ERROR: depth=0, error=unsupported certificate purpose: /C=US/ST=MYst/L=MyCounty/O=My_BIZg/CN=c ... @email.net

suggests that you've not created the (server) certificate in the right manner; try running the client with

#ns-cert-type server

disabled (I added the '#' already).

cscadmin

Thank You for your time, I'm gonna search the internet for the proper way of creating the keys. If not I'll figure something out, a sneaker network might suffice for now.
Thanks Again