I have setup an openvpn server on a VPS, it is running OpenVPN 2.3.2
OpenVPN 2.3.2 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Sep 12 2013
Originally developed by James Yonan
Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <
sales@openvpn.net>
Compile time defines: enable_crypto=yes enable_debug=yes enable_def_auth=yes enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown enable_eurephia=yes enable_fast_install=yes enable_fragment=yes enable_http_proxy=yes enable_iproute2=yes enable_libtool_lock=yes enable_lzo=yes enable_lzo_stub=no enable_management=yes enable_multi=yes enable_multihome=yes enable_pam_dlopen=no enable_password_save=yes enable_pedantic=no enable_pf=yes enable_pkcs11=yes enable_plugin_auth_pam=yes enable_plugin_down_root=yes enable_plugins=yes enable_port_share=yes enable_pthread=yes enable_selinux=no enable_server=yes enable_shared=yes enable_shared_with_static_runtimes=no enable_small=no enable_socks=yes enable_ssl=yes enable_static=yes enable_strict=no enable_strict_options=no enable_systemd=no enable_win32_dll=yes enable_x509_alt_username=yes with_crypto_library=openssl with_gnu_ld=yes with_iproute_path=/sbin/ip with_mem_check=no with_plugindir='$(libdir)/openvpn/plugins' with_sysroot=no
I tried following the guide here:
https://www.digitalocean.com/community/articles/how-to-setup-and-configure-an-openvpn-server-on-centos-6
and it starts fine, but when connecting it never completes the handshake. It shows:
Sat Jan 4 19:07:32 2014 us=797155 MULTI: multi_create_instance called
Sat Jan 4 19:07:32 2014 us=797238 50.172.149.100:55085 Re-using SSL/TLS context
Sat Jan 4 19:07:32 2014 us=797254 50.172.149.100:55085 LZO compression initialized
Sat Jan 4 19:07:32 2014 us=797312 50.172.149.100:55085 Control Channel MTU parms [ L:1558 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sat Jan 4 19:07:32 2014 us=797337 50.172.149.100:55085 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Sat Jan 4 19:07:32 2014 us=797466 50.172.149.100:55085 Local Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-server'
Sat Jan 4 19:07:32 2014 us=797489 50.172.149.100:55085 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-client'
Sat Jan 4 19:07:32 2014 us=797531 50.172.149.100:55085 Local Options hash (VER=V4): 'a8f55717'
Sat Jan 4 19:07:32 2014 us=797555 50.172.149.100:55085 Expected Remote Options hash (VER=V4): '22188c5b'
RSat Jan 4 19:07:32 2014 us=797605 50.172.149.100:55085 TLS: Initial packet from [AF_INET]50.172.149.100:55085, sid=adc4f98c fad1660e
WWRWRWRWWWRWSat Jan 4 19:08:32 2014 us=458488 50.172.149.100:55085 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sat Jan 4 19:08:32 2014 us=458629 50.172.149.100:55085 TLS Error: TLS handshake failed
Sat Jan 4 19:08:32 2014 us=458734 50.172.149.100:55085 SIGUSR1[soft,tls-error] received, client-instance restarting
Sat Jan 4 19:08:34 2014 us=651378 MULTI: multi_create_instance called
Sat Jan 4 19:08:34 2014 us=651473 50.172.149.100:55086 Re-using SSL/TLS context
Sat Jan 4 19:08:34 2014 us=651531 50.172.149.100:55086 LZO compression initialized
Sat Jan 4 19:08:34 2014 us=651622 50.172.149.100:55086 Control Channel MTU parms [ L:1558 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sat Jan 4 19:08:34 2014 us=651648 50.172.149.100:55086 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Sat Jan 4 19:08:34 2014 us=651787 50.172.149.100:55086 Local Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-server'
Sat Jan 4 19:08:34 2014 us=651813 50.172.149.100:55086 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-client'
Sat Jan 4 19:08:34 2014 us=651839 50.172.149.100:55086 Local Options hash (VER=V4): 'a8f55717'
Sat Jan 4 19:08:34 2014 us=651857 50.172.149.100:55086 Expected Remote Options hash (VER=V4): '22188c5b'
RSat Jan 4 19:08:34 2014 us=651886 50.172.149.100:55086 TLS: Initial packet from [AF_INET]50.172.149.100:55086, sid=c36dba5f 070483e0
WWRWRWRWWWRW
and the client is showing something similar. There is no firewall between them, though there is a NAT. It obviously is connecting enough to start the TLS handshake, I just have no idea why it is failing, it seems to be timing out.
