PROBLEM CONNECT TO SERVER

hohoangluan

Hi all.
i've finish install and config openvpn server (centos 5x). But when i use openvpn guide to connect to server it's show error.

unable to connect because your certificate is not yet valid. Check that your system time is correct.

i check the time between server and cliect is match.

server.config

mode server
dev tun1
proto udp
port 1194
tls-server

ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh1024.pem

server 172.22.0.0 255.255.255.0
#ifconfig 192.168.1.1 192.168.1.2
#ifconfig-pool 192.168.1.4 192.168.1.25
log /etc/openvpn/openvpn.log

persist-tun
persist-key

verb 3
comp-lzo

server.log

Wed Aug 29 16:15:40 2012 OpenVPN 2.2.2 i686-redhat-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] built on Apr 5 2012
Wed Aug 29 16:15:40 2012 WARNING: --keepalive option is missing from server config
Wed Aug 29 16:15:40 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Aug 29 16:15:40 2012 Diffie-Hellman initialized with 1024 bit key
Wed Aug 29 16:15:40 2012 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed Aug 29 16:15:40 2012 Socket Buffers: R=[110592->131072] S=[110592->131072]
Wed Aug 29 16:15:40 2012 TCP/UDP: Socket bind failed on local address [undef]:1194: Address already in use
Wed Aug 29 16:15:40 2012 Exiting

cliente.conf

pull
tls-client
dev tun
proto udp
remote 192.168.1.1 1194
#ip-win32 manual
resolv-retry infinite
nobind
persist-key
persist-tun

ca "C:\\Program Files (x86)\\OpenVPN\\test\\ca.crt"
cert "C:\\Program Files (x86)\\OpenVPN\\test\\client.crt"
key "C:\\Program Files (x86)\\OpenVPN\\test\\client.key"
dh "C:\\Program Files (x86)\\OpenVPN\\test\\dh1024.pem"
verb 3
comp-lzo

client.log

Wed Aug 29 16:41:06 2012 OpenVPN 2.2.0 Win32-MSVC++ [SSL] [LZO2] built on Apr 26 2011
Wed Aug 29 16:41:06 2012 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Wed Aug 29 16:41:06 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Aug 29 16:41:07 2012 LZO compression initialized
Wed Aug 29 16:41:07 2012 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed Aug 29 16:41:07 2012 Socket Buffers: R=[8192->8192] S=[8192->8192]
Wed Aug 29 16:41:07 2012 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Aug 29 16:41:07 2012 Local Options hash (VER=V4): '41690919'
Wed Aug 29 16:41:07 2012 Expected Remote Options hash (VER=V4): '530fdded'
Wed Aug 29 16:41:07 2012 UDPv4 link local: [undef]
Wed Aug 29 16:41:07 2012 UDPv4 link remote: 192.168.1.1:1194
Wed Aug 29 16:41:07 2012 TLS: Initial packet from 192.168.1.1:1194, sid=02f50596 d1eb108a
Wed Aug 29 16:41:07 2012 VERIFY ERROR: depth=1, error=certificate is not yet valid: /C=VN/ST=HCM/L=HCM/O=Fort-Funston/OU=changeme/CN=openvpn-ca/name=changeme/emailAddress=hoangluanus86@yahoo.com
Wed Aug 29 16:41:07 2012 TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
Wed Aug 29 16:41:07 2012 TLS Error: TLS object -> incoming plaintext read error
Wed Aug 29 16:41:07 2012 TLS Error: TLS handshake failed
Wed Aug 29 16:41:07 2012 TCP/UDP: Closing socket
Wed Aug 29 16:41:07 2012 SIGUSR1[soft,tls-error] received, process restarting
Wed Aug 29 16:41:07 2012 Restart pause, 2 second(s)
Wed Aug 29 16:41:09 2012 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Wed Aug 29 16:41:09 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Aug 29 16:41:09 2012 Re-using SSL/TLS context
Wed Aug 29 16:41:09 2012 LZO compression initialized
Wed Aug 29 16:41:09 2012 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed Aug 29 16:41:09 2012 Socket Buffers: R=[8192->8192] S=[8192->8192]
Wed Aug 29 16:41:09 2012 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Aug 29 16:41:09 2012 Local Options hash (VER=V4): '41690919'
Wed Aug 29 16:41:09 2012 Expected Remote Options hash (VER=V4): '530fdded'
Wed Aug 29 16:41:09 2012 UDPv4 link local: [undef]
Wed Aug 29 16:41:09 2012 UDPv4 link remote: 192.168.1.1:1194
Wed Aug 29 16:41:09 2012 TCP/UDP: Closing socket
Wed Aug 29 16:41:09 2012 SIGTERM[hard,] received, process exiting

hohoangluan

The problem is datetime. But i have another problem with command

openvpn /etc/openvpn/server.conf

when i use this command, it's not show anything (succeed or Fail) and then i press CTRL + C and restart openvpn.
after that client can connect to vpn server.

Log file after run command openvpn /etc/openvpn/server.conf
server.conf, client.conf is the same above posted

Wed Aug 29 21:41:31 2012 event_wait : Interrupted system call (code=4)
Wed Aug 29 21:41:31 2012 TCP/UDP: Closing socket
Wed Aug 29 21:41:31 2012 /sbin/ip route del 192.168.1.0/24
RTNETLINK answers: Operation not permitted
Wed Aug 29 21:41:31 2012 ERROR: Linux route delete command failed: external prog                                                                                        ram exited with error status: 2
Wed Aug 29 21:41:31 2012 Closing TUN/TAP interface
Wed Aug 29 21:41:31 2012 /sbin/ip addr del dev tun1 local 192.168.1.1 peer 192.1                                                                                        68.1.2
RTNETLINK answers: Operation not permitted
Wed Aug 29 21:41:31 2012 Linux ip addr del failed: external program exited with                                                                                         error status: 2
Wed Aug 29 21:41:31 2012 SIGINT[hard,] received, process exiting

hohoangluan

anybody help me, please. Thank you

krzee

your problem is your PKI
make sure all your clocks are correct, in the right year and timezone, and rebuild your PKI from scratch.
this means rebuild your ca.crt/ca.key and client/server crt/key files
replace ca.crt and crt/key files on the server and client.

follow this:
http://openvpn.net/index.php/open-source/documentation/howto.html#pki

hohoangluan

When i user command

openvpn server.config

it's not show anything
i think problem with error

event_wait : Interrupted system call (code=4)

krzee

you sure openvpn is not already running?

ps auxw|grep vpn

hohoangluan

because when i restart the server, openvpn is not automatic start,right. we must to restart openvpn again?

krzee

depends on your servers configuration
the command i gave you would tell you
you should have a firm grasp of using your OS before trying to configure openvpn on it