OpenVPN Not Seeing Connection Attempts?

Superman859

I'm trying to get OpenVPN up and running on server / client but am stumbling to identify the problem. I have openvpn installed (on a pfsense box) and client configuration good to go as well. When I'm at home on the LAN, it connects and works fine. When I'm external, I don't even think OpenVPN is seeing the connections or something.

The config is set up to run on UDP 1194. I stopped the openvpn service and just did a simple test with netcat to verify that UDP/1194 does indeed get through, and it does (both ways). So I don't think it's a Firewall issue. I also have Snort running, but I do not see any alerts when the connection is failing, so I don't think that should be the issue either. I have also tried disabling Snort and still have same issue. On the client machine, these are logs that I see.

2012-09-24 10:58:40 LZO compression initialized
2012-09-24 10:58:41 UDPv4 link local (bound): [undef]:1194
2012-09-24 10:58:41 UDPv4 link remote: SERVERIP:1194
2012-09-24 10:59:41 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
2012-09-24 10:59:41 TLS Error: TLS handshake failed
2012-09-24 10:59:41 SIGUSR1[soft,tls-error] received, process restarting
2012-09-24 10:59:41 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA.  OpenVPN 2.0-beta16 and earlier used 5000 as the default port.
2012-09-24 10:59:41 WARNING: Make sure you understand the semantics of --tls-remote before using it (see the man page).
2012-09-24 10:59:41 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2012-09-24 10:59:41 Re-using SSL/TLS context
2012-09-24 10:59:41 LZO compression initialized
2012-09-24 10:59:41 UDPv4 link local (bound): [undef]:1194
2012-09-24 10:59:41 UDPv4 link remote: SERVERIP:1194

On the other end, I never see much of anything, even with using verb 5 (and even verb 15 didn't show anything...I'm not sure exactly what it should show, but I would think it'd show the initial incoming packet at least at SOME level).

It's really just a bunch of the following (currently verb 5 I think)

Sun Sep 23 19:10:32 2012 MANAGEMENT: Client disconnected
Sun Sep 23 19:11:34 2012 MANAGEMENT: Client connected from /var/etc/openvpn/server1.sock
Sun Sep 23 19:11:34 2012 MANAGEMENT: CMD 'status 2'
Sun Sep 23 19:11:34 2012 MANAGEMENT: CMD 'quit'
Sun Sep 23 19:11:34 2012 MANAGEMENT: Client disconnected
Sun Sep 23 19:12:36 2012 MANAGEMENT: Client connected from /var/etc/openvpn/server1.sock
Sun Sep 23 19:12:36 2012 MANAGEMENT: CMD 'status 2'
Sun Sep 23 19:12:36 2012 MANAGEMENT: CMD 'quit'
Sun Sep 23 19:12:36 2012 MANAGEMENT: Client disconnected
Sun Sep 23 19:13:38 2012 MANAGEMENT: Client connected from /var/etc/openvpn/server1.sock
Sun Sep 23 19:13:38 2012 MANAGEMENT: CMD 'status 2'
Sun Sep 23 19:13:38 2012 MANAGEMENT: CMD 'quit'
Sun Sep 23 19:13:38 2012 MANAGEMENT: Client disconnected
Sun Sep 23 19:14:40 2012 MANAGEMENT: Client connected from /var/etc/openvpn/server1.sock
Sun Sep 23 19:14:40 2012 MANAGEMENT: CMD 'status 2'

If I run 'tcpdump -i em0 udp and 1194' where em0 is the external port I see the incoming packets from client connection attempts, but nothing outgoing.

Anyone have any suggestions on next step?

Server conf below:


dev ovpns1
dev-type tun
dev-node /dev/tun1
writepid /var/run/openvpn_server1.pid
#user nobody
#group nobody
script-security 3
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
proto udp
cipher BF-CBC
up /usr/local/sbin/ovpn-linkup
down /usr/local/sbin/ovpn-linkdown
local EXTERNALIP
tls-server
server 192.168.8.0 255.255.255.0
client-config-dir /var/etc/openvpn-csc
username-as-common-name
auth-user-pass-verify /var/etc/openvpn/server1.php via-env
tls-verify /var/etc/openvpn/server1.tls-verify.php
lport 1194
management /var/etc/openvpn/server1.sock unix
max-clients 2
push "route 192.168.7.0 255.255.255.0"
ca /var/etc/openvpn/server1.ca
cert /var/etc/openvpn/server1.cert
key /var/etc/openvpn/server1.key
dh /etc/dh-parameters.1024
tls-auth /var/etc/openvpn/server1.tls-auth 0
comp-lzo
persist-remote-ip
float
# logging
#status /var/log/openvpn-status.log
#log /var/log/openvpn.log
#log-append /var/log/openvpn.log
verb 5

Client Conf:

dev tun
persist-tun
persist-key
proto udp
cipher BF-CBC
tls-client
client
resolv-retry infinite
remote SERVERIP 1194
tls-remote Server Cert
auth-user-pass
pkcs12 zeus-udp-1194.p12
tls-auth zeus-udp-1194-tls.key 1
comp-lzo

maikcat

hi there,

BSD is not my strong point (krzee where are you??) 🙂

can you check that openvpn service is up and tun interface is created?

can you post server log? (not part of it)

Michael.

Superman859

The service is definitely up and running. Which server log are you interested in?

[2.0.1-RELEASE][root@zeus.localdomain]/root(3): ifconfig
em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
	options=209b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_MAGIC>
	ether 00:25:90:64:63:dc
	inet6 fe80::225:90ff:fe64:63dc%em0 prefixlen 64 scopeid 0x1 
	inet EXTERNALIP netmask 0xfffff800 broadcast 255.255.255.255
	nd6 options=3<PERFORMNUD,ACCEPT_RTADV>
	media: Ethernet autoselect (1000baseT <full-duplex>)
	status: active
em1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
	options=209b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_MAGIC>
	ether 00:25:90:64:63:dd
	inet 192.168.7.1 netmask 0xffffff00 broadcast 192.168.7.255
	inet6 fe80::225:90ff:fe64:63dd%em1 prefixlen 64 scopeid 0x2 
	nd6 options=3<PERFORMNUD,ACCEPT_RTADV>
	media: Ethernet autoselect (100baseTX <full-duplex>)
	status: active
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
	options=3<RXCSUM,TXCSUM>
	inet 127.0.0.1 netmask 0xff000000 
	inet6 ::1 prefixlen 128 
	inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3 
	nd6 options=3<PERFORMNUD,ACCEPT_RTADV>
pfsync0: flags=0<> metric 0 mtu 1460
	syncpeer: 224.0.0.240 maxupd: 128 syncok: 1
pflog0: flags=100<PROMISC> metric 0 mtu 33200
enc0: flags=0<> metric 0 mtu 1536
ovpns1: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1500
	options=80000<LINKSTATE>
	inet6 fe80::225:90ff:fe64:63dc%ovpns1 prefixlen 64 scopeid 0x7 
	inet 192.168.8.1 --> 192.168.8.2 netmask 0xffffffff 
	nd6 options=3<PERFORMNUD,ACCEPT_RTADV>
	Opened by PID 45327

Tue Sep 25 13:59:43 2012 us=22652 OpenVPN 2.2.0 i386-portbld-freebsd8.1 [SSL] [LZO2] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)
] built on Aug 11 2011
Tue Sep 25 13:59:43 2012 us=24652 MANAGEMENT: unix domain socket listening on /var/etc/openvpn/server1.sock
Tue Sep 25 13:59:43 2012 us=24892 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Tue Sep 25 13:59:43 2012 us=44924 Diffie-Hellman initialized with 1024 bit key
Tue Sep 25 13:59:43 2012 us=47183 Control Channel Authentication: using '/var/etc/openvpn/server1.tls-auth' as a OpenVPN static key file
Tue Sep 25 13:59:43 2012 us=47259 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Sep 25 13:59:43 2012 us=47302 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Sep 25 13:59:43 2012 us=47352 TLS-Auth MTU parms [ L:1542 D:166 EF:66 EB:0 ET:0 EL:0 ]
Tue Sep 25 13:59:43 2012 us=47453 Socket Buffers: R=[42080->65536] S=[57344->65536]
Tue Sep 25 13:59:43 2012 us=47702 ROUTE default_gateway=EXTERNALGATEWAY
Tue Sep 25 13:59:43 2012 us=47851 TUN/TAP device /dev/tun1 opened
Tue Sep 25 13:59:43 2012 us=47912 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Sep 25 13:59:43 2012 us=47992 /sbin/ifconfig ovpns1 192.168.8.1 192.168.8.2 mtu 1500 netmask 255.255.255.255 up
Tue Sep 25 13:59:43 2012 us=54924 /usr/local/sbin/ovpn-linkup ovpns1 1500 1542 192.168.8.1 192.168.8.2 init
OK
Tue Sep 25 13:59:43 2012 us=66315 /sbin/route add -net 192.168.8.0 192.168.8.2 255.255.255.0
add net 192.168.8.0: gateway 192.168.8.2
Tue Sep 25 13:59:43 2012 us=68571 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Sep 25 13:59:43 2012 us=69607 UDPv4 link local (bound): [AF_INET]EXTERNALIP:1194
Tue Sep 25 13:59:43 2012 us=69694 UDPv4 link remote: [undef]
Tue Sep 25 13:59:43 2012 us=69743 MULTI: multi_init called, r=256 v=256
Tue Sep 25 13:59:43 2012 us=69908 IFCONFIG POOL: base=192.168.8.4 size=62, ipv6=0
Tue Sep 25 13:59:43 2012 us=70041 Initialization Sequence Completed
Tue Sep 25 14:00:18 2012 us=301015 MANAGEMENT: Client connected from /var/etc/openvpn/server1.sock
Tue Sep 25 14:00:18 2012 us=501762 MANAGEMENT: CMD 'status 2'
Tue Sep 25 14:00:18 2012 us=704436 MANAGEMENT: CMD 'quit'
Tue Sep 25 14:00:18 2012 us=704542 MANAGEMENT: Client disconnected

Mimiko

Just to know, SERVERIP in client config file is internal server's IP?
Did you see this:

Tue Sep 25 14:00:18 2012 us=501762 MANAGEMENT: CMD 'status 2'
Tue Sep 25 14:00:18 2012 us=704436 MANAGEMENT: CMD 'quit'
Tue Sep 25 14:00:18 2012 us=704542 MANAGEMENT: Client disconnected

The auth script you have gives an error for the client and OpenVPN disconects the client.

Superman859

SERVERIP is the external IP of the open VPN server.

I saw that error but I am not too sure what it means or why it is disconnected.

Mimiko

Verify correct execution of this script: /var/etc/openvpn/server1.tls-auth