Problem migrating Windows -> linux

Gizmo

Hi, I had a perfectly working OpenVPN server running on winXP with muliple WinXP and Win7 clients. I made the switch to a CentOS6.2 server and now I'm unable to get any connection with UDP (TCP works fine). In the middle I'm running a simple WRT54GL with tomato firmware installed. The way it looks (since that the only thing that changed) it is to be some sort of firewall issue. I tried disabling iptables, creating a million different dumb rules but it seems like I'm missing something here...

Mon May 28 16:37:50 2012 us=588000 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Mon May 28 16:37:50 2012 us=588000 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon May 28 16:37:50 2012 us=744000 LZO compression initialized
Mon May 28 16:37:50 2012 us=744000 Control Channel MTU parms [ L:1574 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon May 28 16:37:50 2012 us=744000 Socket Buffers: R=[8192->8192] S=[8192->8192]
Mon May 28 16:37:50 2012 us=744000 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Mon May 28 16:37:50 2012 us=744000 Local Options String: 'V4,dev-type tap,link-mtu 1574,tun-mtu 1532,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Mon May 28 16:37:50 2012 us=744000 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1574,tun-mtu 1532,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Mon May 28 16:37:50 2012 us=744000 Local Options hash (VER=V4): 'd79ca330'
Mon May 28 16:37:50 2012 us=744000 Expected Remote Options hash (VER=V4): 'f7df56b8'
Mon May 28 16:37:50 2012 us=744000 UDPv4 link local: [undef]
Mon May 28 16:37:50 2012 us=744000 UDPv4 link remote: 174.90.92.2:3194
Mon May 28 16:37:50 2012 us=744000 UDPv4 WRITE [14] to 174.90.92.2:3194: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
Mon May 28 16:37:50 2012 us=744000 UDPv4 READ [0] from [undef]: DATA UNDEF len=-1
Mon May 28 16:37:53 2012 us=68000 UDPv4 WRITE [14] to 174.90.92.2:3194: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
Mon May 28 16:37:57 2012 us=733000 UDPv4 WRITE [14] to 174.90.92.2:3194: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
Mon May 28 16:38:06 2012 us=32000 UDPv4 WRITE [14] to 174.90.92.2:3194: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0

client config

client
dev tap
dev-node tap-bridge
proto udp
remote 174.90.92.2 3194
resolv-retry infinite
nobind
persist-key
persist-tun
dh keys/dh1024.pem
ca keys/ca.crt
cert keys/VPN-MBA.crt
key keys/VPN-MBA.key
ns-cert-type server
comp-lzo
verb 6

server config

port 3194
proto udp
dev tap

ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/VPN-Server.crt
key /etc/openvpn/easy-rsa/keys/VPN-Server.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem				
server-bridge 192.168.66.102 255.255.255.0 192.168.66.200 192.168.66.220
keepalive 10 120
comp-lzo
max-clients 20
persist-key
persist-tun
status openvpn-status.log
verb 6

janjust

if TCP works and 'mode udp' does not then you're definitely looking at a firewalling issue (or a bad router/switch). Try disabling the firewall completely, and make sure SELinux is set to 'permissive' (or is turned off completely):

/etc/init.d/iptables stop
setenforce permissive

Gizmo

I had already tried that. (SElinux set to permissive and iptables disabled)
UDP works fine with windows server and TCP works fine with linux server.
Bad router / switch seems unlikely... will try an hard reboot

Gizmo

I had already tried with Selinux disabled and iptables set to stop
Rebooted windows server and UDP is working, same thing for linux and TCP...

is there some extra setting or config in linux for UDP that I am missing?

janjust

what *exactly* is not working ? can you post a connection log from both server and client when a client attempts to connect to the UDP-based linux server? can you ping the VPN server IP at all? can you ping the VPN server IP but larger packets fail?

Gizmo

what *exactly* is not working ?
1. Win7 Client is unable to establish a connection with the linux server while using UDP.
2. Win7 CAN has no problem connecting to linux server while using TCP
3. If I use previous windows server, win7 client has no problem connecting with UDP.

can you ping the VPN server IP at all?
no problem at all @ 32 bytes

can you ping the VPN server IP but larger packets fail?
no sure what should be define as large but maximum size is 1490 bytes

Syslog from SERVER

Thu May 31 09:24:35 2012 us=814894 TLS-Auth MTU parms [ L:1574 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu May 31 09:24:35 2012 us=814923 Socket Buffers: R=[124928->131072] S=[124928->131072]
Thu May 31 09:24:35 2012 us=815268 TUN/TAP device tap1 opened
Thu May 31 09:24:35 2012 us=815288 TUN/TAP TX queue length set to 100
Thu May 31 09:24:35 2012 us=815315 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Thu May 31 09:24:35 2012 us=816516 UDPv4 link local (bound): [undef]:3194
Thu May 31 09:24:35 2012 us=816560 UDPv4 link remote: [undef]
Thu May 31 09:24:35 2012 us=816574 MULTI: multi_init called, r=256 v=256
Thu May 31 09:24:35 2012 us=816627 IFCONFIG POOL: base=192.168.66.200 size=21
Thu May 31 09:24:35 2012 us=816653 Initialization Sequence Completed
Thu May 31 09:24:56 2012 us=181183 MULTI: multi_create_instance called
Thu May 31 09:24:56 2012 us=181246 174.90.92.6:58797 Re-using SSL/TLS context
Thu May 31 09:24:56 2012 us=181277 174.90.92.6:58797 LZO compression initialized
Thu May 31 09:24:56 2012 us=181384 174.90.92.6:58797 Control Channel MTU parms [ L:1574 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu May 31 09:24:56 2012 us=181397 174.90.92.6:58797 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Thu May 31 09:24:56 2012 us=181421 174.90.92.6:58797 Local Options String: 'V4,dev-type tap,link-mtu 1574,tun-mtu 1532,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Thu May 31 09:24:56 2012 us=181429 174.90.92.6:58797 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1574,tun-mtu 1532,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Thu May 31 09:24:56 2012 us=181446 174.90.92.6:58797 Local Options hash (VER=V4): 'f7df56b8'
Thu May 31 09:24:56 2012 us=181458 174.90.92.6:58797 Expected Remote Options hash (VER=V4): 'd79ca330'
Thu May 31 09:24:56 2012 us=181495 174.90.92.6:58797 UDPv4 READ [14] from 174.90.92.6:58797: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
Thu May 31 09:24:56 2012 us=181512 174.90.92.6:58797 TLS: Initial packet from 174.90.92.6:58797, sid=bb6c06f8 dffed2f4
Thu May 31 09:24:56 2012 us=181536 174.90.92.6:58797 UDPv4 WRITE [26] to 174.90.92.6:58797: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 [ 0 ] pid=0 DATA len=0
Thu May 31 09:24:58 2012 us=356770 174.90.92.6:58797 UDPv4 READ [14] from 174.90.92.6:58797: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
Thu May 31 09:24:58 2012 us=356831 174.90.92.6:58797 UDPv4 WRITE [26] to 174.90.92.6:58797: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 [ 0 ] pid=0 DATA len=0
Thu May 31 09:25:02 2012 us=724728 174.90.92.6:58797 UDPv4 READ [14] from 174.90.92.6:58797: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
Thu May 31 09:25:02 2012 us=724781 174.90.92.6:58797 UDPv4 WRITE [26] to 174.90.92.6:58797: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 [ 0 ] pid=0 DATA len=0
Thu May 31 09:25:10 2012 us=734007 174.90.92.6:58797 UDPv4 WRITE [14] to 174.90.92.6:58797: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 [ ] pid=0 DATA len=0
Thu May 31 09:25:10 2012 us=930324 174.90.92.6:58797 UDPv4 READ [14] from 174.90.92.6:58797: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
Thu May 31 09:25:10 2012 us=930372 174.90.92.6:58797 UDPv4 WRITE [22] to 174.90.92.6:58797: P_ACK_V1 kid=0 [ 0 ]
Thu May 31 09:25:27 2012 us=91929 174.90.92.6:58797 UDPv4 READ [14] from 174.90.92.6:58797: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
Thu May 31 09:25:27 2012 us=91998 174.90.92.6:58797 UDPv4 WRITE [26] to 174.90.92.6:58797: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 [ 0 ] pid=0 DATA len=0
Thu May 31 09:25:57 2012 us=14590 174.90.92.6:58797 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Thu May 31 09:25:57 2012 us=14634 174.90.92.6:58797 TLS Error: TLS handshake failed
Thu May 31 09:25:57 2012 us=14702 174.90.92.6:58797 SIGUSR1[soft,tls-error] received, client-instance restarting
Thu May 31 09:25:58 2012 us=27341 MULTI: multi_create_instance called

syslog on the CLIENT side

Thu May 31 09:24:34 2012 us=146000 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Thu May 31 09:24:34 2012 us=146000 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Thu May 31 09:24:34 2012 us=317000 LZO compression initialized
Thu May 31 09:24:34 2012 us=317000 Control Channel MTU parms [ L:1574 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu May 31 09:24:34 2012 us=317000 Socket Buffers: R=[8192->8192] S=[8192->8192]
Thu May 31 09:24:34 2012 us=317000 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Thu May 31 09:24:34 2012 us=317000 Local Options String: 'V4,dev-type tap,link-mtu 1574,tun-mtu 1532,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Thu May 31 09:24:34 2012 us=317000 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1574,tun-mtu 1532,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Thu May 31 09:24:34 2012 us=317000 Local Options hash (VER=V4): 'd79ca330'
Thu May 31 09:24:34 2012 us=317000 Expected Remote Options hash (VER=V4): 'f7df56b8'
Thu May 31 09:24:34 2012 us=317000 UDPv4 link local: [undef]
Thu May 31 09:24:34 2012 us=317000 UDPv4 link remote: 174.90.92.2:3194
Thu May 31 09:24:34 2012 us=317000 UDPv4 WRITE [14] to 174.90.92.2:3194: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
Thu May 31 09:24:34 2012 us=317000 UDPv4 READ [0] from [undef]: DATA UNDEF len=-1
Thu May 31 09:24:36 2012 us=501000 UDPv4 WRITE [14] to 174.90.92.2:3194: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
Thu May 31 09:24:40 2012 us=869000 UDPv4 WRITE [14] to 174.90.92.2:3194: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
Thu May 31 09:24:49 2012 us=75000 UDPv4 WRITE [14] to 174.90.92.2:3194: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
Thu May 31 09:25:05 2012 us=237000 UDPv4 WRITE [14] to 174.90.92.2:3194: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
Thu May 31 09:25:34 2012 us=159000 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Thu May 31 09:25:34 2012 us=159000 TLS Error: TLS handshake failed
Thu May 31 09:25:34 2012 us=159000 TCP/UDP: Closing socket
Thu May 31 09:25:34 2012 us=159000 SIGUSR1[soft,tls-error] received, process restarting
Thu May 31 09:25:34 2012 us=159000 Restart pause, 2 second(s)

Just for testing, I also installed openVPN on the tomato router and here is the SERVER log while attempting to connect...

May 31 09:03:00 tomato daemon.err openvpn[3083]: 174.90.92.6:53826 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
May 31 09:03:00 tomato daemon.err openvpn[3083]: 174.90.92.6:53826 TLS Error: TLS handshake failed
May 31 09:03:00 tomato daemon.notice openvpn[3083]: 174.90.92.6:53826 SIGUSR1[soft,tls-error] received, client-instance restarting
May 31 09:03:02 tomato daemon.notice openvpn[3083]: MULTI: multi_create_instance called
May 31 09:03:02 tomato daemon.notice openvpn[3083]: 174.90.92.6:53828 Re-using SSL/TLS context
May 31 09:03:02 tomato daemon.notice openvpn[3083]: 174.90.92.6:53828 LZO compression initialized
May 31 09:03:02 tomato daemon.notice openvpn[3083]: 174.90.92.6:53828 Control Channel MTU parms [ L:1558 D:138 EF:38 EB:0 ET:0 EL:0 ]
May 31 09:03:02 tomato daemon.notice openvpn[3083]: 174.90.92.6:53828 Data Channel MTU parms [ L:1558 D:1450 EF:26 EB:135 ET:32 EL:0 AF:14/26 ]
May 31 09:03:02 tomato daemon.notice openvpn[3083]: 174.90.92.6:53828 TLS: Initial packet from 174.90.92.6:53828, sid=ad10bc41 2a27ab68
May 31 09:04:02 tomato daemon.err openvpn[3083]: 174.90.92.6:53828 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
May 31 09:04:02 tomato daemon.err openvpn[3083]: 174.90.92.6:53828 TLS Error: TLS handshake failed
May 31 09:04:02 tomato daemon.notice openvpn[3083]: 174.90.92.6:53828 SIGUSR1[soft,tls-error] received, client-instance restarting
May 31 09:04:04 tomato daemon.notice openvpn[3083]: MULTI: multi_create_instance called
May 31 09:04:04 tomato daemon.notice openvpn[3083]: 174.90.92.6:53829 Re-using SSL/TLS context
May 31 09:04:04 tomato daemon.notice openvpn[3083]: 174.90.92.6:53829 LZO compression initialized
May 31 09:04:04 tomato daemon.notice openvpn[3083]: 174.90.92.6:53829 Control Channel MTU parms [ L:1558 D:138 EF:38 EB:0 ET:0 EL:0 ]
May 31 09:04:04 tomato daemon.notice openvpn[3083]: 174.90.92.6:53829 Data Channel MTU parms [ L:1558 D:1450 EF:26 EB:135 ET:32 EL:0 AF:14/26 ]
May 31 09:04:04 tomato daemon.notice openvpn[3083]: 174.90.92.6:53829 TLS: Initial packet from 174.90.92.6:53829, sid=aee905d5 b4ae6216
May 31 09:05:04 tomato daemon.err openvpn[3083]: 174.90.92.6:53829 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)

Mimiko

On Tomato web management go to Port Forwarding -> Basic and add a rule to forward port 3194 UDP to your linux server.
Why you won't use the router with tomato firware as a OpenVPN server?