SilkBC
Hello,
I am getting a "TLS handshake timeout" error when trying to connect my OpenVPN client. I know this is almost always firewall-related, however, I am not sure this is the case. Let me explain:
I first setup OpenVPN server on a SBS 2008 server, and port-forwarded UDP/1994 to the SBS box. Firewall is a "Fortigate 50A". Connecting to OpenVPN server works, however the built-in DHCP server in OpenVPN conflicts with the DHCP server on SBS 2008.
I next attempted to configure OpenVPN on SBS 2008 to run in "bridge mode" and make ue of the SBS 2008 DHCP server, however SBS 2008 does not like having it's network interface as part of a bridged connection. I was not able to make this work.
Bottom line: OpenVPN (using UDP) *does* work through this firewall
Next, I setup a Linux server for the express purpose of being an OpenVPN server. I copied the config and keys over from the SBS 2008 config. There is no firewall running on the Linux/OpenVPN server. I an running it in "router" mode, with the intention of changing it to "bridge" mode once I confirmed it worked (all my experience with OpenVPN is using routed mode, so I wanted to make sure I would be working from a known working setup)
Once I had the OpenVPN setup and running on the Linux server, I changed the UDP/1994 port forward on the firewall to point to the Linux/OpenVPN server. Connecting from the same workstation (and Internet conenction) as before, this is where I get the "TLS handshake timeout" error. I set log verbosity on both the client and the server to 9 and I watched the log on the server; it doesn't even look like the client is hitting the server.
I changed the UDP/1194 port forward back to the SBS 2008 server and I could connect, so firewall *seems* to be fine. I also tried connecting from a workstation on the same LAN as the Linux/OpenVPN server, just to be sure OpenVPN was working right, and it was able to connect.
I have also tried port forwarding TCP/1194 to the Linux/OpenVPN server and in the server.conf file chnaged "proto udp" to "proto tcp" and restarted OpenVPN; I am still getting the "TLS handshake timeout" error. I have tried running (and forwarding) other ports, but the same error occurs.
Just to confirm that routing between the firewall and Linux/OpenVPN server is working (other than the fact that the server can reach the firewall and the Internet), I created a port forward for TCP/22 to the server and was able to successfully SSH to it, so routing appears to be fine.
Any ideas what else could be wrong?
Thanks! :-)
-SilkBC
