No luck getting openvpn to connect two zentyal servers

Caesonia

Hi all. I have glombed over this site, and tried hard to find a resolution to my problem, but with no success. I am quite new to openvpn, and vpn in general, with no guiidance for me as the lone IT ranger. I have been struggling with this for weeks now, and I really need to move forward with a solution for my company. I am really at my wits end. Maybe those with some time can improve the outlook for me.

The vpn connection is between to Zentyal servers. I have had nothing but endless errors, from not certificate confusion to timeouts. I have followed the instructions on the server-.client set up, and it simply will not connect and stay connected. I have managed to get it to the point where it will connect for about 30 seconds, and then drop. I am on two seperate subnets for testing purposes within our own network. I can take the firwalls down entirely and still have no luck. Connectivity between the servers is fine when the vpn is down. One I start the vpn, it lasts for about 60 seconds, and the fails entirely.

Here is the confuguration:

####Server######

# EBox OpenVPN 2.0 config file for server sachemplace1

# Which local IP address should OpenVPN
# listen on? (optional)

# Which TCP/UDP port should OpenVPN listen on?

port 1194

# TCP or UDP server?

proto tcp

# virtual device

dev tap0

# SSL/TLS root certificate (ca), certificate

# (cert), and private key (key).

ca '/var/lib/ebox/CA/cacert.pem'

cert '/var/lib/ebox/CA/certs/34F288873BF03F59.pem'

key '/var/lib/ebox/CA/private/vpn-sachemplace1.pem'
# This file should be kept secret

# check peer certificate against certificate revokation list

crl-verify /var/lib/ebox/CA/crl/latest.pem

# Diffie hellman parameters.
# Generate your own with:
# openssl dhparam -out dh1024.pem 1024
# Substitute 2048 for 1024 if you are using
# 2048 bit keys.
#dh /etc/openvpn/dh1024.pem

dh /etc/openvpn/ebox-dh1024.pem

# Configure server mode and supply a VPN subnet
# for OpenVPN to draw client addresses from.
server 192.168.160.0 255.255.255.0

# Maintain a record of client <-> virtual IP address
# associations in this file.
ifconfig-pool-persist '/etc/openvpn/sachemplace1-ipp.txt'

# If enabled, this directive will configure
# all clients to redirect their default
# network gateway through the VPN
;push "redirect-gateway"

# Uncomment this directive to allow different
# clients to be able to "see" each other.

client-to-client

# The keepalive directive causes ping-like
# messages to be sent back and forth over
keepalive 10 120

# client certificate common name authentication

# For extra security beyond that provided
# by SSL/TLS, create an "HMAC firewall"
# to help block DoS attacks and UDP port flooding.
;tls-auth ta.key 0 # This file is secret

# Select a cryptographic cipher.
# This config item must be copied to
# the client config file as well.
;cipher BF-CBC # Blowfish (default)
;cipher AES-128-CBC # AES
;cipher DES-EDE3-CBC # Triple-DES

# Enable compression on the VPN link.
# If you enable it here, you must also
# enable it in the client config file.
comp-lzo

# The maximum number of concurrently connected
# clients we want to allow.
;max-clients 100

# group and user for the OpenVPN
# daemon's privileges after initialization.

user nobody

group nogroup

# The persist options will try to avoid
# accessing certain resources on restart
# that may no longer be accessible because
# of the privilege downgrade.
persist-key
persist-tun

# Output a short status file showing
# current connections, truncated
# and rewritten every minute.
status '/var/log/ebox/openvpn/status-sachemplace1.log'

# By default, log messages will go to the syslog (or
# on Windows, if running as a service, they will go to
# the "\Program Files\OpenVPN\log" directory).
# Use log or log-append to override this default.
# "log" will truncate the log file on OpenVPN startup,
# while "log-append" will append to it. Use one
# or the other (but not both).
log-append '/var/log/ebox/openvpn/sachemplace1.log'

# Set the appropriate level of log
# file verbosity.
#
# 0 is silent, except for fatal errors
# 4 is reasonable for general usage
# 5 and 6 can help to debug connection problems
# 9 is extremely verbose
verb 3

# Silence repeating messages. At most 20
# sequential messages of the same message
# category will be output to the log.
;mute 20

push "route 192.168.4.0 255.255.255.0"

###Client-Server####

# Zentyal client-side OpenVPN 2.0 config file #
# for connecting to multi-client server. #
# Client name 1402-greenbrier

# Specify that we are a client and that we
# will be pulling certain config file directives
# from the server.
client

# virtual device

dev tap2

# Are we connecting to a TCP or
# UDP server? Use the same setting as
# on the server.

proto tcp

# The hostname/IP and port of the server.
# You can have multiple remote entries
# to load balance between the servers.

remote 192.168.1.10 1194

# Choose a random host from the remote
# list for load-balancing. Otherwise
# try hosts in the order specified.
;remote-random

# Keep trying indefinitely to resolve the
# host name of the OpenVPN server. Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
resolv-retry infinite

# Most clients don't need to bind to
# a specific local port number.
nobind

# Try to preserve some state across restarts.
persist-key
persist-tun

# If you are connecting through an
# HTTP proxy to reach the actual OpenVPN
# server, put the proxy server/IP and
# port number here. See the man page
# if your proxy server requires
# authentication.
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]

# Wireless networks often produce a lot
# of duplicate packets. Set this flag
# to silence duplicate packet warnings.
;mute-replay-warnings

# SSL/TLS parms.
# See the server config file for more
# description. It's best to use
# a separate .crt/.key file pair
# for each client. A single ca
# file can be used for all clients.

ca "/etc/openvpn/1402-greenbrier.conf.d/caCertificate"

cert "/etc/openvpn/1402-greenbrier.conf.d/certificate"

key "/etc/openvpn/1402-greenbrier.conf.d/certificateKey"
# This file should be kept secret

# Verify server certificate by checking
# that the certicate has the nsCertType
# field set to "server". This is an
# important precaution to protect against
# a potential attack discussed here:
# http://openvpn.net/howto.html#mitm
#
# To use this feature, you will need to generate
# your server certificates with the nsCertType
# field set to "server". The build-key-server
# script in the easy-rsa folder will do this.
;ns-cert-type server

# If a tls-auth key is used on the server
# then every client must also have the key.
;tls-auth ta.key 1

# Select a cryptographic cipher.
# If the cipher option is used on the server
# then you must also specify it here.
;cipher x

# Enable compression on the VPN link.
# Don't enable this unless it is also
# enabled in the server config file.
comp-lzo

# Diffie hellman parameters.
# Generate your own with:
# openssl dhparam -out dh1024.pem 1024
# Substitute 2048 for 1024 if you are using
# 2048 bit keys.
#dh /etc/openvpn/dh1024.pem

dh /etc/openvpn/ebox-dh1024.pem

# By default, log messages will go to the syslog (or
# on Windows, if running as a service, they will go to
# the "\Program Files\OpenVPN\log" directory).
# Use log or log-append to override this default.
# "log" will truncate the log file on OpenVPN startup,
# while "log-append" will append to it. Use one
# or the other (but not both).
log-append /var/log/ebox/openvpn/1402-greenbrier.log
status /var/log/ebox/openvpn/status-1402-greenbrier.log

# Set log file verbosity.
verb 3

# Silence repeating messages
;mute 20

####serverside log ##############

Thu May 3 17:30:01 2012 greenbrierzen/192.168.5.17:36138 SIGUSR1[soft,connection-reset] received, client-instance restarting
Thu May 3 17:30:01 2012 TCP/UDP: Closing socket
Thu May 3 17:33:06 2012 MULTI: multi_create_instance called
Thu May 3 17:33:06 2012 Re-using SSL/TLS context
Thu May 3 17:33:06 2012 LZO compression initialized
Thu May 3 17:33:06 2012 Control Channel MTU parms [ L:1576 D:140 EF:40 EB:0 ET:0 EL:0 ]
Thu May 3 17:33:06 2012 Data Channel MTU parms [ L:1576 D:1450 EF:44 EB:135 ET:32 EL:0 AF:3/1 ]
Thu May 3 17:33:06 2012 Local Options hash (VER=V4): '3e6d1056'
Thu May 3 17:33:06 2012 Expected Remote Options hash (VER=V4): '31fdf004'
Thu May 3 17:33:06 2012 TCP connection established with [AF_INET]192.168.5.17:50992
Thu May 3 17:33:06 2012 Socket Buffers: R=[131072->131072] S=[131072->131072]
Thu May 3 17:33:06 2012 TCPv4_SERVER link local: [undef]
Thu May 3 17:33:06 2012 TCPv4_SERVER link remote: [AF_INET]192.168.5.17:50992
Thu May 3 17:33:07 2012 192.168.5.17:50992 TLS: Initial packet from [AF_INET]192.168.5.17:50992, sid=817353b2 48e1b28f
Thu May 3 17:33:07 2012 192.168.5.17:50992 CRL: CRL /var/lib/ebox/CA/crl/latest.pem is from a different issuer than the issuer of certificate /C=US/ST=Virginia/L=Charlottesville/O=sachemplace/CN=Certification_Authority_Certificate
Thu May 3 17:33:07 2012 192.168.5.17:50992 VERIFY OK: depth=1, /C=US/ST=State/L=City/O=sachemplace/CN=Certification_Authority_Certificate
Thu May 3 17:33:07 2012 192.168.5.17:50992 CRL: CRL /var/lib/ebox/CA/crl/latest.pem is from a different issuer than the issuer of certificate /C=US/ST=Virginia/L=Charlottesville/O=sachemplace/CN=greenbrierzen
Thu May 3 17:33:07 2012 192.168.5.17:50992 VERIFY OK: depth=0, /C=US/ST=State/L=City/O=sachemplace/CN=greenbrierzen
Thu May 3 17:33:08 2012 192.168.5.17:50992 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu May 3 17:33:08 2012 192.168.5.17:50992 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu May 3 17:33:08 2012 192.168.5.17:50992 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu May 3 17:33:08 2012 192.168.5.17:50992 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu May 3 17:33:08 2012 192.168.5.17:50992 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Thu May 3 17:33:08 2012 192.168.5.17:50992 [greenbrierzen] Peer Connection Initiated with [AF_INET]192.168.5.17:50992
Thu May 3 17:33:10 2012 greenbrierzen/192.168.5.17:50992 PUSH: Received control message: 'PUSH_REQUEST'
Thu May 3 17:33:10 2012 greenbrierzen/192.168.5.17:50992 SENT CONTROL [greenbrierzen]: 'PUSH_REPLY,route 192.168.4.0 255.255.255.0,route-gateway 192.168.160.1,ping 10,ping-restart 120,ifconfig 192.168.160.2 255.255.255.0' (status=1)
Thu May 3 17:33:20 2012 greenbrierzen/192.168.5.17:50992 MULTI: Learn: b2:8d:bb:6e:f4:df -> greenbrierzen/192.168.5.17:50992
Thu May 3 17:33:23 2012 greenbrierzen/192.168.5.17:50992 read TCPv4_SERVER []: No route to host (code=113)
Thu May 3 17:33:26 2012 greenbrierzen/192.168.5.17:50992 read TCPv4_SERVER []: No route to host (code=113)
Thu May 3 17:33:29 2012 greenbrierzen/192.168.5.17:50992 read TCPv4_SERVER []: No route to host (code=113)

####Client-log############

Thu May 3 17:38:21 2012 TCP connection established with [AF_INET]192.168.1.10:1194
Thu May 3 17:38:21 2012 Socket Buffers: R=[87380->131072] S=[16384->131072]
Thu May 3 17:38:21 2012 TCPv4_CLIENT link local: [undef]
Thu May 3 17:38:21 2012 TCPv4_CLIENT link remote: [AF_INET]192.168.1.10:1194
Thu May 3 17:38:21 2012 TLS: Initial packet from [AF_INET]192.168.1.10:1194, sid=e9fe9386 dc10f25e
Thu May 3 17:38:22 2012 VERIFY OK: depth=1, /C=US/ST=State/L=City/O=sachemplace/CN=Certification_Authority_Certificate
Thu May 3 17:38:22 2012 VERIFY OK: depth=0, /C=US/ST=State/L=City/O=sachemplace/CN=vpn-sachemplace1
Thu May 3 17:38:22 2012 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu May 3 17:38:22 2012 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu May 3 17:38:22 2012 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu May 3 17:38:22 2012 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu May 3 17:38:22 2012 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Thu May 3 17:38:22 2012 [vpn-sachemplace1] Peer Connection Initiated with [AF_INET]192.168.1.10:1194
Thu May 3 17:38:24 2012 SENT CONTROL [vpn-sachemplace1]: 'PUSH_REQUEST' (status=1)
Thu May 3 17:38:25 2012 PUSH: Received control message: 'PUSH_REPLY,route 192.168.4.0 255.255.255.0,route-gateway 192.168.160.1,ping 10,ping-restart 120,ifconfig 192.168.160.2 255.255.255.0'
Thu May 3 17:38:25 2012 OPTIONS IMPORT: timers and/or timeouts modified
Thu May 3 17:38:25 2012 OPTIONS IMPORT: --ifconfig/up options modified
Thu May 3 17:38:25 2012 OPTIONS IMPORT: route options modified
Thu May 3 17:38:25 2012 OPTIONS IMPORT: route-related options modified
Thu May 3 17:38:25 2012 Preserving previous TUN/TAP instance: tap2
Thu May 3 17:38:25 2012 Initialization Sequence Completed
Thu May 3 17:40:35 2012 [vpn-sachemplace1] Inactivity timeout (--ping-restart), restarting
Thu May 3 17:40:35 2012 TCP/UDP: Closing socket
Thu May 3 17:40:35 2012 SIGUSR1[soft,ping-restart] received, process restarting
Thu May 3 17:40:35 2012 Restart pause, 5 second(s)
Thu May 3 17:40:40 2012 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Thu May 3 17:40:40 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Thu May 3 17:40:40 2012 Re-using SSL/TLS context
Thu May 3 17:40:40 2012 LZO compression initialized
Thu May 3 17:40:40 2012 Control Channel MTU parms [ L:1576 D:140 EF:40 EB:0 ET:0 EL:0 ]
Thu May 3 17:40:40 2012 Data Channel MTU parms [ L:1576 D:1450 EF:44 EB:135 ET:32 EL:0 AF:3/1 ]
Thu May 3 17:40:40 2012 Local Options hash (VER=V4): '31fdf004'
Thu May 3 17:40:40 2012 Expected Remote Options hash (VER=V4): '3e6d1056'
Thu May 3 17:40:40 2012 Attempting to establish TCP connection with [AF_INET]192.168.1.10:1194 [nonblock]
Thu May 3 17:40:50 2012 TCP: connect to [AF_INET]192.168.1.10:1194 failed, will try again in 5 seconds: Connection timed out
Thu May 3 17:41:05 2012 TCP: connect to [AF_INET]192.168.1.10:1194 failed, will try again in 5 seconds: Connection timed out

Thanks so much for your help in advance. I really need to get this set up so that my data network is seperated from my voip, so I can do some better traffic shaping.

Best Regards.

maikcat

hi there,

just to remind you that projects like zentyal (untangle,zeroshell,clearos etc)
have the tendency to overwrite configs every time they startup...

i believe it is better to post to their forum first.

regards.

Michael.

Mimiko

The zentyal servers are problematic. See this topic for some glues: https://forums.openvpn.net/topic7645.html. Also read this doc: http://doc.zentyal.org/en/vpn.html, especially where it is writted about connecting to zentyal servers.

Caesonia

maikcat wrotehi there,

just to remind you that projects like zentyal (untangle,zeroshell,clearos etc)
have the tendency to overwrite configs every time they startup...

i believe it is better to post to their forum first.

regards.

Michael.

Yeah, I see you like to make this post to a lot of different people, instead of just thinking if you see something that might be helpful.

I am aware that software like this has a habit of writing it's own configs on reboot. I was planning, if necessary, to override it with shell scripts. Fortunately, I didn't have to.

Caesonia

Mimiko wroteThe zentyal servers are problematic. See this topic for some glues: https://forums.openvpn.net/topic7645.html. Also read this doc: http://doc.zentyal.org/en/vpn.html, especially where it is writted about connecting to zentyal servers.

Hi there. Thanks for you help. Their documentation is horrible, and I had seen the other post, but it finally did put me onto something after seeing both. The gateway bit was the key.

A few things were not working as they were supposed to. What was happening was that once the vpn connection was established, the settings for the local network would be lost, especially the gateway for the local network. I have never seen such a thing, and its complete rot, but....

I had to set static routes with their gateways explicitly. Once I did however, the connection stayed up. To make it ping across correctly to each of the internal lans and for the clients to have internet after the initial connection required me manually doing the ip_fowarding, but it sticks on reboot. Finally, the push factor does work, and as far as I can tell from testing, ping across, but you also need to be sure you create a static route via their interface to the lan on the client side. It doesn't advertise both was.

This might have been made more difficult by the fact that I was running this as a test set up on an internal network, but I think there are still some bits that just don't work like they are supposed to. I don't know what is going to happen when I now have windows clients coming in with the road warriors. We can see.

I hope my answers help others with the OpenVPN Znetyal/Ebox challenge.

maikcat

Yeah, I see you like to make this post to a lot of different people, instead of just thinking if you see something that might be helpful.

because i have a (little) expirience with zentyal & others and i know their tedency to overwrite files.

(btw look here:http://trac.zentyal.org/wiki/Documentation/Community/HowTo/CustomizeConfigFiles)

my comment

i believe it is better to post to their forum first.

is pretty simple,check THEIR forum because THEIR software is pretty complicated
(btw did you found a default gateway when issuing netstat -nr?)

and YES i am sure that there will be NOT a obvious error in their config (except if you use a beta version)
so...

how i am supposed to help you (janjust tried before and after 20 posts he simply told the user to
visit their forum) when an "appliance" like zentyal has CORRECT configs , COMPLICATED setup (zentyal
has various add ons from transparent proxy to asterisk) and you CANT easily edit configs and test things
out...

if you dont like my comment ,so be it...

if you setup openvpn on a linux distro or win i will gladly help you out
because i would know that you HAVE THE CONTROL of your setup,
on zentyal you DONT,so i think (my opinion) its a WASTE OF TIME for both of us.

just think that i could simply dont answer you at all.....

hope to solve your problem.

Michael.