I am trying to setup an openvpn server and a client, but all I get when I try to connect the client to the server is: [code] us=65771 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) us=65810 TLS Error: TLS handshake failed [/code] Here is my server.conf [code] port 1199 proto udp dev tun ca ca.crt cert server.crt key server.key dh dh4096.pem tls-auth ta.key 0 server 192.168.1.192 255.255.255.192 ifconfig-pool-persist ipp.txt log-append log keepalive 10 120 comp-lzo persist-key persist-tun status openvpn-status.log verb 6 [/code] and here is my client.conf: [code] client dev tun proto udp remote remote_ip 1199 resolv-retry infinite nobind user nobody group nobody ca ca.crt cert client.crt key client.key tls-auth ta.key 1 ns-cert-type server keepalive 10 120 comp-lzo persist-key persist-tun verb 6 [/code] I tcpdumped the server and can confirm that it receives the UDP packets, but it doesn't respond to them. The server starts without a problem, just some warnings about cached passwords. I have tried many different options, but none have worked so far. Anyone who can say what is wrong with my setup? Thank you for your time!

It didn't make a difference. I seem to have found the problem though. The client on my server adds the following route: [code] 128.0.0.0/1 via dev tun0 [/code] If I remove it I am able to connect to my server. What is that route good for? Why would my VPN provider add it and what are the consequences of me removing it?

TLS handshake failed

Phobios

I am trying to setup an openvpn server and a client, but all I get when I try to connect the client to the server is:

us=65771 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
us=65810 TLS Error: TLS handshake failed

Here is my server.conf

port 1199
proto udp
dev tun

ca ca.crt
cert server.crt
key server.key
dh dh4096.pem
tls-auth ta.key 0

server 192.168.1.192 255.255.255.192
ifconfig-pool-persist ipp.txt

log-append log

keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 6

and here is my client.conf:

client
dev tun
proto udp
remote remote_ip 1199

resolv-retry infinite

nobind

user nobody
group nobody

ca ca.crt
cert client.crt
key client.key
tls-auth ta.key 1

ns-cert-type server

keepalive 10 120
comp-lzo
persist-key
persist-tun
verb 6

I tcpdumped the server and can confirm that it receives the UDP packets, but it doesn't respond to them. The server starts without a problem, just some warnings about cached passwords.

I have tried many different options, but none have worked so far. Anyone who can say what is wrong with my setup?

Thank you for your time!

Phobios

Server side log (verb 6):

us=670040 OpenVPN 2.3.3 x86_64-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Apr  9 2014
us=685974 Diffie-Hellman initialized with 2048 bit key
us=686978 Control Channel Authentication: using '/home/user/config/openvpn/server/ta.key' as a OpenVPN static key file
us=687034 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
us=687061 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
us=687102 TLS-Auth MTU parms [ L:1542 D:166 EF:66 EB:0 ET:0 EL:0 ]
us=687160 Socket Buffers: R=[212992->131072] S=[212992->131072]
us=687453 ROUTE_GATEWAY 192.168.1.1/255.255.255.0 IFACE=enp2s0 HWADDR=c8:60:00:23:58:49
us=689476 TUN/TAP device tun1 opened
us=689577 TUN/TAP TX queue length set to 100
us=689641 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
us=689719 /usr/bin/ip link set dev tun1 up mtu 1500
us=692437 /usr/bin/ip addr add dev tun1 local 192.168.1.193 peer 192.168.1.194
us=696521 /usr/bin/ip route add 192.168.1.192/26 via 192.168.1.194
us=699624 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
us=700668 GID set to nobody
us=700834 UID set to nobody
us=700882 UDPv4 link local (bound): [undef]
us=700910 UDPv4 link remote: [undef]
us=700942 MULTI: multi_init called, r=256 v=256
us=701064 IFCONFIG POOL: base=192.168.1.196 size=14, ipv6=0
us=701107 IFCONFIG POOL LIST
Tue Apr 15 12:41:44 2014 us=701188 Initialization Sequence Completed

Client log (verb 6) after passphrase was given:

us=22076 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
us=26305 WARNING: file 'openvpn/galaxy.key' is group or others accessible
us=26548 WARNING: file 'openvpn/ta.key' is group or others accessible
us=26559 Control Channel Authentication: using 'openvpn/ta.key' as a OpenVPN static key file
us=26575 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
us=26586 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
us=26617 LZO compression initialized
us=26704 Control Channel MTU parms [ L:1542 D:166 EF:66 EB:0 ET:0 EL:0 ]
us=26745 Socket Buffers: R=[212992->131072] S=[212992->131072]
us=26771 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
us=26791 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-   method 2,tls-client'
us=26802 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher BF-CBC,auth SHA1,keysize 128,tls-  auth,key-method 2,tls-server'
us=26821 Local Options hash (VER=V4): '504e774e'
us=26835 Expected Remote Options hash (VER=V4): '14168603'
us=27098 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
#<label> ###This part is repeated over and over
us=27117 UDPv4 link local: [undef]
us=27129 UDPv4 link remote: [AF_INET]<server-ip>:1199
us=27187 UDPv4 WRITE [42] to [AF_INET]<server-ip>:1199: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 pid=[ #1 ] [ ] pid=0 DATA len=0
us=117525 UDPv4 WRITE [42] to [AF_INET]<server-ip>:1199: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 pid=[ #2 ] [ ] pid=0 DATA len=0
us=298014 UDPv4 WRITE [42] to [AF_INET]<server-ip>:1199: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 pid=[ #3 ] [ ] pid=0 DATA len=0
us=538734 UDPv4 WRITE [42] to [AF_INET]<server-ip>:1199: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 pid=[ #4 ] [ ] pid=0 DATA len=0
us=178265 UDPv4 WRITE [42] to [AF_INET]<server-ip>:1199: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 pid=[ #5 ] [ ] pid=0 DATA len=0
us=339158 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
us=339203 TLS Error: TLS handshake failed
us=339322 TCP/UDP: Closing socket
us=339355 SIGUSR1[soft,tls-error] received, process restarting
us=339369 Restart pause, 2 second(s)
us=339528 Re-using SSL/TLS context 
us=339664 LZO compression initialized
us=339776 Control Channel MTU parms [ L:1542 D:166 EF:66 EB:0 ET:0 EL:0 ]
us=339830 Socket Buffers: R=[212992->131072] S=[212992->131072]
us=339851 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
us=339880 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-  method 2,tls-client'
us=339891 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher BF-CBC,auth SHA1,keysize 128,tls- auth,key-method 2,tls-server'
us=339913 Local Options hash (VER=V4): '504e774e'
us=339927 Expected Remote Options hash (VER=V4): '14168603'
#goto <label>

Thank you for your help.

Phobios

Ok, so I found out what my problem was. The server was already an instance of OpenVPN in client mode and when I disconnected it I was able to connect to it from the client machine.

My question now is: Why cant my machine be running two OpenVPN instances at the same time? One client instance and one server instance? Is there a workaround to get this working?

Phobios

But I do have the nobind in my client config file. Both the client config on my server machine and on the client trying to connect to the server.

The server starts without any problems, but when trying to connect to it, the server receives UDP packets, but sends none back to the client. I checked with tcpdump and the server receives the initial packets from the client, but doesn't respond in any way.

Phobios

client config on my server:

client
dev tun0
proto udp
remote <server-ip-1> 1194
remote <server-ip-2> 1194
remote <server-ip-3> 1194
resolv-retry infinite
nobind

log-append <path>/log

script-security 2
up <path>/up.sh #includes update-resolv-conf
down <path>/down.sh #includes update-resolv-conf
up-restart

user nobody
group nobody

auth-user-pass authfile
auth-retry nointeract

ca [inline]

tls-client
tls-auth [inline]
ns-cert-type server

keepalive 10 30
cipher AES-256-CBC
persist-key
persist-tun
comp-lzo
tun-mtu 1500
mssfix
passtos
verb 3

<ca>
inlined ca
</ca>

<tls-auth>
inlined ta.key
</tls-auth

Phobios

It didn't make a difference.

I seem to have found the problem though. The client on my server adds the following route:

128.0.0.0/1 via <some-ip> dev tun0

If I remove it I am able to connect to my server. What is that route good for? Why would my VPN provider add it and what are the consequences of me removing it?

Phobios

I am not in control of the second server and I don't have access to its config file.

The connection works if I remove that route, but it is extremely slow when using ssh, web browsing over squid or accessing samba shares over the network.
This is true even when the server is not used as a client anymore. What could the reason be for it being so painfully slow?