I'm trying to setup OpenVPN on a server and client, both Debian: server is stable/jessie, client is a mix of stable and testing. I'm a longtime Linux user, but this is my first time with OpenVPN. FWIW, my goal is to setup a jumpbox for access to another network, since the other/target network now requires me (among other things) to access from a static IPv4 IP#. I will then be running an SSL VPN (as previously, and still now, required) through the jumpbox. However, currently I'm just trying to get a simple/vanilla OpenVPN session up and running (as a smoketest) before I proceed.
My server (a linode[1] to which I have ssh access) seems to be starting correctly:
me@server:/etc/openvpn$ sudo openvpn --config ./server.conf & # obfuscated IP#
> Mon Oct 13 21:53:49 2014 OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Jun 18 2013
> Mon Oct 13 21:53:49 2014 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
> Mon Oct 13 21:53:49 2014 Diffie-Hellman initialized with 1024 bit key
> Mon Oct 13 21:53:49 2014 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
> Mon Oct 13 21:53:49 2014 Socket Buffers: R=[212992->131072] S=[212992->131072]
> Mon Oct 13 21:53:49 2014 ROUTE default_gateway=ser.ver.IP.1
> Mon Oct 13 21:53:49 2014 TUN/TAP device tun0 opened
> Mon Oct 13 21:53:49 2014 TUN/TAP TX queue length set to 100
> Mon Oct 13 21:53:49 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
> Mon Oct 13 21:53:49 2014 /sbin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
> Mon Oct 13 21:53:49 2014 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.2
> Mon Oct 13 21:53:49 2014 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
> Mon Oct 13 21:53:49 2014 UDPv4 link local (bound): [undef]
> Mon Oct 13 21:53:49 2014 UDPv4 link remote: [undef]
> Mon Oct 13 21:53:49 2014 MULTI: multi_init called, r=256 v=256
> Mon Oct 13 21:53:49 2014 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
> Mon Oct 13 21:53:49 2014 IFCONFIG POOL LIST
> Mon Oct 13 21:53:49 2014 Initialization Sequence Completed
However my client (to which I have full/physical access) does not seem to be starting correctly: it fails to utter "Initialization Sequence Completed" or to ping:
me@client:~$ sudo openvpn ./client1.conf & # obfuscated IP#
Mon Oct 13 21:56:42 2014 OpenVPN 2.3.2 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Nov 28 2013
Mon Oct 13 21:56:42 2014 Socket Buffers: R=[212992->131072] S=[212992->131072]
Mon Oct 13 21:56:42 2014 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Mon Oct 13 21:56:42 2014 UDPv4 link local: [undef]
Mon Oct 13 21:56:42 2014 UDPv4 link remote: [AF_INET]ser.ver.IP.18:1194
me@client:~$ date ; ping 10.8.0.1
Mon Oct 13 21:57:37 EDT 2014
PING 10.8.0.1 (10.8.0.1) 56(84) bytes of data.
Mon Oct 13 21:57:42 2014 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Mon Oct 13 21:57:42 2014 TLS Error: TLS handshake failed
Mon Oct 13 21:57:42 2014 SIGUSR1[soft,tls-error] received, process restarting
Mon Oct 13 21:57:42 2014 Restart pause, 2 second(s)
Mon Oct 13 21:57:44 2014 Socket Buffers: R=[212992->131072] S=[212992->131072]
Mon Oct 13 21:57:44 2014 UDPv4 link local: [undef]
Mon Oct 13 21:57:44 2014 UDPv4 link remote: [AF_INET]ser.ver.IP.18:1194
^C
--- 10.8.0.1 ping statistics ---
40 packets transmitted, 0 received, 100% packet loss, time 39284ms
I'm wondering how to fix, or at least, how to debug further: your assistance is appreciated. My configurations are
me@server:~$ grep -vE '^#|^;|^$' /etc/openvpn/server.conf
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
and
me@client:~$ grep -vE '^#|^;|^$' ~/client1.conf # obfuscated IP#
client
dev tun
proto udp
remote ser.ver.IP.18 1194
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
ns-cert-type server
comp-lzo
verb 3
[1]
http://www.linode.com/ . Note that I have followed their OpenVPN guide @
https://www.linode.com/docs/networking/vpn/secure-communications-with-openvpn-on-ubuntu-12-04-precise-and-debian-7
