TLS key negotiation/handshake error

parsleybravo

OpenVPN noob here. I'm looking to expand my VPN capabilities, and setting up OpenVPN on my DD-WRT router sounded like a good option. I think I've worked myself through a couple of very basic problems, but I have no idea how to handle the issues I'm now facing.

All certs and keys are created on my laptop, the machine I'll be using for VPN access on the road. I've uploaded the necessary info to my router via my home network and been testing the connection via phone tether (though attempting to connect to the VPN while still on my home WiFi has yielded the same results).

I've basically been following this guide.

Any tips or direction would be greatly appreciated.

Server config:

push "route 192.168.1.0 255.255.255.0"
push "dhcp-option DNS 192.168.66.1"
server 192.168.66.0 255.255.255.0

dev tun0
proto udp
keepalive 10 120
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem

Server log:

Jan 28 14:05:57 WNDR4000 daemon.notice openvpn[10069]: 192.168.1.3:53484 Re-using SSL/TLS context
Jan 28 14:06:57 WNDR4000 daemon.err openvpn[10069]: 192.168.1.3:53484 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Jan 28 14:06:57 WNDR4000 daemon.err openvpn[10069]: 192.168.1.3:53484 TLS Error: TLS handshake failed
Jan 28 14:06:58 WNDR4000 daemon.notice openvpn[10069]: 192.168.1.3:51119 Re-using SSL/TLS context
Jan 28 14:07:58 WNDR4000 daemon.err openvpn[10069]: 192.168.1.3:51119 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Jan 28 14:07:58 WNDR4000 daemon.err openvpn[10069]: 192.168.1.3:51119 TLS Error: TLS handshake failed

Client log:

Mon Jan 28 06:05:53 2013 OpenVPN 2.3.0 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Jan  8 2013
Mon Jan 28 06:05:54 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon Jan 28 06:05:54 2013 UDPv4 link local: [undef]
Mon Jan 28 06:05:54 2013 UDPv4 link remote: [AF_INET]XX.X.XXX.XX:1194
Mon Jan 28 06:06:54 2013 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Mon Jan 28 06:06:54 2013 TLS Error: TLS handshake failed
Mon Jan 28 06:06:54 2013 SIGUSR1[soft,tls-error] received, process restarting

maikcat

hi there,

are your client in the SAME network with your server and you are trying to connect by using your routers wan ip?

Michael.

parsleybravo

maikcat wrotehi there,

are your client in the SAME network with your server and you are trying to connect by using your routers wan ip?

Michael.

They are on the same network when my client machine is using the WiFi in my apartment. When I test the VPN connection, however, they are not on the same network.

I forgot to include my client config and router firewall info:

Client config:

remote XX.X.XXX.XX 1194

client 
remote-cert-tls server 
dev tun0 
proto udp 
resolv-retry infinite 
nobind 
persist-key 
persist-tun 
float 

ca ca.crt 
cert Laptop.crt 
key Laptop.key

Firewall:

iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT
iptables -I FORWARD 1 --source 192.168.66.0/24 -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT

parsleybravo

maikcat wrotehi there,

are your client in the SAME network with your server and you are trying to connect by using your routers wan ip?

Michael.

And yes, I am trying to connect using my router's WAN IP (static).

Is there anything in the configs or logs that indicates what I'm doing wrong here?

maikcat

can you disable your firewall for testing?

you must try to connect without being in the same physical network with your openvpn server...

Michael.

parsleybravo

parsleybravo wroteWhen I test the VPN connection, however, they are not on the same network.

When trying to connect via VPN, I am not on the same network. I'm tethering to my phone to test the connection; this is the only other connection available to me without driving to find a WiFi hotspot.

maikcat wrotecan you disable your firewall for testing?

I disabled the router's SPI firewall and tested again. Both the server and client logs show the same results as before.

mwandelaar

Do you have any firewalling on the client?
And can you disable that one allso for testing?

The errors shown in the loggings appears to me that there's no real connection between the server and client. There's no TLS handshake yet.

parsleybravo

mwandelaar wroteDo you have any firewalling on the client?
And can you disable that one allso for testing?

The errors shown in the loggings appears to me that there's no real connection between the server and client. There's no TLS handshake yet.

I do run Avast IS on the client machine, and Windows Firewall is also enabled.

I disabled both firewalls on the client machine, as well as the router's SPI firewall, and retested.

Same results.

parsleybravo

Nothing? No recommendations other than "try disabling your firewalls"?

maikcat

TLS errors,from my expirience comes from:

firewall somewhere drops packets,

or by cheap routers with problematic NAT implementation...

if your setup worked and suddenly stoped working i would try simply to
reboot my router... (it had worked for me noumerous times)

you can also use wireshark on your server and try to track down what
is happening with packets recieved...

Michael.

mwandelaar

The only other options i see are:

trying to connect to the server while on the same network, i.e. plugin both server and client onto the same switch. This might create problems after a succesfull connection, but can rule-out problems with routers/NAT etc. Oh, and please try this with all firewalls disabled.

Using a high level of verbosity if the above does not give you a correct setup, and only in that setup. use somthing like "verb 5" and see what the errors are.

It might be usefull to run wireshark / tcpdump on the system(s) when connecting and see the pcap's to trace back what's really going on. But that's more of a last resort to go through, though.

Please let us know.

parsleybravo

Thanks for the replies and the advice. I'm tearing my hair out trying to get this to work.

mwandelaar wrotetrying to connect to the server while on the same network, i.e. plugin both server and client onto the same switch. This might create problems after a succesfull connection, but can rule-out problems with routers/NAT etc. Oh, and please try this with all firewalls disabled.

I have tried this... sort of. The server is running ON the switch (DD-WRT firmware, OpenVPN server daemon). For the client, I have tried while connected via ethernet and via wireless. Results are the same. Firewalls (router SPI and client software) disabled.

mwandelaar wroteUsing a high level of verbosity if the above does not give you a correct setup, and only in that setup. use somthing like "verb 5" and see what the errors are.

By "only in that setup," you mean using the configs I posted above?

mwandelaar wroteIt might be usefull to run wireshark / tcpdump on the system(s) when connecting and see the pcap's to trace back what's really going on.

I haven't found a way to run on the server side because the server daemon is running on the router.

I don't know if this is an indication of anything, but I am able to successfully setup and connect to a PPTP VPN on the same router. I flashed an updated DD-WRT firmware to see if that was the problem, but the new firmware did not include the OpenVPN daemons. I might try rolling back to the old firmware and see if I can get a PPTP up and running.

q8_legend

I'm having exactly the same problem, without any luck of success 🙁

So, what can I do ?? is there is another way to implement the openvpn ??

I need to setup a secure vpn server within my router(WNDR3700v2 with ddwrt) that use SSL/TLS encryption . so that I can use it easily every where without facing a blocking issue ..

I hope I can get a fix for my problem..

Thanks

mwandelaar

For both of the problems:

Please connect server and client to the same switch, if possible (running the vpn-server on the router
Add verb 5 to the configfiles
Disable all firewalls / virusscanners*
and try the connection.

If the problem still exists, post the logfile here (or link to pastebin or something)

*) Virusscanners, or mallware scanners, as they might man-in-the-middle ssl-connections to scan for malicious code

q8_legend

mwandelaar wroteFor both of the problems:

Please connect server and client to the same switch, if possible (running the vpn-server on the router
Add verb 5 to the configfiles
Disable all firewalls / virusscanners*
and try the connection.

If the problem still exists, post the logfile here (or link to pastebin or something)

*) Virusscanners, or mallware scanners, as they might man-in-the-middle ssl-connections to scan for malicious code

Finally. I got it to be connected but unfortunately without a routing!!

I will post a new post now, since its independent to this subject

blast14

hi anyone please help me how to fix this
Thu Aug 13 13:14:05 2015 YengVPN i686-pc-mingw32 [SSL] [LZO2] built on Jun 25 2015
Thu Aug 13 13:14:06 2015 Control Channel MTU parms [ L:1543 D:140 EF:40 EB:0 ET:0 EL:0 ]
Thu Aug 13 13:14:06 2015 Socket Buffers: R=[8192->8192] S=[8192->8192]
Thu Aug 13 13:14:06 2015 Data Channel MTU parms [ L:1543 D:1450 EF:43 EB:4 ET:0 EL:0 ]
Thu Aug 13 13:14:06 2015 Local Options hash (VER=V4): 'db02a8f8'
Thu Aug 13 13:14:06 2015 Expected Remote Options hash (VER=V4): '7e068940'
Thu Aug 13 13:14:06 2015 Attempting to establish TCP connection with 54.246.10.2:443
Thu Aug 13 13:14:06 2015 TCP connection established with 54.246.10.2:443
Thu Aug 13 13:14:06 2015 TCPv4_CLIENT link local: [undef]
Thu Aug 13 13:14:06 2015 TCPv4_CLIENT link remote: 0.0.0.0:0
Thu Aug 13 13:14:36 2015 TLS Error: TLS key negotiation failed to occur within 30 seconds (check your network connectivity)
Thu Aug 13 13:14:36 2015 TLS Error: TLS handshake failed
Thu Aug 13 13:14:36 2015 Fatal TLS error (check_tls_errors_co), restarting
Thu Aug 13 13:14:36 2015 TCP/UDP: Closing socket
Thu Aug 13 13:14:36 2015 SIGUSR1[soft,tls-error] received, process restarting
Thu Aug 13 13:14:36 2015 Restart pause, 5 second(s)
Thu Aug 13 13:14:41 2015 Re-using SSL/TLS context
Thu Aug 13 13:14:41 2015 Control Channel MTU parms [ L:1543 D:140 EF:40 EB:0 ET:0 EL:0 ]
Thu Aug 13 13:14:41 2015 Socket Buffers: R=[8192->8192] S=[8192->8192]
Thu Aug 13 13:14:41 2015 Data Channel MTU parms [ L:1543 D:1450 EF:43 EB:4 ET:0 EL:0 ]
Thu Aug 13 13:14:41 2015 Local Options hash (VER=V4): 'db02a8f8'
Thu Aug 13 13:14:41 2015 Expected Remote Options hash (VER=V4): '7e068940'
Thu Aug 13 13:14:41 2015 Attempting to establish TCP connection with 54.246.10.2:443
Thu Aug 13 13:14:42 2015 TCP connection established with 54.246.10.2:443
Thu Aug 13 13:14:42 2015 TCPv4_CLIENT link local: [undef]
Thu Aug 13 13:14:42 2015 TCPv4_CLIENT link remote: 0.0.0.0:0