[Resolved] Server Blocking Incoming VPN Connections

illyb

I have recently added a Linksys router equipped with DD-WRT v24-sp2 (04/07/12) mega (svn r18946M VINT Eko) to my network as my gateway router to the Internet (via a Comcast cable modem). On the LAN side of my network, I have an Apple Time Machine that serves as both my network switch and wireless access point. Currently, I have the Linksys router set up as the DHCP server and the Time Capsule set in a bridge mode, though I intend to change the network configuration to a static route between the Linksys and the Time Capsule, and move the DHCP server to the Time Capsule.

My overall goal is to be able to remotely connect to my network (via VPN) as to access the contents of the Time Capsule storage and the devices connected wirelessly to the Time Capsule.

A rundown of my network as it stands now:
- Linksys: 10.0.1.1 (10.0.1.0/255.255.248.0)
- Time Capsule: 10.0.1.94
Wireless Network 1: 10.0.1.10 - 10.0.1.254
Wireless Network 2 (Not in Use right now): 172.16.42.10- 172.16.42.10

Additionally, I have planned on a VPN subnet of 10.0.2.0/255.255.255.0.

After much tweaking of my OpenVPN config files on both client and server OpenVPN software, I am unable to connect to my VPN. The following log is generated by my client (Viscosity) when I attempt to connect to the OpenVPN server.

———————
Jan 25 23:37:04: Viscosity Mac 1.4.7 (1159)
Jan 25 23:37:04: Viscosity OpenVPN Engine Started
Jan 25 23:37:04: Running on Mac OS X 10.9.1
Jan 25 23:37:04: ---------
Jan 25 23:37:04: Checking reachability status of connection...
Jan 25 23:37:04: Connection is reachable. Starting connection attempt.
Jan 25 23:37:07: OpenVPN 2.3.2 i386-apple-darwin [SSL (OpenSSL)] [LZO] [PKCS11] [MH] [IPv6] built on Jun 7 2013
Jan 25 23:37:06: WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Jan 25 23:37:23: WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Jan 25 23:37:23: UDPv4 link local: [undef]
Jan 25 23:37:23: UDPv4 link remote: [AF_INET]www.xxx.yyy.zzz:1194
Jan 25 23:38:23: TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Jan 25 23:38:23: TLS Error: TLS handshake failed
Jan 25 23:38:23: SIGUSR1[soft,tls-error] received, process restarting
—————

(Never mind the server certificate verification method or password caching warnings… I know they are issues and I will fix them once I can get baseline VPN connectivity working.)

Diving a bit deeper, I took a Wireshark capture of the communication between the client and the OpenVPN server. After a successful DNS lookup, the first packet that the client sends to the server contains a P_CONTROL_HARD_RESET_CLIENT_V2 command sent to port 1194 on the server. The server then response with a ICMP Destination Unreachable (Port Unreachable) response.

I have the SPI firewall enabled on the router, but haven’t explicitly configured it to block anything. I have the following commands run by my router to set up the firewall for OpenVPN connections.

——————
iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT
iptables -I FORWARD 1 --source 10.0.1.0/24 -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT
———————

My client config:
———————
#viscosity startonopen false
#viscosity dhcp true
#viscosity dnssupport true
#viscosity name qwerty
key key.key
cert cert.crt
ca ca.crt
remote qwerty.com 1194 udp
persist-key
tls-client
pull
redirect-gateway def1
dev tun
persist-tun
comp-lzo no
nobind
cipher aes-256-cbc
auth sha512
———————

My server config:
———————
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
keepalive 10 120
verb 4
mute 5
log-append /var/log/openvpn
writepid /var/log/openvpnd.pid
management 127.0.0.1 5002
management-log-cache 50
mtu-disc yes
topology subnet
client-config-dir /tmp/openvpn/ccd
script-security 2
port 1194
proto udp
cipher aes-256-cbc
auth sha512
tls-server
ifconfig-pool-persist /tmp/openvpn/ip-pool 86400
client-to-client
push "redirect-gateway def1"
fast-io
tun-mtu 1500
server 10.0.2.0 255.255.255.0
dev tun0
———————

What do I have wrong? How can I get my VPN up and running? Thanks in advance for any assistance!

illyb

I still am unable to connect once I disable the SPI firewall and change the client configuration.

I have run Wireshark captures on my client while attempting to connect to my OpenVPN server, and all that happens (once the DNS lookup completes) is that the client sends a P_CONTROL_HARD_RESET_CLIENT_V2 command sent to port 1194 on the server. The server then response with a ICMP Destination Unreachable (Port Unreachable) response. This happens repeatedly, and eventually the client errors the same way it has all along.

Any other ideas? Are there any DD-WRT settings I need to check to make sure they are set properly?

Could my ISP (Comcast) be blocking OpenVPN services?

illyb

debbie10t wroteThis means that there is no process listening on the port you attempted to connect to on what ever device was the last device to receive the packet.

Good find ... OpenVPN does not appear to be starting on my DD-WRT router. I will ask the same question on a DD-WRT forum, but does anyone know how to debug the issue? I am running DD-WRT v24-sp2 (04/07/12) mega (svn r18946M VINT Eko). I have over 4k of NVRAM available.

Thanks in advance.

illyb

debbie10t wroteCan you post your server log: log-append /var/log/openvpn

Also, using log-append could have used all your RAM, try using log /var/log/openvpn.log and delete your old log.

Current contents of /var/log/openvpn:

Mon Feb 10 04:30:27 2014 us=890129 OpenVPN 2.2.1 mipsel-linux [SSL] [LZO2] [EPOLL] built on Apr  7 2012
Mon Feb 10 04:30:27 2014 us=892812 MANAGEMENT: TCP Socket listening on 127.0.0.1:5002
Mon Feb 10 04:30:27 2014 us=897421 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Mon Feb 10 04:30:29 2014 us=991041 Diffie-Hellman initialized with 2048 bit key
Mon Feb 10 04:30:30 2014 us=247 Cannot load private key file /tmp/openvpn/key.pem: error:0906B072:lib(9):func(107):reason(114): error:140B0009:lib(20):func(176):reason(9)
Mon Feb 10 04:30:30 2014 us=1973 Error: private key password verification failed
Mon Feb 10 04:30:30 2014 us=2503 Exiting

I used openssl to generate all of my certs, keys, and dh files. It looks like the passphrase I put on the server private key file is causing the problem... yes? The file at /tmp/openvpn/key.pem exists with permissions 644.

illyb

I took the passphrase off the server private key and am making forward progress--though I still have a ways to go. My client can "connect" to the server, but I am unable to do anything useful with the connection. What I observed during my first "successful" connection: the client connected, but I was unable to do anything (e.g. access network resources, access the internet within the VPN tunnel, etc.). Eventually the connection timed out, it appears, and the server rebooted. Below is the log from the server that was taken during the test connection.

Wed Feb 12 04:30:23 2014 us=696366 OpenVPN 2.2.1 mipsel-linux [SSL] [LZO2] [EPOLL] built on Apr  7 2012
Wed Feb 12 04:30:23 2014 us=699053 MANAGEMENT: TCP Socket listening on 127.0.0.1:5002
Wed Feb 12 04:30:23 2014 us=703325 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Wed Feb 12 04:30:25 2014 us=690199 Diffie-Hellman initialized with 2048 bit key
Wed Feb 12 04:30:25 2014 us=699232 WARNING: file '/tmp/openvpn/key.pem' is group or others accessible
Wed Feb 12 04:30:25 2014 us=717471 TLS-Auth MTU parms [ L:1601 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed Feb 12 04:30:25 2014 us=718428 Socket Buffers: R=[109568->131072] S=[109568->131072]
Wed Feb 12 04:30:25 2014 us=756185 TUN/TAP device tun0 opened
Wed Feb 12 04:30:25 2014 us=756954 TUN/TAP TX queue length set to 100
Wed Feb 12 04:30:25 2014 us=758466 /sbin/ifconfig tun0 10.0.2.1 netmask 255.255.255.0 mtu 1500 broadcast 10.0.2.255
Wed Feb 12 04:30:25 2014 us=924493 Data Channel MTU parms [ L:1601 D:1450 EF:101 EB:4 ET:0 EL:0 ]
Wed Feb 12 04:30:25 2014 us=979998 UDPv4 link local (bound): [undef]:1194
Wed Feb 12 04:30:25 2014 us=980833 UDPv4 link remote: [undef]
Wed Feb 12 04:30:25 2014 us=981635 MULTI: multi_init called, r=256 v=256
Wed Feb 12 04:30:25 2014 us=983480 IFCONFIG POOL: base=10.0.2.2 size=252
Wed Feb 12 04:30:25 2014 us=984290 IFCONFIG POOL LIST
Wed Feb 12 04:30:25 2014 us=986135 Initialization Sequence Completed
Wed Feb 12 20:48:13 2014 us=904371 MULTI: multi_create_instance called
Wed Feb 12 20:48:13 2014 us=905881 xxx.xxx.xxx.xxx:50797 Re-using SSL/TLS context
Wed Feb 12 20:48:13 2014 us=912211 xxx.xxx.xxx.xxx:50797 Control Channel MTU parms [ L:1601 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed Feb 12 20:48:13 2014 us=913005 xxx.xxx.xxx.xxx:50797 Data Channel MTU parms [ L:1601 D:1450 EF:101 EB:4 ET:0 EL:0 ]
Wed Feb 12 20:48:13 2014 us=915109 xxx.xxx.xxx.xxx:50797 Local Options String: 'V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-
server'
Wed Feb 12 20:48:13 2014 us=915726 xxx.xxx.xxx.xxx:50797 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA512,keysize 256,key-met
hod 2,tls-client'
Wed Feb 12 20:48:13 2014 us=917029 xxx.xxx.xxx.xxx:50797 Local Options hash (VER=V4): 'aafdd1dc'
Wed Feb 12 20:48:13 2014 us=918149 xxx.xxx.xxx.xxx:50797 Expected Remote Options hash (VER=V4): 'fdf9820a'
RWed Feb 12 20:48:13 2014 us=920042 xxx.xxx.xxx.xxx:50797 TLS: Initial packet from xxx.xxx.xxx.xxx:50797, sid=d03da473 0d0248ea
WRRWRWRWWWWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRRRRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWed Feb 12 20:48:17 2014 us=269453 xxx.xxx.xxx.xxx:50797 VERIFY OK: depth=1, /C=US/ST=
ST/L=L/O=O/OU=OU/CN=O_ROOT_CA
Wed Feb 12 20:48:17 2014 us=292091 xxx.xxx.xxx.xxx:50797 VERIFY OK: depth=0, /C=US/ST=ST/O=O/OU=OU/CN=CN/emailAddress=EM
WRWRWRWRWRWRWWWWRWRWRWRWRWRWRWRWRWRWRRRRWRWRWRWed Feb 12 20:48:19 2014 us=368649 xxx.xxx.xxx.xxx:50797 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1601', remote='link-mtu 1558'
Wed Feb 12 20:48:19 2014 us=370815 xxx.xxx.xxx.xxx:50797 WARNING: 'auth' is used inconsistently, local='auth SHA512', remote='auth SHA1'
Wed Feb 12 20:48:19 2014 us=374122 xxx.xxx.xxx.xxx:50797 WARNING: 'comp-lzo' is present in remote config but missing in local config, remote='comp-lzo'
Wed Feb 12 20:48:19 2014 us=384381 xxx.xxx.xxx.xxx:50797 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Feb 12 20:48:19 2014 us=385417 xxx.xxx.xxx.xxx:50797 Data Channel Encrypt: Using 512 bit message hash 'SHA512' for HMAC authentication
Wed Feb 12 20:48:19 2014 us=386210 xxx.xxx.xxx.xxx:50797 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Feb 12 20:48:19 2014 us=387236 xxx.xxx.xxx.xxx:50797 Data Channel Decrypt: Using 512 bit message hash 'SHA512' for HMAC authentication
WWWRRRWed Feb 12 20:48:19 2014 us=421313 xxx.xxx.xxx.xxx:50797 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Wed Feb 12 20:48:19 2014 us=422603 xxx.xxx.xxx.xxx:50797 [CN] Peer Connection Initiated with xxx.xxx.xxx.xxx:50797
Wed Feb 12 20:48:19 2014 us=426421 CN/xxx.xxx.xxx.xxx:50797 MULTI: Learn: 10.0.2.2 -> CN/xxx.xxx.xxx.xxx:50797
Wed Feb 12 20:48:19 2014 us=427312 CN/xxx.xxx.xxx.xxx:50797 MULTI: primary virtual IP for CN/xxx.xxx.xxx.xxx:50797: 10.0.2.2
RWed Feb 12 20:48:21 2014 us=586471 CN/xxx.xxx.xxx.xxx:50797 PUSH: Received control message: 'PUSH_REQUEST'
Wed Feb 12 20:48:21 2014 us=588672 CN/xxx.xxx.xxx.xxx:50797 SENT CONTROL [CN]: 'PUSH_REPLY,redirect-gateway def1,route-gateway 10.0.2.1,topology subnet,ping 10,ping-restar
t 120,ifconfig 10.0.2.2 255.255.255.0' (status=1)
WWWWRRRRWed Feb 12 20:48:27 2014 us=84611 CN/xxx.xxx.xxx.xxx:50797 Authenticate/Decrypt packet error: packet HMAC authentication failed
RWed Feb 12 20:48:27 2014 us=713070 CN/xxx.xxx.xxx.xxx:50797 Authenticate/Decrypt packet error: packet HMAC authentication failed
RWed Feb 12 20:48:28 2014 us=157695 CN/xxx.xxx.xxx.xxx:50797 Authenticate/Decrypt packet error: packet HMAC authentication failed
RWed Feb 12 20:48:29 2014 us=165098 CN/xxx.xxx.xxx.xxx:50797 Authenticate/Decrypt packet error: packet HMAC authentication failed
RWed Feb 12 20:48:30 2014 us=189244 CN/xxx.xxx.xxx.xxx:50797 Authenticate/Decrypt packet error: packet HMAC authentication failed
RWed Feb 12 20:48:31 2014 us=180825 CN/xxx.xxx.xxx.xxx:50797 NOTE: --mute triggered...
WRRWRWRWRRRRRRRWRRWRWRRRRRRRWRWRWRRRRRRRRWRWWed Feb 12 20:50:22 2014 us=973132 33 variation(s) on previous 5 message(s) suppressed by --mute
Wed Feb 12 20:50:22 2014 us=973977 read UDPv4 [ECONNREFUSED]: Connection refused (code=146)
WWed Feb 12 20:50:32 2014 us=296323 read UDPv4 [ECONNREFUSED]: Connection refused (code=146)
WWed Feb 12 20:50:42 2014 us=534120 read UDPv4 [ECONNREFUSED]: Connection refused (code=146)
WWed Feb 12 20:50:52 2014 us=879058 read UDPv4 [ECONNREFUSED]: Connection refused (code=146)
WWed Feb 12 20:51:03 2014 us=117499 read UDPv4 [ECONNREFUSED]: Connection refused (code=146)
WWed Feb 12 20:51:13 2014 us=285648 NOTE: --mute triggered...
WWWWWWWed Feb 12 20:52:21 2014 us=600816 CN/xxx.xxx.xxx.xxx:50797 7 variation(s) on previous 5 message(s) suppressed by --mute
Wed Feb 12 20:52:21 2014 us=601472 CN/xxx.xxx.xxx.xxx:50797 [CN] Inactivity timeout (--ping-restart), restarting
Wed Feb 12 20:52:21 2014 us=602114 CN/xxx.xxx.xxx.xxx:50797 SIGUSR1[soft,ping-restart] received, client-instance restarting

I believe I have addressed the warnings listed above in the log file. Here are my current config files.

Server:

dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
keepalive 10 120
mute 5
log /var/log/openvpn
writepid /var/log/openvpnd.pid
management 127.0.0.1 5002
management-log-cache 50
mtu-disc yes
topology subnet
client-config-dir /tmp/openvpn/ccd
script-security 2
port 1194
proto udp
cipher aes-256-cbc
auth sha512
tls-server
ifconfig-pool-persist /tmp/openvpn/ip-pool 86400
comp-lzo no
client-to-client
push "redirect-gateway def1"
fast-io
tun-mtu 1500
server 10.0.2.0 255.255.255.0
dev tun0
verb 5

Client:

#viscosity startonopen false
#viscosity dhcp true
#viscosity dnssupport true
#viscosity name qwerty
remote qwerty.com 1194 
proto udp
pull
tls-client
persist-key
ca ca.crt
redirect-gateway def1
dev tun
persist-tun
cert cert.crt
comp-lzo no
nobind
key key.key
cipher aes-256-cbc
tun-mtu 1500
auth sha512

Will the changes I have made take care of the HMAC authentication errors noted in the server log file? Will the changes resolve the error I experienced? Should I add my iptables config back in to make the VPN tunnel usable?

illyb

Correction: the server has the line

comp-lzo no

in its config file in addition to the config file text in my previous post.

CR1T1C4L718

Make sure that version is not broke with VPN....meaning I tried MEGA build and with a certain version for my router it would not work at all, it wasn't until I tried a different version did it work.

Sent from my potato.

illyb

CR1T1C4L718 wroteMake sure that version is not broke with VPN....meaning I tried MEGA build and with a certain version for my router it would not work at all, it wasn't until I tried a different version did it work.

Sent from my potato.

How do I find out if the VPN capability is broken for my build?

illyb

I added my iptables config back in and I am up and running. Thanks to all for your help!

illyb

debbie10t wrotePresumably, you also rectified these issues:
illyb wroteWed Feb 12 20:48:19 2014 --- WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1601', remote='link-mtu 1558'
Wed Feb 12 20:48:19 2014 --- WARNING: 'auth' is used inconsistently, local='auth SHA512', remote='auth SHA1'
Wed Feb 12 20:48:19 2014 --- WARNING: 'comp-lzo' is present in remote config but missing in local config, remote='comp-lzo'

Yes, I sure did.