Folks - The last time I tried setting up VPN back in Nov '11, I ran into issues and gave up. 🙁 This has been in my back burner for a while and I desperately wanna have this working. Your time and help is much appreciated. 🙂
Whenever I try and connect, I keep getting a TLS handshake failed error.
Here's some basic info -
Key reference site:
http://www.dd-wrt.com/wiki/index.php/VPN_(the_easy_way)_v24%2B
Mac OSX 10.8.3
Router: Linksys Firmware: DD-WRT v24-sp2 (12/20/11) vpn-small
Tunnelblick 3.3beta36 (build 3228) - OpenVPN 2.2.1
Firewall Rules
iptables -t nat -A POSTROUTING -j MASQUERADE
iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT
iptables -I FORWARD 1 --source 192.168.66.0/24 -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT
Server Config
push "route 192.168.1.0 255.255.255.0"
#push "dhcp-option DNS 192.168.66.1"
server 192.168.66.0 255.255.255.0
dev tun0
proto udp
port 1194
keepalive 15 60
daemon
verb 4
comp-lzo
client-to-client
duplicate-cn
tls-server
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
Client Config
client
dev tun0
proto udp
remote <XYZ> 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ns-cert-type server
comp-lzo
verb 4
float
ca ca.crt
cert client1.crt
key client1.key
#cipher AES-512-CBC
Troubleshooting Steps
#Command for logs: ln -s /tmp/var/log/messages /tmp/www/log.html
Command: ps | grep openvpn
Result: 1463 root 1048 S grep openvpn
Command: cat /var/log/messages | grep openvpn
Result:
Mar 30 15:05:29 <Router Name> daemon.notice openvpn[1383]: OpenVPN 2.2.1 mipsel-linux [SSL] [LZO2] built on Dec 20 2011
Mar 30 15:05:29 <Router Name> daemon.warn openvpn[1383]: NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mar 30 15:05:30 <Router Name> daemon.notice openvpn[1383]: Diffie-Hellman initialized with 2048 bit key
Mar 30 15:05:30 <Router Name> daemon.warn openvpn[1383]: WARNING: file '/tmp/openvpn/key.pem' is group or others accessible
Mar 30 15:05:30 <Router Name> daemon.notice openvpn[1383]: TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mar 30 15:05:30 <Router Name> daemon.notice openvpn[1383]: Socket Buffers: R=[114688->131072] S=[114688->131072]
Mar 30 15:05:30 <Router Name> daemon.notice openvpn[1383]: TUN/TAP device tun0 opened
Mar 30 15:05:30 <Router Name> daemon.notice openvpn[1383]: TUN/TAP TX queue length set to 100
Mar 30 15:05:30 <Router Name> daemon.notice openvpn[1383]: /sbin/ifconfig tun0 192.168.66.1 pointopoint 192.168.66.2 mtu 1500
Mar 30 15:05:30 <Router Name> daemon.notice openvpn[1383]: /tmp/openvpn/route-up.sh tun0 1500 1542 192.168.66.1 192.168.66.2 init
Mar 30 15:05:30 <Router Name> daemon.warn openvpn[1383]: WARNING: External program may not be called unless '--script-security 2' or higher is enabled. Use '--script-security 3 system' for backward compatibility with 2.1_rc8 and earlier. See --
elp text or man page for detai
Mar 30 15:05:30 <Router Name> daemon.err openvpn[1383]: WARNING: Failed running command (--up/--down): external program fork failed
Mar 30 15:05:30 <Router Name> daemon.notice openvpn[1383]: Exiting
Command: iptables -t nat -L -n -v
Result:
Chain PREROUTING (policy ACCEPT 90 packets, 9251 bytes)
pkts bytes target prot opt in out source destination
0 0 DNAT icmp -- * * 0.0.0.0/0 <WAN IP> to:192.168.1.1
0 0 DNAT tcp -- * * 0.0.0.0/0 <WAN IP> tcp dpt:8080 to:192.168.1.110:80
0 0 DNAT udp -- * * 0.0.0.0/0 <WAN IP> udp dpt:8080 to:192.168.1.110:80
0 0 DNAT tcp -- * * 0.0.0.0/0 <WAN IP> tcp dpt:8081 to:192.168.1.240:80
0 0 DNAT udp -- * * 0.0.0.0/0 <WAN IP> udp dpt:8081 to:192.168.1.240:80
0 0 DNAT tcp -- * * 0.0.0.0/0 <WAN IP> tcp dpt:8082 to:192.168.1.241:80
0 0 DNAT udp -- * * 0.0.0.0/0 <WAN IP> udp dpt:8082 to:192.168.1.241:80
0 0 DNAT tcp -- * * 0.0.0.0/0 <WAN IP> tcp dpt:8083 to:192.168.1.242:80
0 0 DNAT udp -- * * 0.0.0.0/0 <WAN IP> udp dpt:8083 to:192.168.1.242:80
0 0 DNAT tcp -- * * 0.0.0.0/0 <WAN IP> tcp dpt:8084 to:192.168.1.243:80
0 0 DNAT udp -- * * 0.0.0.0/0 <WAN IP> udp dpt:8084 to:192.168.1.243:80
0 0 DNAT tcp -- * * 0.0.0.0/0 <WAN IP> tcp dpt:8087 to:192.168.1.120:80
0 0 DNAT udp -- * * 0.0.0.0/0 <WAN IP> udp dpt:8087 to:192.168.1.120:80
0 0 DNAT tcp -- * * 0.0.0.0/0 <WAN IP> tcp dpt:8085 to:192.168.1.244:80
0 0 DNAT udp -- * * 0.0.0.0/0 <WAN IP> udp dpt:8085 to:192.168.1.244:80
0 0 TRIGGER 0 -- * * 0.0.0.0/0 <WAN IP> TRIGGER type:dnat match:0 relate:0
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
21 3073 SNAT 0 -- * vlan2 192.168.1.0/24 0.0.0.0/0 to:<WAN IP>
0 0 RETURN 0 -- * br0 0.0.0.0/0 0.0.0.0/0 PKTTYPE = broadcast
8 564 MASQUERADE 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 8 packets, 564 bytes)
pkts bytes target prot opt in out source destination
Command: iptables -L -v -n --line-numbers
Result:
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 7 294 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:1194
2 3342 310K ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
3 0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:1194
4 0 0 ACCEPT 0 -- tun0 * 0.0.0.0/0 0.0.0.0/0
5 0 0 logdrop udp -- vlan2 * 0.0.0.0/0 0.0.0.0/0 udp dpt:520
6 0 0 logdrop udp -- br0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:520
7 0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:520
8 0 0 logdrop icmp -- vlan2 * 0.0.0.0/0 0.0.0.0/0
9 0 0 logdrop 2 -- * * 0.0.0.0/0 0.0.0.0/0
10 0 0 ACCEPT 0 -- lo * 0.0.0.0/0 0.0.0.0/0 state NEW
11 1019 72216 ACCEPT 0 -- br0 * 0.0.0.0/0 0.0.0.0/0 state NEW
12 140 22306 logdrop 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 ACCEPT 0 -- tun0 br0 0.0.0.0/0 0.0.0.0/0
2 0 0 ACCEPT 0 -- br0 tun0 0.0.0.0/0 0.0.0.0/0
3 0 0 ACCEPT 0 -- * * 192.168.66.0/24 0.0.0.0/0
4 0 0 ACCEPT 47 -- * vlan2 192.168.1.0/24 0.0.0.0/0
5 0 0 ACCEPT tcp -- * vlan2 192.168.1.0/24 0.0.0.0/0 tcp dpt:1723
6 0 0 ACCEPT 0 -- tun0 * 0.0.0.0/0 0.0.0.0/0
7 0 0 ACCEPT 0 -- * tun0 0.0.0.0/0 0.0.0.0/0
8 0 0 ACCEPT 0 -- br0 br0 0.0.0.0/0 0.0.0.0/0
9 401 24036 TCPMSS tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x02 TCPMSS clamp to PMTU
10 5142 2301K lan2wan 0 -- * * 0.0.0.0/0 0.0.0.0/0
11 4573 2250K ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
12 0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.1.110 tcp dpt:80
13 0 0 ACCEPT udp -- * * 0.0.0.0/0 192.168.1.110 udp dpt:80
14 0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.1.240 tcp dpt:80
15 0 0 ACCEPT udp -- * * 0.0.0.0/0 192.168.1.240 udp dpt:80
16 0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.1.241 tcp dpt:80
17 0 0 ACCEPT udp -- * * 0.0.0.0/0 192.168.1.241 udp dpt:80
18 0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.1.242 tcp dpt:80
19 0 0 ACCEPT udp -- * * 0.0.0.0/0 192.168.1.242 udp dpt:80
20 0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.1.243 tcp dpt:80
21 0 0 ACCEPT udp -- * * 0.0.0.0/0 192.168.1.243 udp dpt:80
22 0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.1.120 tcp dpt:80
23 0 0 ACCEPT udp -- * * 0.0.0.0/0 192.168.1.120 udp dpt:80
24 0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.1.244 tcp dpt:80
25 0 0 ACCEPT udp -- * * 0.0.0.0/0 192.168.1.244 udp dpt:80
26 0 0 TRIGGER 0 -- vlan2 br0 0.0.0.0/0 0.0.0.0/0 TRIGGER type:in match:0 relate:0
27 569 50736 trigger_out 0 -- br0 * 0.0.0.0/0 0.0.0.0/0
28 569 50736 ACCEPT 0 -- br0 * 0.0.0.0/0 0.0.0.0/0 state NEW
29 0 0 logdrop 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 4529 packets, 2910K bytes)
num pkts bytes target prot opt in out source destination
Chain advgrp_1 (0 references)
num pkts bytes target prot opt in out source destination
Chain advgrp_10 (0 references)
num pkts bytes target prot opt in out source destination
Chain advgrp_2 (0 references)
num pkts bytes target prot opt in out source destination
Chain advgrp_3 (0 references)
num pkts bytes target prot opt in out source destination
Chain advgrp_4 (0 references)
num pkts bytes target prot opt in out source destination
Chain advgrp_5 (0 references)
num pkts bytes target prot opt in out source destination
Chain advgrp_6 (0 references)
num pkts bytes target prot opt in out source destination
Chain advgrp_7 (0 references)
num pkts bytes target prot opt in out source destination
Chain advgrp_8 (0 references)
num pkts bytes target prot opt in out source destination
Chain advgrp_9 (0 references)
num pkts bytes target prot opt in out source destination
Chain grp_1 (0 references)
num pkts bytes target prot opt in out source destination
Chain grp_10 (0 references)
num pkts bytes target prot opt in out source destination
Chain grp_2 (0 references)
num pkts bytes target prot opt in out source destination
Chain grp_3 (0 references)
num pkts bytes target prot opt in out source destination
Chain grp_4 (0 references)
num pkts bytes target prot opt in out source destination
Chain grp_5 (0 references)
num pkts bytes target prot opt in out source destination
Chain grp_6 (0 references)
num pkts bytes target prot opt in out source destination
Chain grp_7 (0 references)
num pkts bytes target prot opt in out source destination
Chain grp_8 (0 references)
num pkts bytes target prot opt in out source destination
Chain grp_9 (0 references)
num pkts bytes target prot opt in out source destination
Chain lan2wan (1 references)
num pkts bytes target prot opt in out source destination
Chain logaccept (0 references)
num pkts bytes target prot opt in out source destination
1 0 0 LOG 0 -- * * 0.0.0.0/0 0.0.0.0/0 state NEW LOG flags 7 level 4 prefix `ACCEPT '
2 0 0 ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain logbrute (0 references)
num pkts bytes target prot opt in out source destination
1 0 0 0 -- * * 0.0.0.0/0 0.0.0.0/0 recent: SET name: BRUTEFORCE side: source
2 0 0 RETURN 0 -- * * 0.0.0.0/0 0.0.0.0/0 !recent: UPDATE seconds: 60 hit_count: 4 name: BRUTEFORCE side: source
3 0 0 RETURN 0 -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/min burst 1
4 0 0 LOG 0 -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 6 level 4 prefix `[DROP BRUTEFORCE] : '
5 0 0 logdrop 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain logdrop (7 references)
num pkts bytes target prot opt in out source destination
1 62 17952 LOG 0 -- * * 0.0.0.0/0 0.0.0.0/0 state NEW LOG flags 7 level 4 prefix `DROP '
2 78 4354 LOG 0 -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID LOG flags 7 level 4 prefix `DROP '
3 140 22306 DROP 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain logreject (0 references)
num pkts bytes target prot opt in out source destination
1 0 0 LOG 0 -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 7 level 4 prefix `WEBDROP '
2 0 0 REJECT tcp -- * * 0.0.0.0/0 0.0.0.0/0 reject-with tcp-reset
Chain trigger_out (1 references)
num pkts bytes target prot opt in out source destination
Server (dd-wrt) Logs:
Command: cat /var/log/messages
Result:
Mar 30 15:11:12 <Router Name> kern.warn kernel: DROP IN=vlan2 OUT= MAC=<MAC>08:00:45:00:01:48 SRC=<Comcast IP> DST=255.255.255.255 LEN=328 TOS=0x00 PREC=0x00 TTL=64 ID=9014 PROTO=UDP SPT=67 DPT=68 LEN=308
Mar 30 15:11:12 <Router Name> kern.warn kernel: DROP IN=vlan2 OUT= MAC=<MAC>08:00:45:00:01:48 SRC=<Comcast IP> DST=255.255.255.255 LEN=328 TOS=0x00 PREC=0x00 TTL=64 ID=9021 PROTO=UDP SPT=67 DPT=68 LEN=308
Mar 30 15:11:28 <Router Name> kern.warn kernel: DROP IN=vlan2 OUT= MAC=<MAC>08:00:45:00:01:52 SRC=<Comcast IP> DST=255.255.255.255 LEN=338 TOS=0x00 PREC=0x00 TTL=64 ID=11210 PROTO=UDP SPT=67 DPT=68 LEN=318
Mar 30 15:11:28 <Router Name> kern.warn kernel: DROP IN=vlan2 OUT= MAC=<MAC>08:00:45:00:01:52 SRC=<Comcast IP> DST=255.255.255.255 LEN=338 TOS=0x00 PREC=0x00 TTL=64 ID=11221 PROTO=UDP SPT=67 DPT=68 LEN=318
Mar 30 15:12:10 <Router Name> kern.warn kernel: DROP IN=vlan2 OUT= MAC=<MAC>08:00:45:00:01:48 SRC=<Comcast IP> DST=255.255.255.255 LEN=328 TOS=0x00 PREC=0x00 TTL=64 ID=17241 PROTO=UDP SPT=67 DPT=68 LEN=308
Mar 30 15:13:03 <Router Name> kern.warn kernel: DROP IN=vlan2 OUT= MAC=<MAC>08:00:45:00:01:48 SRC=<Comcast IP> DST=255.255.255.255 LEN=328 TOS=0x00 PREC=0x00 TTL=64 ID=24903 PROTO=UDP SPT=67 DPT=68 LEN=308
Mar 30 15:14:41 <Router Name> kern.warn kernel: DROP IN=vlan2 OUT= MAC=<MAC>08:00:45:00:01:48 SRC=<Comcast IP> DST=255.255.255.255 LEN=328 TOS=0x00 PREC=0x00 TTL=64 ID=36348 PROTO=UDP SPT=67 DPT=68 LEN=308
Tunnelblick/Client Logs
2013-03-30 15:11:46 us=99126 max_clients = 1024
2013-03-30 15:11:46 us=99133 max_routes_per_client = 256
2013-03-30 15:11:46 us=99140 auth_user_pass_verify_script = '[UNDEF]'
2013-03-30 15:11:46 us=99146 auth_user_pass_verify_script_via_file = DISABLED
2013-03-30 15:11:46 us=99153 ssl_flags = 0
2013-03-30 15:11:46 us=99160 port_share_host = '[UNDEF]'
2013-03-30 15:11:46 us=99167 port_share_port = 0
2013-03-30 15:11:46 us=99173 client = ENABLED
2013-03-30 15:11:46 us=99180 pull = ENABLED
2013-03-30 15:11:46 us=99187 auth_user_pass_file = '[UNDEF]'
2013-03-30 15:11:46 us=99206 OpenVPN 2.2.1 i386-apple-darwin10.8.0 [SSL] [LZO2] [PKCS11] [eurephia] built on Feb 14 2013
2013-03-30 15:11:46 us=99326 MANAGEMENT: TCP Socket listening on 127.0.0.1:1337
2013-03-30 15:11:46 us=99909 Need hold release from management interface, waiting...
2013-03-30 15:11:46 us=206113 MANAGEMENT: Client connected from 127.0.0.1:1337
2013-03-30 15:11:46 us=215278 MANAGEMENT: CMD 'pid'
2013-03-30 15:11:46 us=215460 MANAGEMENT: CMD 'state on'
2013-03-30 15:11:46 us=215559 MANAGEMENT: CMD 'state'
2013-03-30 15:11:46 us=215676 MANAGEMENT: CMD 'bytecount 1'
2013-03-30 15:11:46 us=215761 MANAGEMENT: CMD 'hold release'
2013-03-30 15:11:46 *Tunnelblick: Established communication with OpenVPN
2013-03-30 15:11:46 us=216037 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2013-03-30 15:11:46 us=260348 LZO compression initialized
2013-03-30 15:11:46 us=260514 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
2013-03-30 15:11:46 us=260665 Socket Buffers: R=[196724->65536] S=[9216->65536]
2013-03-30 15:11:46 us=260975 MANAGEMENT: >STATE:1364681506,RESOLVE,,,
2013-03-30 15:11:46 us=302520 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
2013-03-30 15:11:46 us=302660 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
2013-03-30 15:11:46 us=302711 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
2013-03-30 15:11:46 us=302773 Local Options hash (VER=V4): '41690919'
2013-03-30 15:11:46 us=302842 Expected Remote Options hash (VER=V4): '530fdded'
2013-03-30 15:11:46 us=302908 UDPv4 link local: [undef]
2013-03-30 15:11:46 us=303001 UDPv4 link remote: <WAN IP>:1194
2013-03-30 15:11:46 us=303116 MANAGEMENT: >STATE:1364681506,WAIT,,,
2013-03-30 15:12:46 us=76522 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
2013-03-30 15:12:46 us=76735 TLS Error: TLS handshake failed
2013-03-30 15:12:46 us=76915 TCP/UDP: Closing socket
2013-03-30 15:12:46 us=77022 SIGUSR1[soft,tls-error] received, process restarting
2013-03-30 15:12:46 us=77083 MANAGEMENT: >STATE:1364681566,RECONNECTING,tls-error,,
2013-03-30 15:12:46 us=351422 MANAGEMENT: CMD 'hold release'
2013-03-30 15:12:46 us=351544 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
