Can't connect to server

rosol

Hi
Someone could check this config's and log? Something wrong with my cert probably, but i dont know why, because i do exacly this same steps as here:
http://openvpn.net/index.php/open-source/documentation/howto.html

Configs:
server: http://pastebin.com/VAQjVmwc
client: http://pastebin.com/s37qtvNa
log: http://pastebin.com/Pm77d7iV

Thanks for help.

maikcat

please post HERE your configs WITHOUT comments.

Michael.

rosol

Here's config:

server

local 192.168.2.5
port PORT
proto tcp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
crl-verify /etc/ssl/crl.pem
plugin /usr/lib/openvpn/openvpn-auth-pam.so common-auth
auth-user-pass-verify /etc/openvpn/vpncheckCN-user.sh via-env
dh /etc/openvpn/keys/dh1024.pem
ns-cert-type client
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.2.0 255.255.255.0"
push "route 10.8.0.0 255.255.255.0"
client-config-dir ccd
ccd-exclusive
script-security 3
tls-verify "/etc/openvpn/vpncheckCN-cert.sh /etc/openvpn/userlist.txt"
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
status /var/log/openvpn-status.log
log-append /var/log/openvpn.log
verb 5
tls-server
inactive 3600

client

client
dev tun
proto tcp
remote IP+SERVER'S PORT
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
ca ca.crt
cert client.crt
key client.key
log-append "C:\\Program Files (x86)\\OpenVPN\\log\\openvpn.log"
comp-lzo
verb 4
keepalive 10 120
tls-client
auth-user-pass

Sever: http://pastebin.com/mqTRi5By
Client: http://pastebin.com/1vJ000EH

Thanks for fast reply Michael.

maikcat

i copied your configs...

please post HERE (not in pastebin) your server & client logs

Michael.

rosol

Log serv:
Thu Sep 20 14:29:50 2012 us=260910 MULTI: multi_create_instance called
3 Thu Sep 20 14:29:50 2012 us=260982 Re-using SSL/TLS context
4 Thu Sep 20 14:29:50 2012 us=261002 LZO compression initialized
5 Thu Sep 20 14:29:50 2012 us=261075 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
6 Thu Sep 20 14:29:50 2012 us=261091 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
7 Thu Sep 20 14:29:50 2012 us=261117 Local Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
8 Thu Sep 20 14:29:50 2012 us=261125 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
9 Thu Sep 20 14:29:50 2012 us=261140 Local Options hash (VER=V4): 'c0103fa8'
10 Thu Sep 20 14:29:50 2012 us=261151 Expected Remote Options hash (VER=V4): '69109d17'
11 Thu Sep 20 14:29:50 2012 us=261168 TCP connection established with [AF_INET]87.205.43.204:51527
12 Thu Sep 20 14:29:50 2012 us=261178 TCPv4_SERVER link local: [undef]
13 Thu Sep 20 14:29:50 2012 us=261187 TCPv4_SERVER link remote: [AF_INET]87.205.43.204:51527
14 RThu Sep 20 14:29:50 2012 us=261256 87.205.43.204:51527 TLS: Initial packet from [AF_INET]87.205.43.204:51527, sid=50a710c3 46a72724
15 WRRWRWRWWWWRWRWWWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRRRRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRexit: 37: Illegal number: 0#
16 Thu Sep 20 14:29:52 2012 us=5233 87.205.43.204:51527 VERIFY SCRIPT ERROR: depth=1, <Details of cert>
17 Thu Sep 20 14:29:52 2012 us=5334 87.205.43.204:51527 TLS_ERROR: BIO read tls_read_plaintext error: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned
18 Thu Sep 20 14:29:52 2012 us=5349 87.205.43.204:51527 TLS Error: TLS object -> incoming plaintext read error
19 Thu Sep 20 14:29:52 2012 us=5357 87.205.43.204:51527 TLS Error: TLS handshake failed
20 Thu Sep 20 14:29:52 2012 us=5415 87.205.43.204:51527 Fatal TLS error (check_tls_errors_co), restarting
21 Thu Sep 20 14:29:52 2012 us=5429 87.205.43.204:51527 SIGUSR1[soft,tls-error] received, client-instance restarting
22 Thu Sep 20 14:29:52 2012 us=5486 TCP/UDP: Closing socket
23 Thu Sep 20 14:29:57 2012 us=79615 MULTI: multi_create_instance called
24 Thu Sep 20 14:29:57 2012 us=79667 Re-using SSL/TLS context
25 Thu Sep 20 14:29:57 2012 us=79691 LZO compression initialized
26 Thu Sep 20 14:29:57 2012 us=79734 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
27 Thu Sep 20 14:29:57 2012 us=79751 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
28 Thu Sep 20 14:29:57 2012 us=79773 Local Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
29 Thu Sep 20 14:29:57 2012 us=79781 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
30 Thu Sep 20 14:29:57 2012 us=79794 Local Options hash (VER=V4): 'c0103fa8'
31 Thu Sep 20 14:29:57 2012 us=79805 Expected Remote Options hash (VER=V4): '69109d17'
32 Thu Sep 20 14:29:57 2012 us=79822 TCP connection established with [AF_INET]87.205.43.204:51528
33 Thu Sep 20 14:29:57 2012 us=79832 TCPv4_SERVER link local: [undef]
34 Thu Sep 20 14:29:57 2012 us=79841 TCPv4_SERVER link remote: [AF_INET]87.205.43.204:51528
35 Thu Sep 20 14:29:57 2012 us=81686 87.205.43.204:51528 Connection reset, restarting [0]
36 Thu Sep 20 14:29:57 2012 us=81717 87.205.43.204:51528 SIGUSR1[soft,connection-reset] received, client-instance restarting
37 Thu Sep 20 14:29:57 2012 us=81771 TCP/UDP: Closing socket

Client log:
Thu Sep 20 14:34:59 2012 us=120000 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Thu Sep 20 14:34:59 2012 us=120000 Re-using SSL/TLS context
Thu Sep 20 14:34:59 2012 us=120000 LZO compression initialized
Thu Sep 20 14:34:59 2012 us=120000 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Thu Sep 20 14:34:59 2012 us=120000 Socket Buffers: R=[8192->8192] S=[8192->8192]
Thu Sep 20 14:34:59 2012 us=120000 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Sep 20 14:34:59 2012 us=120000 Local Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Thu Sep 20 14:34:59 2012 us=120000 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Thu Sep 20 14:34:59 2012 us=120000 Local Options hash (VER=V4): '69109d17'
Thu Sep 20 14:34:59 2012 us=120000 Expected Remote Options hash (VER=V4): 'c0103fa8'
Thu Sep 20 14:34:59 2012 us=120000 Attempting to establish TCP connection with SERV_IP+PORT
Thu Sep 20 14:34:59 2012 us=151000 TCP connection established with SERV_IP+PORT
Thu Sep 20 14:34:59 2012 us=151000 TCPv4_CLIENT link local: [undef]
Thu Sep 20 14:34:59 2012 us=151000 TCPv4_CLIENT link remote: SERV_IP+PORT
Thu Sep 20 14:34:59 2012 us=183000 TLS: Initial packet from SERV_IP+PORT, sid=ebaccff8 119fb09e
Thu Sep 20 14:35:00 2012 us=165000 VERIFY OK: depth=1, <Details cert>
Thu Sep 20 14:35:00 2012 us=165000 VERIFY OK: nsCertType=SERVER
Thu Sep 20 14:35:00 2012 us=165000 VERIFY OK: depth=0, <Details cert>
Thu Sep 20 14:35:01 2012 us=117000 Connection reset, restarting [0]
Thu Sep 20 14:35:01 2012 us=117000 TCP/UDP: Closing socket
Thu Sep 20 14:35:01 2012 us=117000 SIGUSR1[soft,connection-reset] received, process restarting
Thu Sep 20 14:35:01 2012 us=117000 Restart pause, 5 second(s)

maikcat

can you use for testing this:

local 192.168.2.5
port PORT
proto tcp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
crl-verify /etc/ssl/crl.pem
plugin /usr/lib/openvpn/openvpn-auth-pam.so common-auth
auth-user-pass-verify /etc/openvpn/vpncheckCN-user.sh via-env
dh /etc/openvpn/keys/dh1024.pem
;ns-cert-type client
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.2.0 255.255.255.0"
push "route 10.8.0.0 255.255.255.0"
client-config-dir ccd
ccd-exclusive
script-security 3
;tls-verify "/etc/openvpn/vpncheckCN-cert.sh /etc/openvpn/userlist.txt"
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
status /var/log/openvpn-status.log
log-append /var/log/openvpn.log
verb 5
tls-server
inactive 3600

michael.

rosol

That config give only Client log:
Thu Sep 20 15:20:00 2012 us=373000 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Thu Sep 20 15:20:04 2012 us=600000 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Thu Sep 20 15:20:04 2012 us=772000 LZO compression initialized
Thu Sep 20 15:20:04 2012 us=772000 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Thu Sep 20 15:20:04 2012 us=772000 Socket Buffers: R=[8192->8192] S=[8192->8192]
Thu Sep 20 15:20:04 2012 us=772000 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Sep 20 15:20:04 2012 us=772000 Local Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Thu Sep 20 15:20:04 2012 us=772000 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Thu Sep 20 15:20:04 2012 us=772000 Local Options hash (VER=V4): '69109d17'
Thu Sep 20 15:20:04 2012 us=772000 Expected Remote Options hash (VER=V4): 'c0103fa8'
Thu Sep 20 15:20:04 2012 us=772000 Attempting to establish TCP connection with SERV_IP+PORT
Thu Sep 20 15:20:05 2012 us=880000 TCP: connect to SERV_IP+PORT failed, will try again in 5 seconds: Connection refused (WSAECONNREFUSED)
Thu Sep 20 15:20:11 2012 us=979000 TCP: connect to SERV_IP+PORT failed, will try again in 5 seconds: Connection refused (WSAECONNREFUSED)

maikcat

the above is SERVER config not client...

when you restart the service using the config above ,what log file say?

Michael.

rosol

Server log is empty ... I made this config for server side and restarted openvpn daemon.
This log above it's everything what i have :/.

rosol

I tried use this config file:
local 192.168.2.5
port PORT
proto tcp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
;crl-verify /etc/ssl/crl.pem
plugin /usr/lib/openvpn/openvpn-auth-pam.so common-auth
auth-user-pass-verify /etc/openvpn/vpncheckCN-user.sh via-env
dh /etc/openvpn/keys/dh1024.pem
;ns-cert-type client
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.2.0 255.255.255.0"
push "route 10.8.0.0 255.255.255.0"
client-config-dir ccd
ccd-exclusive
script-security 3
tls-verify "/etc/openvpn/vpncheckCN-cert.sh /etc/openvpn/userlist.txt"
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
status /var/log/openvpn-status.log
log-append /var/log/openvpn.log
verb 5
tls-server
inactive 3600

And log server:
Thu Sep 20 16:21:48 2012 us=253043 MULTI: multi_create_instance called
762 Thu Sep 20 16:21:48 2012 us=253093 Re-using SSL/TLS context
763 Thu Sep 20 16:21:48 2012 us=253111 LZO compression initialized
764 Thu Sep 20 16:21:48 2012 us=253153 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
765 Thu Sep 20 16:21:48 2012 us=253170 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
766 Thu Sep 20 16:21:48 2012 us=253193 Local Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
767 Thu Sep 20 16:21:48 2012 us=253212 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
768 Thu Sep 20 16:21:48 2012 us=253227 Local Options hash (VER=V4): 'c0103fa8'
769 Thu Sep 20 16:21:48 2012 us=253239 Expected Remote Options hash (VER=V4): '69109d17'
770 Thu Sep 20 16:21:48 2012 us=253256 TCP connection established with [AF_INET]87.205.43.204:52690
771 Thu Sep 20 16:21:48 2012 us=253266 TCPv4_SERVER link local: [undef]
772 Thu Sep 20 16:21:48 2012 us=253275 TCPv4_SERVER link remote: [AF_INET]87.205.43.204:52690
773 RThu Sep 20 16:21:48 2012 us=253326 87.205.43.204:52690 TLS: Initial packet from [AF_INET]87.205.43.204:52690, sid=a39aa12f 10d19c09
774 WRRWRWRWWWWRWRWWWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRRRRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRexit: 37: Illegal number: 0#
775 Thu Sep 20 16:21:49 2012 us=836574 87.205.43.204:52690 VERIFY SCRIPT ERROR: depth=1, <Details of cert>
776 Thu Sep 20 16:21:49 2012 us=836681 87.205.43.204:52690 TLS_ERROR: BIO read tls_read_plaintext error: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned
777 Thu Sep 20 16:21:49 2012 us=836696 87.205.43.204:52690 TLS Error: TLS object -> incoming plaintext read error
778 Thu Sep 20 16:21:49 2012 us=836704 87.205.43.204:52690 TLS Error: TLS handshake failed
779 Thu Sep 20 16:21:49 2012 us=836759 87.205.43.204:52690 Fatal TLS error (check_tls_errors_co), restarting
780 Thu Sep 20 16:21:49 2012 us=836773 87.205.43.204:52690 SIGUSR1[soft,tls-error] received, client-instance restarting
781 Thu Sep 20 16:21:49 2012 us=836809 TCP/UDP: Closing socket

rosol

Ok i made it with other config from here:
http://wiki.debian.org/openvpn%20for%20server%20and%20client
Anyway whank you Michael for help 🙂.
Topic closed.