[Solved] Which ports do I need to route for openvpn to work?

nathaniel

I have OpenVPN configured on one of server. The server is part of an installation among many others. The VPN should let me access the servers network directly, e.g. directly ping them. To connect, I opened port 1194 for udp on iptables, but I still get the message "tls negotiation failed to occur within 60 seconds.".

I think this is because OpenVPN might need another port. When I start the client, I get traffic to the server on port 443.
Which ports do I need to open for OpenVPN to work?

Log output on client:

Thu Nov 21 15:09:32 2013 OpenVPN 2.3.2 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Aug  8 2013
Thu Nov 21 15:09:32 2013 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Thu Nov 21 15:09:32 2013 UDPv4 link local (bound): [undef]
Thu Nov 21 15:09:32 2013 UDPv4 link remote: [AF_INET]XX.XX.XX.XX:1194
Thu Nov 21 15:10:33 2013 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Thu Nov 21 15:10:33 2013 TLS Error: TLS handshake failed
Thu Nov 21 15:11:17 2013 SIGTERM[hard,] received, process exiting

Server config:

port 1194
proto udp
dev tun
server 10.0.0.0 255.255.255.0
comp-lzo
keepalive 10 60
ca ca.crt
dh dh2048.pem
key vpn.key
cert vpn.crt
push "route 192.168.0.0 255.255.255.0"

Client config:

port 1194
remote XX.XX.XX.XX
proto udp
client
comp-lzo
dev tun
ca ca.crt
key vpn.key
cert vpn.crt

Any suggestions?

nathaniel

No, I don't use the access server. I just use the normal package of openvpn from the debian repositories.

Any other suggestions on where the problem may be or which (other) ports I should try to open? Maybe tcp?

nathaniel

debbie10t wrote
nathaniel wroteAny other suggestions on where the problem may be
You do not have a TLS key, read the HOWTO, specifically this part:
http://openvpn.net/index.php/open-source/documentation/howto.html#security

Thanks a lot for the answer.

Just for clarification, in my understanding, I assumed the tls key is optional and therefore, it should work without one?

nathaniel

You do not have a TLS key

Added one, didn't solve the problem. Still the same error message.

Also, I still get a "Warning: No server certificate verification method has been enabled...". This is not so bad in my case because the keys are transferred only once and by using a secure channel.
I now get "Control Channel Authentication: using 'keys\ta.key' as a OpenVPN static key file" which is expected I think.

nathaniel

Issue solved.

It was quite complicated where a side effect of another application running lead to no traffic reaching the vpn server. I changed the port, it worked.