Using OpenVPN 2.1.1 , Windows 7 , Rackspace cloud load balancer I have a server and a client which used to connect without any issues via a rackspace cloud load balancer with TCP protocol But when I changed the protocol to UDP ; the client can no longer connect to the server. The error message show is :TLS Error: [b]TLS handshake failed[/b] From the logs:- Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client' Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server' I tried connecting [b]without the load balancer[/b] and a proper IP address is assigned to my client So when a load balancer is in between the ( IP address it recognises ; as coming from client )is :- From server log:- [i]Initial packet from 10.190.254.6:10854 ; which is a bit strange; as the IP address is not the internet facing IP of my computer[/i] and the OpenVPN Gui shows the status as handshake failed. [i]Tue May 06 14:45:50 2014 us=315000 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)[/i] I didn't want to clutter the question with both config files; so the local and remote options string. Can anyone point me in the right direction why this behaviour?

Open VPN and cloud load balancer, UDP connection

rohithnair

Using OpenVPN 2.1.1 , Windows 7 , Rackspace cloud load balancer

I have a server and a client which used to connect without any issues via a rackspace cloud load balancer with TCP protocol
But when I changed the protocol to UDP ; the client can no longer connect to the server.

The error message show is :TLS Error: TLS handshake failed

From the logs:-

Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'

I tried connecting without the load balancer and a proper IP address is assigned to my client

So when a load balancer is in between the ( IP address it recognises ; as coming from client )is :-
From server log:-
Initial packet from 10.190.254.6:10854 ; which is a bit strange; as the IP address is not the internet facing IP of my computer

and the OpenVPN Gui shows the status as handshake failed.

Tue May 06 14:45:50 2014 us=315000 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)

I didn't want to clutter the question with both config files; so the local and remote options string.

Can anyone point me in the right direction why this behaviour?

rohithnair

I upgraded to latest Open VPN which is OpenVPN 2.3.4 i686 , On Windows 2008 Server

ERROR SERVER

Tue May 06 16:47:47 2014 MULTI: multi_create_instance called
Tue May 06 16:47:47 2014 yy.yyy.yyy.y:48159 Re-using SSL/TLS context
Tue May 06 16:47:47 2014 yy.yyy.yyy.y:48159 LZO compression initialized
Tue May 06 16:47:47 2014 yy.yyy.yyy.y:48159 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue May 06 16:47:47 2014 yy.yyy.yyy.y:48159 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue May 06 16:47:47 2014 yy.yyy.yyy.y:48159 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Tue May 06 16:47:47 2014 yy.yyy.yyy.y:48159 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Tue May 06 16:47:47 2014 yy.yyy.yyy.y:48159 Local Options hash (VER=V4): '530fdded'
Tue May 06 16:47:47 2014 yy.yyy.yyy.y:48159 Expected Remote Options hash (VER=V4): '41690919'
Tue May 06 16:47:47 2014 yy.yyy.yyy.y:48159 UDPv4 READ [14] from [AF_INET]yy.yyy.yyy.y:48159: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
Tue May 06 16:47:47 2014 yy.yyy.yyy.y:48159 TLS: Initial packet from [AF_INET]yy.yyy.yyy.y:48159, sid=c4182be3 5984b31c
Tue May 06 16:47:47 2014 yy.yyy.yyy.y:48159 UDPv4 WRITE [26] to [AF_INET]yy.yyy.yyy.y:48159: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 [ 0 ] pid=0 DATA len=0
Tue May 06 16:47:49 2014 yy.yyy.yyy.y:48159 UDPv4 WRITE [14] to [AF_INET]yy.yyy.yyy.y:48159: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 [ ] pid=0 DATA len=0
Tue May 06 16:47:49 2014 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
Tue May 06 16:47:53 2014 yy.yyy.yyy.y:48159 UDPv4 WRITE [14] to [AF_INET]yy.yyy.yyy.y:48159: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 [ ] pid=0 DATA len=0
Tue May 06 16:47:53 2014 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
Tue May 06 16:48:02 2014 yy.yyy.yyy.y:48159 UDPv4 WRITE [14] to [AF_INET]yy.yyy.yyy.y:48159: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 [ ] pid=0 DATA len=0
Tue May 06 16:48:02 2014 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
Tue May 06 16:48:18 2014 yy.yyy.yyy.y:48159 UDPv4 WRITE [14] to [AF_INET]yy.yyy.yyy.y:48159: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 [ ] pid=0 DATA len=0
Tue May 06 16:48:18 2014 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)

ERROR CLIENT

Tue May 06 16:50:29 2014 MANAGEMENT: >STATE:1399391429,RECONNECTING,tls-error,,
Tue May 06 16:50:29 2014 Restart pause, 2 second(s)
Tue May 06 16:50:31 2014 Socket Buffers: R=[8192->8192] S=[8192->8192]
Tue May 06 16:50:31 2014 UDPv4 link local: [undef]
Tue May 06 16:50:31 2014 UDPv4 link remote: [AF_INET]xxx.xx.xx.xx:4184
Tue May 06 16:50:31 2014 MANAGEMENT: >STATE:1399391431,WAIT,,,
Tue May 06 16:50:31 2014 MANAGEMENT: >STATE:1399391431,AUTH,,,
Tue May 06 16:50:31 2014 TLS: Initial packet from [AF_INET]xxx.xx.xx.xxx:4184, sid=6b25aefa 1e9667ff

SERVER CONFIG

local PublicIPOfThisPC_LinkedViaLoadBalancer
port 4184
proto udp
dev tun
ca "C:\\Program Files (x86)\\OpenVPN\\easy-rsa\\keys\\ca.crt"
cert "C:\\Program Files (x86)\\OpenVPN\\easy-rsa\\keys\\server.crt"
key "C:\\Program Files (x86)\\OpenVPN\\easy-rsa\\keys\\server.key"  # This file should be kept secret
dh "C:\\Program Files (x86)\\OpenVPN\\easy-rsa\\keys\\dh1024.pem"
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 7

CLIENT CONFIG

client
dev tun
proto udp
remote loadbalancerIP 4184
resolv-retry infinite
nobind
persist-key
persist-tun
ca "C:\\Program Files (x86)\\OpenVPN\\easy-rsa\\keys\\ca.crt"
cert "C:\\Program Files (x86)\\OpenVPN\\easy-rsa\\keys\\x.crt"
key "C:\\Program Files (x86)\\OpenVPN\\easy-rsa\\keys\\x.key"
ns-cert-type server
comp-lzo
verb 3

rohithnair

@debbie10T

Windows IP Configuration

   Host Name . . . . . . . . . . . . : TEST
   Primary Dns Suffix  . . . . . . . :
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : TAP-Windows Adapter V9
   Physical Address. . . . . . . . . : 00-FF-10-4F-62-47
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::e1a7:a246:f39c:c8b9%16(Preferred)
   IPv4 Address. . . . . . . . . . . : 10.8.0.1(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.252
   Lease Obtained. . . . . . . . . . : 07 May 2014 10:00:54
   Lease Expires . . . . . . . . . . : 07 May 2015 10:00:54
   Default Gateway . . . . . . . . . :
   DHCP Server . . . . . . . . . . . : 10.8.0.2
   DHCPv6 IAID . . . . . . . . . . . : 268500752
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1A-FA-A9-13-BC-76-4E-08-CB-39

   DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
                                       fec0:0:0:ffff::2%1
                                       fec0:0:0:ffff::3%1
   NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter public:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Citrix PV Ethernet Adapter #0
   Physical Address. . . . . . . . . : BC-76-4E-08-CB-38
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv6 Address. . . . . . . . . . . : 2a00:1a48:7808:101:be76:4eff:fe08:cb38(Pr
eferred)
   IPv4 Address. . . . . . . . . . . : 162.13.xxx.xxx(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : fe80::def%14
                                       162.13.xxx.1
   DHCPv6 IAID . . . . . . . . . . . : 331118158
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1A-FA-A9-13-BC-76-4E-08-CB-39

   DNS Servers . . . . . . . . . . . : 83.138.xxx.xx
                                       83.138.xxx.xx
   NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter private:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Citrix PV Ethernet Adapter #1
   Physical Address. . . . . . . . . : BC-76-4E-08-CB-39
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 10.181.xxx.xxx(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.224.0
   Default Gateway . . . . . . . . . :
   DHCPv6 IAID . . . . . . . . . . . : 264009294
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1A-FA-A9-13-BC-76-4E-08-CB-39

   DNS Servers . . . . . . . . . . . : 83.138.xxx.xx
                                       83.138.xxx.xx
   NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter isatap.{104F6247-7CF8-4CAA-8435-9400EAC19452}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 9:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft Teredo Tunneling Adapter
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.{C36CFB86-A5B8-4B39-8050-256947E5B9C7}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #2
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.{6C011606-D0F7-4953-A388-937A870857A0}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #3
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

rohithnair

Sorry, it is the private ip which is accessible via load balancer

rohithnair

Like you said seems to me like the Load balancer issue, because the IP address which it gets assigned is a rackspace IP one , as I can ping to that IP from my server.
It does assign this IP only when connecting via UDP.