synology dsm 5.1 2nd server

dgermann

Friends--

After many hours and several months, it is time to ask for help from you.

Issue: cannot get client to connect to NAS.

Server: Synology ds213j running dsm 5.1, at 192.168.0.202

Client: Ubuntu 12.04.5 LTS OpenVPN 2.2.1 x86_64-linux-gnu

Router: Archer C7 AC1750 with port forwarding rules: external 1447 set to internal 1447 on the ipaddress for the nas, using udp. Static routing is

1	10.8.0.1	255.255.255.255	192.168.0.201	Enabled	Modify Delete
2	192.168.1.0	255.255.255.0	192.168.0.201	Enabled	Modify Delete
3	10.8.0.0	255.255.255.0	192.168.0.201	Enabled	Modify Delete
4	10.8.1.1	255.255.255.255	192.168.0.202	Enabled	Modify Delete
5	10.8.1.0	255.255.255.0	192.168.0.202	Enabled	Modify Delete

Note: This client also connects to another server (192.168.0.201) on the same lan via openvpn (this connection has been working well for a year or two). I am using the same keys and crts for both servers.

The other server uses port 1194, its server.conf has the line "server 10.8.0.0 255.255.255.0" and the same push route line as the one below. Its ccd/client file is "iroute 192.168.1.0 255.255.255.0
ifconfig-push 10.8.0.42 10.8.0.41"

Server.conf:

management 127.0.0.1 1195
port 1447
proto udp 
dev tun 
ca /usr/syno/etc/synovpnclient/openvpn/ca.crt 
cert /usr/syno/etc/synovpnclient/openvpn/mariah.crt 
key /usr/syno/etc/synovpnclient/openvpn/mariah.key  # This file should be kept secret 
dh /usr/syno/etc/synovpnclient/openvpn/dh1024.pem 
server 10.8.1.0 255.255.255.0 
ifconfig-pool-persist ipp.txt 
push "route 192.168.0.0 255.255.255.0" 
client-config-dir /usr/syno/etc/synovpnclient/openvpn/ccd 
route 192.168.1.0	255.255.255.0 
client-to-client 
log-append /var/log/openvpn.log
keepalive 10 120 
comp-lzo 
max-clients 2 
persist-key 
persist-tun 
status /usr/syno/etc/synovpnclient/openvpn/openvpn-status.log
status-version 2
verb 3

Server's ccd/air file is:

iroute 192.168.1.0      255.255.255.0
ifconfig-push 10.8.1.42 10.8.1.41

client.conf:

client
dev tun1
proto udp
remote xxxx.no-ip.org 1447
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/air.crt
key /etc/openvpn/air.key
remote-cert-tls server
comp-lzo
verb 3

On client, when I run openvpn client.conf, I get:

Sun Feb 15 18:09:15 2015 OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Dec  1 2014
Sun Feb 15 18:09:15 2015 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Sun Feb 15 18:09:15 2015 LZO compression initialized
Sun Feb 15 18:09:15 2015 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sun Feb 15 18:09:15 2015 Socket Buffers: R=[229376->131072] S=[229376->131072]
Sun Feb 15 18:09:15 2015 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sun Feb 15 18:09:15 2015 Local Options hash (VER=V4): '41690919'
Sun Feb 15 18:09:15 2015 Expected Remote Options hash (VER=V4): '530fdded'
Sun Feb 15 18:09:15 2015 UDPv4 link local: [undef]
Sun Feb 15 18:09:15 2015 UDPv4 link remote: [AF_INET]XX.XX.XX.171:1447
Sun Feb 15 18:10:15 2015 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sun Feb 15 18:10:15 2015 TLS Error: TLS handshake failed
Sun Feb 15 18:10:15 2015 TCP/UDP: Closing socket

On the server side, there is nothing at all in the /var/log/openvpn.log file, nor in the /usr/syno/etc/synovpnclient/openvpn/openvpn-status.log

For today's tests, I completely disabled the firewall on the NAS, thinking that could be an issue.

So what to do to get these machines connected?

Thanks!

Traffic

dgermann wroteOn client, when I run openvpn client.conf, I get:
Code:
Sun Feb 15 18:09:15 2015 OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Dec 1 2014
...
Sun Feb 15 18:10:15 2015 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sun Feb 15 18:10:15 2015 TLS Error: TLS handshake failed
Sun Feb 15 18:10:15 2015 TCP/UDP: Closing socket

dgermann wroteOn the server side, there is nothing at all in the /var/log/openvpn.log file

Did you actually start the server ?

dgermann

Yes. I went to the openvpn page in dsm and disabled it, saved, enabled, saved. That is the way I think it gets started in synology.

Does that mean you are not seeing a problem in what I have done so far?

Thanks, Traffic.

Traffic

Considering you have in your server config:

log-append /var/log/openvpn.log
status /usr/syno/etc/synovpnclient/openvpn/openvpn-status.log

If this is true:

dgermann wroteOn the server side, there is nothing at all in the /var/log/openvpn.log file, nor in the /usr/syno/etc/synovpnclient/openvpn/openvpn-status.log

strongly suggests your server is not starting at all ..

dgermann wroteSun Feb 15 18:10:15 2015 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sun Feb 15 18:10:15 2015 TLS Error: TLS handshake failed
Sun Feb 15 18:10:15 2015 TCP/UDP: Closing socket

This usually means that the client cannot reach the server at all .. most likely due to a firewall blocking you .. however

dgermann wroteNote: This client also connects to another server (192.168.0.201) on the same lan via openvpn

I wonder if this 1st VPN is interfering with your 2nd connection ? Check your client routes ..

dgermann

Traffic--

Thanks for helping me.

Using the clue that the server might not be running, I did this on the nas: openvpn server.conf.

Then I disabled the firewall on the nas, and ran the openvpn on the client side. Still the same "Tue Feb 17 22:46:49 2015 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)"

Route on client shows:

route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         homeportal      0.0.0.0         UG    0      0        0 eth0
10.8.0.0        10.8.0.41       255.255.255.0   UG    0      0        0 tun0
10.8.0.41       *               255.255.255.255 UH    0      0        0 tun0
link-local      *               255.255.0.0     U     1000   0        0 eth0
192.168.0.0     10.8.0.41       255.255.255.0   UG    0      0        0 tun0
192.168.1.0     *               255.255.255.0   U     1      0        0 eth0
doug@air:/etc/openvpn$

route on nas shows:

route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.0.1     0.0.0.0         UG    0      0        0 eth0
10.8.1.0        10.8.1.2        255.255.255.0   UG    0      0        0 tun0
10.8.1.2        *               255.255.255.255 UH    0      0        0 tun0
192.168.0.0     *               255.255.255.0   U     0      0        0 eth0
mariah>

Checking to see what is running on the synology nas I get:

mariah> ps |grep openvpn
 7228 root      7176 S    /var/packages/VPNCenter/target/sbin/openvpn --daemon
 7229 root      7176 S    /var/packages/VPNCenter/target/sbin/openvpn --daemon
 7236 root      7176 S    /var/packages/VPNCenter/target/sbin/openvpn --daemon
13348 root      3996 S    grep openvpn
mariah>

...which I think tells me it is running.

Not sure what to do to see if the other connection is blocking this. And since that computer is many miles away, if I disconnect the tun0, and the tun1 does not go, I am lost.

BTW, this is a production environment.

Thanks, Traffic.

Traffic

dgermann wroteNote: This client also connects to another server (192.168.0.201) on the same lan via openvpn (this connection has been working well for a year or two). I am using the same keys and crts for both servers.

dgermann wroteNot sure what to do to see if the other connection is blocking this. And since that computer is many miles away, if I disconnect the tun0, and the tun1 does not go, I am lost.

OK

Please post configs (no log required) of the working VPN. That way we can determine if there are any options conflicting: eg server port number ..

dgermann

Traffic--

OK. Here is the server.conf on earth (192.168.0.201), which is the working openvpn server:

port 1194 
proto udp 
dev tun 
ca /etc/openvpn/ca.crt 
cert /etc/openvpn/earth.crt 
key /etc/openvpn/earth.key  # This file should be kept secret 
dh /etc/openvpn/dh1024.pem 
server 10.8.0.0 255.255.255.0 
ifconfig-pool-persist ipp.txt 
push "route 192.168.0.0 255.255.255.0" 
client-config-dir /etc/openvpn/ccd 
route 192.168.1.0	255.255.255.0 
client-to-client 
keepalive 10 120 
comp-lzo 
max-clients 2 
persist-key 
persist-tun 
status openvpn-status.log 
verb 3

The ccd file for air, the client on earth's vpn, is:

iroute 192.168.1.0      255.255.255.0
ifconfig-push 10.8.0.42 10.8.0.41

BTW, the ccd file for air, the client on the NAS is:

iroute 192.168.1.0      255.255.255.0
ifconfig-push 10.8.1.42 10.8.1.41

The client.conf file on air, for the working connection to earth, is:

client
dev tun
proto udp
remote [blanked].no-ip.org 1194
#remote 192.168.0.201
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/air.crt
key /etc/openvpn/air.key
remote-cert-tls server
comp-lzo
verb 3

I think that's all you asked for.

Thanks for helping me, Traffic! I can get a lot of things in linux, but this feels like it has too many moving parts!

Traffic

If your working VPN is stable: ie you can connect/disconnect to it at will ..
I would disconnect from the working VPN and try connecting to the other ..
Then just work through the usual suspects if you cannot connect ..

Also:

NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

In your case you have chosen to use both subnets ... which is just a disaster in the making.

dgermann wroteThanks for helping me, Traffic! I can get a lot of things in linux, but this feels like it has too many moving parts!

Simplify .. take all those extra wheels out of the equation.

dgermann

Traffic--

Thank you. That sounds like sage advice. I will try to follow it.

I am a little lost on a couple of specifics, if you will help me please:

1. To disconnect from the working vpn: does this mean I need to be physically present at the client machine to test these things out? As I said, it is probably 20 miles from here. So if I need access to both it means driving back and forth. Or is there some way to maintain connectivity from one location while I work through the usual suspects?

2. And so what should be the usual suspects I should work through? They might be obvious to you, being the guru and one of the oughta be developers, but to me, networking has nothing usual about it.

3. These client machines are desktop boxes and not laptops, so the addresses should not be a problem. But looking ahead, should I go to something like 192.168.23.x or 10.8.23.x or?

4. What extra wheels? I feel like I need the training wheels.... <grin>

Thanks, Traffic.

Traffic

You have:

a working VPN from client-1 to server-1 = xxxx.no-ip.org UDP:1194

You do not have:

a working VPN from client-1 to server-2 = xxxx.no-ip.org UDP:1447

You explain that xxxx.no-ip.org is the same internet address for both servers.

The error you get trying to connect client-1 to server-2 is:

dgermann wroteSun Feb 15 18:10:15 2015 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sun Feb 15 18:10:15 2015 TLS Error: TLS handshake failed

This means 99.99% certain that you have not setup port forwarding or firewall rules correctly on the router/firewall which protects your server LAN.

Obviously, check that you client firewall/router allows UDP:1447 outgoing as well !

The essential fact to understand is:

It is 99.99% certain this is not an OpenVPN issue, it is your firewalls.

Check your firewall logs .. Thoroughly !

dgermann

Traffic--

Could this be an issue? Both server one and server two conf have the line "route 192.168.1.0 255.255.255.0" and the routing tables on the router point this address to 129.168.0.201. Both the server one and server two ccd files for the client have a line "iroute 192.168.1.0 255.255.255.0"

Need to also keep you updated about what I did in response to your last post, although I found a bunch of things that did not work:

Everything you say up to your 99.99% line is correct, as far as I can see.

Found no firewall logs:

There appear to be no firewall logs on the synology nas. In /var/log/syslog.log there is nothing logged since Feb 6, and I have been doing work on it several days since then, including today, the 22nd. openvpn.log has only this:

mariah> cat openvpn.log 
Tue Feb 17 22:40:21 2015 OpenVPN 2.3.6 armle-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Jan  7 2015
Tue Feb 17 22:40:21 2015 library versions: OpenSSL 1.0.1k-fips 8 Jan 2015, LZO 2.08
Tue Feb 17 22:40:21 2015 MANAGEMENT: Socket bind failed on local address [AF_INET]127.0.0.1:1195: Address already in use
Tue Feb 17 22:40:21 2015 Exiting due to fatal error
mariah>

I don't see any other log files that seem to give us any clues.

I am not finding any firewall logs for my router. The general logs for it show only dhcp requests.

Other things I checked:

No-ip is set up and showing as connected on the synology nas.

On Router:

Current NAT status: Enable
Current Hardware NAT status: Enable
Forwarding Virtual Servers
1194 is forwarded to 192.168.0.201 udp
1447 is forwarded to 192.168.0.202 udp

There are about 18 upnpclients showing all to the nas: I tried disabling and enabling this and it made no difference.

I did kill the client.conf connection on the client side and try to connect to the server two without that running, but it gave the same error message. Got some help on that side and restored the working connection.

Thanks, Traffic!

dgermann

PS: Is there a way to edit a post that's a few days old? Or get a sysop to do it for me?

Thanks!

Traffic

dgermann wroteIs there a way to edit a post that's a few days old? Or get a sysop to do it for me?

Maikcat will probably do it for you .. post details of what you need.

dgermann wroteTue Feb 17 22:40:21 2015 MANAGEMENT: Socket bind failed on local address [AF_INET]127.0.0.1:1195: Address already in use
Tue Feb 17 22:40:21 2015 Exiting due to fatal error

this message means you are trying to run the same config twice or both configs use the same management port.

dgermann

Traffic--

Can you ask Maikat to delete the ipaddress that shows in post 1, the last box, about the 5th to the last line? Thanks!

I don't know what that management localhost 1195 is. There is a line for that in their sample server.conf, but not in the one I am using. My server.conf is in /usr/syno/etc/synovpnclient/openvpn/ The sample is in usr/syno/etc/packages/VPNCenter/openvpn/ and is called openvpn.conf.

Sign me Lost and Grateful for your help, Traffic.

Traffic

dgermann wroteI don't know what that management localhost 1195 is. There is a line for that in their sample server.conf, but not in the one I am using

Then you are not using the config that you think you are using ...

Check your NAS setup for what config file it actually starts.

dgermann

Traffic--

Thank you for helping me.

You have come up with an excellent clue. I will try to run that down.

The next week or so is very busy for me, so you might not get a response from me very quickly.

I think we are making progress.

Thank you Traffic, and thank you Maikat for doing that editing for me!

dgermann

Traffic--

Seems some progress has been made. I have changed some firewall rules on the synology nas to allow traffic from any place to the vpn port. So in other words, the firewall rules are:

1. Allow all ports and all protocols from within the local network 192.168.x.x
2. Allow vpn port to be accessed for any protocol from anywhere.
3. Allow vpn server to be accessed udp from the remote source 10.8.x.x
4. Deny all other traffic.

With these rules I can connect the remote vpn client to the local vpn nas server.

I am concerned that rule #2 is a security risk. Is it? How to tighten it and still let the desired traffic through?

Thanks!

Traffic

dgermann wroteFriends--

After many hours and several months, it is time to ask for help from you.

Issue: cannot get client to connect to NAS.

Server: Synology ds213j running dsm 5.1, at 192.168.0.202

Client: Ubuntu 12.04.5 LTS OpenVPN 2.2.1 x86_64-linux-gnu

Router: Archer C7 AC1750 with port forwarding rules

See: https://forums.openvpn.net/topic18183.html#p49483

dgermann wrote2. Allow vpn port to be accessed for any protocol from anywhere.

dgermann wroteI am concerned that rule #2 is a security risk. Is it?

Is that all still accurate ?