Hello,
for several day I have been trying to setup an OpenVPN server on my Linksys WRT54G/GL/GS router running DD-WRT v24-sp2 (08/07/10) vpn - build 14896. (have also been testing all this on the 13064 build)
I have been following this guide:
http://www.dd-wrt.com/wiki/index.php/VPN_%28the_easy_way%29_v24%2B#Creating_Certificates_using_Ubuntu_Linux
In order to generate cerfiticates. (I have done this three times now(!))
Her is the verification output:
/etc/openvpn/easy-rsa/keys$ openssl verify -CAfile ca.crt kalahari.crt
kalahari.crt: OK
Client config (my xxx.no-ip.org = my no-ip DDNS):
client
dev tun0
proto udp
remote xxx.no-ip.org 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ns-cert-type server
comp-lzo
verb 4
float
ca ca.crt
cert kalahari.crt
key kalahari.key
Server config:
push "route 192.168.1.0 255.255.255.0"
push "dhcp-option DNS 192.168.10.1"
server 192.168.10.0 255.255.255.0
dev tun0
proto udp // Have also tried tcp forwarded with input accept (iptables)
keepalive 10 120
verb 5
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
# Only use crl-verify if you are using the revoke list - otherwise leave it commented out
# crl-verify /tmp/openvpn/ca.crl
# management parameter allows DD-WRT's OpenVPN Status web page to access the server's management port
# port must be 5001 for scripts embedded in firmware to work
management localhost 5001
Firewall rules:
iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT
(iptables -I INPUT 1 -p tcp --dport 1194 -j ACCEPT)
iptables -I FORWARD 1 --source 192.168.10.0/24 -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT
OpenVPN seems to be running on the server/router:
29806 root 2404 S openvpn --config /tmp/openvpn/openvpn.conf --route-up /tmp/openvpn/route-up.sh --down /tmp/openvpn/route-down.sh --daemon
Here is the client logfile (xx.xxx.xx.xxx = router IP):
Sun Mar 9 17:18:25 2014 us=265827 OpenVPN 2.3.2 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Jul 12 2013
Sun Mar 9 17:18:25 2014 us=266363 WARNING: file 'kalahari.key' is group or others accessible
Sun Mar 9 17:18:25 2014 us=266507 LZO compression initialized
Sun Mar 9 17:18:25 2014 us=266577 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sun Mar 9 17:18:25 2014 us=266618 Socket Buffers: R=[212992->131072] S=[212992->131072]
Sun Mar 9 17:18:25 2014 us=575237 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sun Mar 9 17:18:25 2014 us=575303 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Sun Mar 9 17:18:25 2014 us=575320 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Sun Mar 9 17:18:25 2014 us=575351 Local Options hash (VER=V4): '41690919'
Sun Mar 9 17:18:25 2014 us=575367 Expected Remote Options hash (VER=V4): '530fdded'
Sun Mar 9 17:18:25 2014 us=575386 UDPv4 link local: [undef]
Sun Mar 9 17:18:25 2014 us=575398 UDPv4 link remote: [AF_INET]xx.xxx.xx.xxx:1194
Sun Mar 9 17:19:26 2014 us=252224 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sun Mar 9 17:19:26 2014 us=252319 TLS Error: TLS handshake failed
Sun Mar 9 17:19:26 2014 us=252555 TCP/UDP: Closing socket
Sun Mar 9 17:19:26 2014 us=252636 SIGUSR1[soft,tls-error] received, process restarting
Sun Mar 9 17:19:26 2014 us=252673 Restart pause, 2 second(s)
Sun Mar 9 17:19:28 2014 us=252812 Re-using SSL/TLS context
Sun Mar 9 17:19:28 2014 us=252981 LZO compression initialized
Sun Mar 9 17:19:28 2014 us=253149 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sun Mar 9 17:19:28 2014 us=253234 Socket Buffers: R=[212992->131072] S=[212992->131072]
Sun Mar 9 17:19:28 2014 us=287059 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sun Mar 9 17:19:28 2014 us=287196 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Sun Mar 9 17:19:28 2014 us=287244 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Sun Mar 9 17:19:28 2014 us=287305 Local Options hash (VER=V4): '41690919'
Sun Mar 9 17:19:28 2014 us=287350 Expected Remote Options hash (VER=V4): '530fdded'
Sun Mar 9 17:19:28 2014 us=287385 UDPv4 link local: [undef]
Sun Mar 9 17:19:28 2014 us=287419 UDPv4 link remote: [AF_INET]xx.xxx.xx.xxx:1194
^CSun Mar 9 17:19:58 2014 us=983620 event_wait : Interrupted system call (code=4)
Sun Mar 9 17:19:58 2014 us=983933 TCP/UDP: Closing socket
Sun Mar 9 17:19:58 2014 us=984007 SIGINT[hard,] received, process exiting
Here is the server logfile:
20140309 17:18:04 I OpenVPN 2.1.1 mipsel-unknown-linux-gnu [SSL] [LZO2] [EPOLL] built on Aug 7 2010
20140309 17:18:04 MANAGEMENT: TCP Socket listening on 127.0.0.1:5001
20140309 17:18:04 W IMPORTANT: OpenVPN's default port number is now 1194 based on an official port number assignment by IANA. OpenVPN 2.0-beta16 and earlier used 5000 as the default port.
20140309 17:18:05 Diffie-Hellman initialized with 1024 bit key
20140309 17:18:05 W WARNING: file '/tmp/openvpn/key.pem' is group or others accessible
20140309 17:18:05 TLS-Auth MTU parms [ L:1541 D:138 EF:38 EB:0 ET:0 EL:0 ]
20140309 17:18:05 I TUN/TAP device tun0 opened
20140309 17:18:05 TUN/TAP TX queue length set to 100
20140309 17:18:05 I /sbin/ifconfig tun0 192.168.10.1 pointopoint 192.168.10.2 mtu 1500
20140309 17:18:05 /sbin/route add -net 192.168.10.0 netmask 255.255.255.0 gw 192.168.10.2
20140309 17:18:05 Data Channel MTU parms [ L:1541 D:1450 EF:41 EB:4 ET:0 EL:0 ]
20140309 17:18:05 Socket Buffers: R=[32767->65534] S=[32767->65534]
20140309 17:18:05 I UDPv4 link local (bound): [undef]:1194
20140309 17:18:05 I UDPv4 link remote: [undef]
20140309 17:18:05 MULTI: multi_init called r=256 v=256
20140309 17:18:05 IFCONFIG POOL: base=192.168.10.4 size=62
20140309 17:18:05 I Initialization Sequence Completed
20140309 17:18:05 MANAGEMENT: Client connected from 127.0.0.1:5001
20140309 17:18:05 D MANAGEMENT: CMD 'state'
20140309 17:18:05 MANAGEMENT: Client disconnected
20140309 17:18:05 MANAGEMENT: Client connected from 127.0.0.1:5001
20140309 17:18:05 D MANAGEMENT: CMD 'status 2'
20140309 17:18:05 MANAGEMENT: Client disconnected
20140309 17:18:06 MANAGEMENT: Client connected from 127.0.0.1:5001
20140309 17:18:06 D MANAGEMENT: CMD 'log 500'
20140309 17:18:06 MANAGEMENT: Client disconnected
20140309 17:18:16 MANAGEMENT: Client connected from 127.0.0.1:5001
20140309 17:18:16 D MANAGEMENT: CMD 'state'
20140309 17:18:16 MANAGEMENT: Client disconnected
20140309 17:18:17 MANAGEMENT: Client connected from 127.0.0.1:5001
20140309 17:18:17 D MANAGEMENT: CMD 'status 2'
20140309 17:18:17 MANAGEMENT: Client disconnected
20140309 17:18:17 MANAGEMENT: Client connected from 127.0.0.1:5001
20140309 17:18:17 D MANAGEMENT: CMD 'log 500'
20140309 17:18:17 MANAGEMENT: Client disconnected
20140309 17:18:25 MULTI: multi_create_instance called
20140309 17:18:25 I 192.168.1.137:43585 Re-using SSL/TLS context
20140309 17:18:25 192.168.1.137:43585 Control Channel MTU parms [ L:1541 D:138 EF:38 EB:0 ET:0 EL:0 ]
20140309 17:18:25 192.168.1.137:43585 Data Channel MTU parms [ L:1541 D:1450 EF:41 EB:4 ET:0 EL:0 ]
20140309 17:18:25 192.168.1.137:43585 TLS: Initial packet from 192.168.1.137:43585 sid=9de7823e c7273610
20140309 17:18:32 MANAGEMENT: Client connected from 127.0.0.1:5001
20140309 17:18:32 D MANAGEMENT: CMD 'state'
20140309 17:18:32 MANAGEMENT: Client disconnected
20140309 17:18:32 MANAGEMENT: Client connected from 127.0.0.1:5001
20140309 17:18:32 D MANAGEMENT: CMD 'status 2'
20140309 17:18:32 MANAGEMENT: Client disconnected
20140309 17:18:32 MANAGEMENT: Client connected from 127.0.0.1:5001
20140309 17:18:32 D MANAGEMENT: CMD 'log 500'
20140309 17:18:32 MANAGEMENT: Client disconnected
20140309 17:19:26 N 192.168.1.137:43585 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
20140309 17:19:26 N 192.168.1.137:43585 TLS Error: TLS handshake failed
20140309 17:19:26 192.168.1.137:43585 SIGUSR1[soft tls-error] received client-instance restarting
20140309 17:19:28 MULTI: multi_create_instance called
20140309 17:19:28 I 192.168.1.137:42105 Re-using SSL/TLS context
20140309 17:19:28 192.168.1.137:42105 Control Channel MTU parms [ L:1541 D:138 EF:38 EB:0 ET:0 EL:0 ]
20140309 17:19:28 192.168.1.137:42105 Data Channel MTU parms [ L:1541 D:1450 EF:41 EB:4 ET:0 EL:0 ]
20140309 17:19:28 192.168.1.137:42105 TLS: Initial packet from 192.168.1.137:42105 sid=76bc769a 8afa488d
20140309 17:20:28 N 192.168.1.137:42105 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
20140309 17:20:28 N 192.168.1.137:42105 TLS Error: TLS handshake failed
20140309 17:20:28 192.168.1.137:42105 SIGUSR1[soft tls-error] received client-instance restarting
Her is the running iptable rules on the router/server:
root@DD-WRT:~# iptables -vL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
5 210 ACCEPT udp -- any any anywhere anywhere udp dpt:1194
2070 215K ACCEPT 0 -- any any anywhere anywhere state RELATED,ESTABLISHED
0 0 DROP udp -- vlan1 any anywhere anywhere udp dpt:route
0 0 DROP udp -- br0 any anywhere anywhere udp dpt:route
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:route
0 0 DROP icmp -- vlan1 any anywhere anywhere
0 0 DROP igmp -- any any anywhere anywhere
1 69 ACCEPT 0 -- lo any anywhere anywhere state NEW
605 56982 logaccept 0 -- br0 any anywhere anywhere state NEW
631 190K DROP 0 -- any any anywhere anywhere
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT 0 -- tun0 br0 anywhere anywhere
0 0 ACCEPT 0 -- br0 tun0 anywhere anywhere
0 0 ACCEPT 0 -- any any 192.168.10.0/24 anywhere
0 0 ACCEPT gre -- any vlan1 192.168.1.0/24 anywhere
0 0 ACCEPT tcp -- any vlan1 192.168.1.0/24 anywhere tcp dpt:1723
0 0 ACCEPT 0 -- br0 br0 anywhere anywhere
312 18500 TCPMSS tcp -- any any anywhere anywhere tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU
3664 1075K lan2wan 0 -- any any anywhere anywhere
3476 1058K ACCEPT 0 -- any any anywhere anywhere state RELATED,ESTABLISHED
0 0 TRIGGER 0 -- vlan1 br0 anywhere anywhere TRIGGER type:in match:0 relate:0
188 16448 trigger_out 0 -- br0 any anywhere anywhere
188 16448 ACCEPT 0 -- br0 any anywhere anywhere state NEW
0 0 DROP 0 -- any any anywhere anywhere
Chain OUTPUT (policy ACCEPT 2560 packets, 1328K bytes)
pkts bytes target prot opt in out source destination
Iptable rules client/kalahari:
Chain INPUT (policy DROP 3410 packets, 575K bytes)
pkts bytes target prot opt in out source destination
536K 654M ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
2101 126K ACCEPT all -- lo any anywhere anywhere
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 337K packets, 42M bytes)
pkts bytes target prot opt in out source destination
I dont know if this is relevant but I have noticed that i am able to ping <push "dhcp-option DNS 192.168.10.1"> from server config.
ping 192.168.10.1
PING 192.168.10.1 (192.168.10.1) 56(84) bytes of data.
64 bytes from 192.168.10.1: icmp_seq=1 ttl=64 time=2.91 ms
64 bytes from 192.168.10.1: icmp_seq=2 ttl=64 time=1.14 ms
^C
--- 192.168.10.1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 1.145/2.030/2.916/0.886 ms
It seems to be a TLS error, as I have understood can mean a lot of this, but usually it is a firewall problem. I have also been using this (
http://netalyzr.icsi.berkeley.edu/) service to check whether my ISP have blocked the OpenVPN port 1194 (they have not). I would really appreciate if anyone could take a look at my configurations an maybe see if they can spot my error.
Thank you in advanced 🙂
