Hey All,
I'm a total noob with open VPN, so be easy on me please.
Got this Nighthawk 7000 router to implement an open VPN for the business I work for. We are a web agency and so there are multiple firewalls that I keep our IP whitlisted for (SSH, etc). The goal is that our remote employees could connect into our VPN and assume our IP address so I don't have to constantly deal with revolving IPs from their home, my home, etc.
So, anywho -- the nighthawk claimed to do this. So I've activated the VPN service, downloaded the config files, attempted to connect, and getting some TLS error crap.
I'm not a networking expert, I'm a developer. So I'm not stupid when it comes to this type of stuff, but feeling pretty stupid now.
I'm connecting via a MAC computer using Viscosity (and tried TunnelBlick which sucks).
May 07 09:08:42: WARNING: No server certificate verification method has been enabled. See
http://openvpn.net/howto.html#mitm for more info.
May 07 09:08:42: Attempting to establish TCP connection with [AF_INET]50.101.104.185:12974 [nonblock]
May 07 09:08:43: TCP connection established with [AF_INET]50.101.104.185:12974
May 07 09:08:43: TCPv4_CLIENT link local: [undef]
May 07 09:08:43: TCPv4_CLIENT link remote: [AF_INET]50.101.104.185:12974
May 07 09:08:47: TLS_ERROR: BIO read tls_read_plaintext error: error:1408F06B:SSL routines:SSL3_GET_RECORD:bad decompression
May 07 09:08:47: TLS Error: TLS object -> incoming plaintext read error
May 07 09:08:47: TLS Error: TLS handshake failed
May 07 09:08:47: Fatal TLS error (check_tls_errors_co), restarting
May 07 09:08:47: SIGUSR1[soft,tls-error] received, process restarting
My guess on this is that it's looking to authenticate with a certificate, in which the Nighthawk gave me the client certificates to authenticate with. This seems more on the Nighthawk end?
Please note, I did change the IP above for security reasons.
I'm willing to pay someone to jump on the phone with me and help me get this squared away. I'm willing to take a completely different approach if what I'm doing currently isn't the right way.
Our hosting company can setup a remote VPN for me which would solve the case, but they want $350 / month for 10 concurrent connections, which would be fine with me since it's a fair price. Just can't get boss man to approve.
Here is the config file that was downloaded from the router:
client
dev tap
proto tcp
remote 50.101.104.185 12974
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
cipher AES-128-CBC
comp-lzo
verb 5
Again, I changed the IP. I'm using the Dynamic DNS service, but really isn't needed since I hooked the Nighthawk up with a static IP instead of pulling from the pool of statics we own.
I sincerely appreciate your time in this matter.
