Server behind NAT firewall - configuraton

arne22

Hello !

I have made a few installations of OpenVPN on a Centos VPS and it has worked all the times.
All these installations that hve worked have all had an external "real" ip. All setups have been
close to identical.

I have now tried to set up a OpenVPN server behind a NAT router. I think the port forwarding should
be ok, but still it it imposseble to log on to the lan located OpenVPN server from Internet.

It says that it will not accept the certificate, or tha there is no proper methos for evaluation of the
certificate.

Her is my config files:

server.conf

local 192.168.0.14
port 443
proto tcp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh1024.pem
server 10.9.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 5 30
comp-lzo
persist-key
persist-tun
status server-tcp.log
verb 3

Client configuration file
push "redirect-gateway def1"
client
dev tun
proto tcp
remote 79.x.x.x 443
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert cent2.crt
key cent2.key
comp-lzo
verb 3

From Log:
Sun May 13 10:52:16 2012 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Sun May 13 10:52:16 2012 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Sun May 13 10:52:16 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Sun May 13 10:52:17 2012 Cannot load certificate file cent2.crt: error:0906D06C:PEM routines:PEM_read_bio:no start line: error:140AD009:SSL routines:SSL_CTX_use_certificate_file:PEM lib
Sun May 13 10:52:17 2012 Exiting

I would be thankfull if anyone had an idea.

By the way, I have made several new installations to make it work and the error messages has been different:
On first try it said something like that the time on the certificate was wrong. I set the time for the server and made a new installation.
On next try I could see that the loin was doing quite much of the login process, and then it was just hanging,
On the last try, it just say those few words about "no certificate verification method".

Thanks a lot ! :-)

Arne

janjust

this warning

Sun May 13 10:52:17 2012 Cannot load certificate file cent2.crt: error:0906D06C:PEM routines:PEM_read_bio:no start line: error:140AD009:SSL routines:SSL_CTX_use_certificate_file:PEM lib

shows that there's a problem loading the client side certificate; is the certificate in the right directory? can you specify a full path to it?

arne22

Thanks a lot ! You pushed me in the right direction. The client certificates vere in the proper directory, but when I opened them to take a look, one of them appeared to be just an empty file. I guess I must have dome some fault when generating them. So I generated new client certificates and everything worked. Thanks for making me checking in the right area, because I was actually checking everything else, except for the content of the certificate files themself. 😃