I'm attempting to bring an off-site server into the local network. They all have public IPs and I can connect to them directly. I have an Ubiquiti router that is supposed to be able to use OpenVPN, but I've been getting these errors on the client:
Jul 23 11:42:44 client openvpn[59741]: Restart pause, 2 second(s)
Jul 23 11:42:46 client openvpn[59741]: WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more
info.
Jul 23 11:42:46 client openvpn[59741]: Socket Buffers: R=[42080->65536] S=[9216->65536]
Jul 23 11:42:46 client openvpn[59741]: UDPv4 link local: [undef]
Jul 23 11:42:46 client openvpn[59741]: UDPv4 link remote: [AF_INET]x.x.x.x:1194
Jul 23 11:42:46 client openvpn[59741]: TLS: Initial packet from [AF_INET]x.x.x.x:1194, sid=c8a5fe0f2dae8f65
Jul 23 11:42:55 client openvpn[59741]: VERIFY ERROR: depth=0, error=self signed certificate: C=US, ST=CA, L=OurTown, O=Company, CN=server, name=My Name, emailAddress=email@domain.my
Jul 23 11:42:55 client openvpn[59741]: TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
Jul 23 11:42:55 client openvpn[59741]: TLS Error: TLS object -> incoming plaintext read error
Jul 23 11:42:55 client openvpn[59741]: TLS Error: TLS handshake failed
Jul 23 11:42:55 client openvpn[59741]: SIGUSR1[soft,tls-error] received, process restarting
On the server side, I get this:
Jul 23 11:55:25 server openvpn[28449]: x.x.x.x:64174 Re-using SSL/TLS context
Jul 23 11:55:25 server openvpn[28449]: x.x.x.x:64174 Control Channel MTU parms [ L:1541 D:138 EF:38 EB:0 ET:0 EL:0 ]
Jul 23 11:55:25 server openvpn[28449]: x.x.x.x:64174 Data Channel MTU parms [ L:1541 D:1450 EF:41 EB:4 ET:0 EL:0 ]
Jul 23 11:55:25 server openvpn[28449]: x.x.x.x:64174 Local Options hash (VER=V4): '239669a8'
Jul 23 11:55:25 server openvpn[28449]: x.x.x.x:64174 Expected Remote Options hash (VER=V4): '3514370b'
Jul 23 11:55:25 server openvpn[28449]: x.x.x.x:64174 TLS: Initial packet from [AF_INET]x.x.x.x:64174, sid=2fdb7439 cd00f849
Jul 23 11:55:30 server openvpn[28449]: x.x.x.x:55998 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Jul 23 11:55:30 server openvpn[28449]: x.x.x.x:55998 TLS Error: TLS handshake failed
Jul 23 11:55:30 server openvpn[28449]: x.x.x.x:55998 SIGUSR1[soft,tls-error] received, client-instance restarting
Jul 23 11:55:30 server openvpn[28449]: read UDPv4 [ECONNREFUSED|ECONNREFUSED]: Connection refused (code=146)
Jul 23 11:55:30 server openvpn[28449]: read UDPv4 [ECONNREFUSED|ECONNREFUSED|ECONNREFUSED|ECONNREFUSED]: Connection refused (code=146)
Jul 23 11:55:30 server openvpn[28449]: read UDPv4 [ECONNREFUSED]: Connection refused (code=146)
Jul 23 11:55:30 server openvpn[28449]: read UDPv4 [ECONNREFUSED|ECONNREFUSED]: Connection refused (code=146)
Jul 23 11:55:30 server openvpn[28449]: read UDPv4 [ECONNREFUSED|ECONNREFUSED]: Connection refused (code=146)
Jul 23 11:55:30 server openvpn[28449]: read UDPv4 [ECONNREFUSED]: Connection refused (code=146)
Jul 23 11:55:30 server openvpn[28449]: read UDPv4 [ECONNREFUSED|ECONNREFUSED]: Connection refused (code=146)
Jul 23 11:55:32 server openvpn[28449]: read UDPv4 [ECONNREFUSED]: Connection refused (code=146)
Jul 23 11:55:32 server openvpn[28449]: read UDPv4 [ECONNREFUSED]: Connection refused (code=146)
As you can see, the connection is refused several times. The strange thing is, my client has no firewall.
My questions are two fold.
1. How can the connection be refused when I don't have a firewall?
2. Given that it is self-signed, how can the server certificate be invalid?
Any help is appreciated. I've included config information below.
The client has this configuration. I'm attempting to do certificate based authentication.
tun-mtu 1500
client
;dev tap
dev tun
proto udp
verb 3
remote client.domain.my 1194
nobind
persist-key
persist-tun
resolv-retry infinite
ca ca.crt
cert client.crt
key client.key
The server has this confguration (note: this is translated from the ubiquiti configuration system):
dev vtun0
local-port 1194
mode server
tls-server
persist-key
persist-tun
persist-local-ip
persist-remote-ip
user nobody
group nobody
verb 3
ifconfig-pool-persist ipp.txt
tun-mtu 1500
keepalive 8 30
protocol udp
server #subnet information
ca /usr/share/doc/openvpn/examples/easy-rsa/2.0/keys/ca.crt
cert /usr/share/doc/openvpn/examples/easy-rsa/2.0/keys/server.crt
dh /usr/share/doc/openvpn/examples/easy-rsa/2.0/keys/dh4096.pem
key /usr/share/doc/openvpn/examples/easy-rsa/2.0/keys/server.key
All the keys were generated on the router using the easy-rsa scripts. All the certificates are self-signed.
uname -a on the client:
FreeBSD client 10.0-STABLE FreeBSD 10.0-STABLE #0 r267626 Wed Jun 25 16:18:05 PDT 2014
uname -a on the server:
Linux server 3.4.27-UBNT #1 SMP Tue Dec 24 14:20:32 PST 2013 mips64 GNU/Linux
