rivimey
Folks,
I have been setting up a VPN Client solution for our AWS hosted VMs so they can access external private servers. I have succeeded in making a configuration file that looks reasonable, and the openvpn process reads it and tries to contact to the external vpn's IP address. The OpenVPN log says it is trying to authenticate TLS. However, it never succeeds in doing so.
Could this be because the AWS uses NAT, so the instance sees IPs like 10.76.189.167 but the external vpn server will see packets coming from another address - e.g. 54.83.22.196
If so, and given that I have no access to the external VPN server's configuration, have you any idea how I might make the setup work?
If it is any help, I know a very similar config works ok when using tunnelblick from a Mac.
Log Entry:
Tue Nov 26 11:58:55 2013 OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Feb 27 2013
Tue Nov 26 11:58:55 2013 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Tue Nov 26 11:58:55 2013 WARNING: file '/etc/openvpn/client.key' is group or others accessible
Tue Nov 26 11:58:55 2013 LZO compression initialized
Tue Nov 26 11:58:55 2013 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Tue Nov 26 11:58:55 2013 UDPv4 link local (bound): [undef]
Tue Nov 26 11:58:55 2013 UDPv4 link remote: [AF_INET]171.67.125.14:1194
Tue Nov 26 11:59:55 2013 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Tue Nov 26 11:59:55 2013 TLS Error: TLS handshake failed
My client config:
client
port 1194
proto udp
dev tap
keepalive 10 120
comp-lzo
remote 171.68.125.14
ca /etc/openvpn/ca.crt
cert /etc/openvpn/client.crt
key /etc/openvpn/client.key
tls-cipher DHE-RSA-AES256-SHA
cipher AES-256-CBC
ns-cert-type server
user root
group root
persist-key
persist-tun
resolv-retry infinite
status /etc/openvpn/openvpn-status.log
log-append /var/log/openvpn.log
verb 1
mute 10
