Hi,
first of all. OpenVPN runs flawlessly. Just one addition need to be done.
current situation.
Firewall with two separated internal networks and two separated external interfaces.
No.1: LAN; OpenVPN Server is located in. Static NAT from external IP to this server.
No.2: NEW! Guest-LAN; Client is trying to connect. Since Firewall is doing loopback external traffic is not leaving via External2/No.4.
No.3: External1; Public clients can access OpenVPN Server via a static nat config. Everything works perfect.
No.4: External2; Guest-LAN client from No.2 is browsing over this interface to go outside. not in this case because of loopback
server log entries:
Fri Jun 15 10:47:48 2012 us=974236 MULTI: multi_create_instance called
Fri Jun 15 10:47:48 2012 us=974574 192.168.100.1:50613 Re-using SSL/TLS context
Fri Jun 15 10:47:48 2012 us=974665 192.168.100.1:50613 LZO compression initialized
Fri Jun 15 10:47:48 2012 us=975008 192.168.100.1:50613 Control Channel MTU parms [ L:1562 D:166 EF:66 EB:0 ET:0 EL:0 ]
Fri Jun 15 10:47:48 2012 us=975124 192.168.100.1:50613 Data Channel MTU parms [ L:1562 D:1400 EF:62 EB:135 ET:0 EL:0 AF:3/1 ]
Fri Jun 15 10:47:48 2012 us=975139 192.168.100.1:50613 Fragmentation MTU parms [ L:1562 D:1400 EF:61 EB:135 ET:1 EL:0 AF:3/1 ]
Fri Jun 15 10:47:48 2012 us=975183 192.168.100.1:50613 Local Options String: 'V4,dev-type tun,link-mtu 1562,tun-mtu 1500,proto UDPv4,comp-lzo,mtu-dynamic,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
Fri Jun 15 10:47:48 2012 us=975193 192.168.100.1:50613 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1562,tun-mtu 1500,proto UDPv4,comp-lzo,mtu-dynamic,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
Fri Jun 15 10:47:48 2012 us=975213 192.168.100.1:50613 Local Options hash (VER=V4): '0088baee'
Fri Jun 15 10:47:48 2012 us=975229 192.168.100.1:50613 Expected Remote Options hash (VER=V4): 'e05aa1c5'
Fri Jun 15 10:47:48 2012 us=975273 192.168.100.1:50613 TLS: Initial packet from 192.168.100.1:50613, sid=61e86e25 e1a28b03
Fri Jun 15 10:48:18 2012 us=1190 192.168.100.1:50611 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Fri Jun 15 10:48:18 2012 us=1258 192.168.100.1:50611 TLS Error: TLS handshake failed
Fri Jun 15 10:48:18 2012 us=1378 192.168.100.1:50611 SIGUSR1[soft,tls-error] received, client-instance restarting
client log entries:
Fri Jun 15 11:01:45 2012 OpenVPN 2.2.1 Win32-MSVC++ [SSL] [LZO2] built on Jul 1 2011
Fri Jun 15 11:01:45 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Fri Jun 15 11:01:45 2012 Control Channel Authentication: using 'private\ta-vpn-ddf.key' as a OpenVPN static key file
Fri Jun 15 11:01:45 2012 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Jun 15 11:01:45 2012 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Jun 15 11:01:45 2012 LZO compression initialized
Fri Jun 15 11:01:45 2012 Control Channel MTU parms [ L:1562 D:166 EF:66 EB:0 ET:0 EL:0 ]
Fri Jun 15 11:01:45 2012 Socket Buffers: R=[8192->8192] S=[8192->8192]
Fri Jun 15 11:01:45 2012 Data Channel MTU parms [ L:1562 D:1400 EF:62 EB:135 ET:0 EL:0 AF:3/1 ]
Fri Jun 15 11:01:45 2012 Fragmentation MTU parms [ L:1562 D:1400 EF:61 EB:135 ET:1 EL:0 AF:3/1 ]
Fri Jun 15 11:01:45 2012 Local Options hash (VER=V4): 'e05aa1c5'
Fri Jun 15 11:01:45 2012 Expected Remote Options hash (VER=V4): '0088baee'
Fri Jun 15 11:01:45 2012 UDPv4 link local: [undef]
Fri Jun 15 11:01:45 2012 UDPv4 link remote: tested_both_internal_and_extrenal_IP_of_OpenVPNServer:443
Rules allow anything to anything for testing purposes for the corresponding nets and IP's. Exactly the same rules for a test http connection redirect the traffic correctly and pass it to the the server. But the TLS handshake is failing. It must have something to do with a misconfig on firewall but I'm quite lost at the moment. Any help appreciated. Thanks a lot.
