Problems Connecting from Acer c720 Chromebook.

geekinthesticks

I have OpenVPN installed on one of my Linodes. I can connect OK from Linux computers and Android. However, I am having problems getting my Chromebook to connect. I have followed various tutorials I found and imported my certificates and created an .onc file, which imports with out errors. However, I can't connect and in my server logs I see:

Sat Feb 28 16:55:16 2015 us=621775 46.33.134.31:47346 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sat Feb 28 16:55:16 2015 us=621985 46.33.134.31:47346 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Sat Feb 28 16:55:16 2015 us=622198 46.33.134.31:47346 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Sat Feb 28 16:55:16 2015 us=622425 46.33.134.31:47346 Local Options hash (VER=V4): '14168603'
Sat Feb 28 16:55:16 2015 us=622601 46.33.134.31:47346 Expected Remote Options hash (VER=V4): '504e774e'
Sat Feb 28 16:55:16 2015 us=622806 46.33.134.31:47346 TLS: Initial packet from [AF_INET]46.33.134.31:47346, sid=13d105a7 1c6acff3
Sat Feb 28 16:55:18 2015 us=434126 MULTI: multi_create_instance called
Sat Feb 28 16:55:18 2015 us=434550 46.33.134.31:50323 Re-using SSL/TLS context
Sat Feb 28 16:55:18 2015 us=434852 46.33.134.31:50323 LZO compression initialized
Sat Feb 28 16:55:18 2015 us=435185 46.33.134.31:50323 Control Channel MTU parms [ L:1542 D:166 EF:66 EB:0 ET:0 EL:0 ]
Sat Feb 28 16:55:18 2015 us=435372 46.33.134.31:50323 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sat Feb 28 16:55:18 2015 us=435581 46.33.134.31:50323 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Sat Feb 28 16:55:18 2015 us=435802 46.33.134.31:50323 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Sat Feb 28 16:55:18 2015 us=436039 46.33.134.31:50323 Local Options hash (VER=V4): '14168603'
Sat Feb 28 16:55:18 2015 us=436213 46.33.134.31:50323 Expected Remote Options hash (VER=V4): '504e774e'
Sat Feb 28 16:55:18 2015 us=436408 46.33.134.31:50323 TLS: Initial packet from [AF_INET]46.33.134.31:50323, sid=1485b7a4 90d9d3ef
Sat Feb 28 13:39:03 2015 us=711338 46.33.134.31:58116 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Sat Feb 28 13:39:03 2015 us=711560 46.33.134.31:58116 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Sat Feb 28 13:39:03 2015 us=711794 46.33.134.31:58116 Local Options hash (VER=V4): '14168603'
Sat Feb 28 13:39:03 2015 us=711969 46.33.134.31:58116 Expected Remote Options hash (VER=V4): '504e774e'

Googling the "Expected Remote Options hash" error suggests a problem with tls. However, I have imported my tls key into the Chromebook and the same tls key works OK on other systems.

Traffic

Why did you post in Off Topic ?

geekinthesticks

A combination of brain fade and uncoordinated fingers. Is it possible to move it to a more appropriate section? If not I can re-post in Server Admin if that's the best place.

Traffic

If a mod sees this maybe they will move it to configuration for you.

So now to business:

Please post server and client configs and your client logs.
Please set --verb 4 in configs first.
You may even find the answers yourself if you do ..
8-)

geekinthesticks

Here is my server config:

port 1194

proto udp

dev tun


ca /root/easy-rsa/keys/ca.crt
cert /root/easy-rsa/keys/netflix.crt
key /root/easy-rsa/keys/netflix.key  # This file should be kept secret

dh /etc/openvpn/keys/dh2048.pem


server 10.8.0.0 255.255.255.0

ifconfig-pool-persist ipp.txt

keepalive 10 120

tls-auth /etc/openvpn/keys/ta.key 0

comp-lzo

user nobody
group nobody

persist-key
persist-tun

status openvpn-status.log

verb 4


# Use password based authentication.
#plugin /usr/lib/openvpn/plugins/openvpn-plugin-auth-pam.so login
#client-cert-not-required
#username-as-common-name

push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
# log-append /var/log/openvpn

This is the onc file I am using on the Chromebook:

{
 "Type":"UnencryptedConfiguration",
      "Certificates": [ {
      "GUID": "{f05273d0-70e0-4065-8781-b0198e39e21a}",
      "Type": "Authority",
      "X509": <redacted>
   } ],
    "NetworkConfigurations": [ {
      "GUID": "{42a052ee-bdc4-11e4-8dfc-aa07a5b093db}",
      "Name": "netflix",
      "Type": "VPN",
      "VPN": {
          "Type": "OpenVPN",
          "Host": "netflix.wilkesley.net",
          "OpenVPN": {
                        "ServerCARef": "{f05273d0-70e0-4065-8781-b0198e39e21a}",
                    "AuthRetry": "interact",
                    "ClientCertType": "Pattern",
                    "ClientCertPattern": {
                          "IssuerCARef": [ "{f05273d0-70e0-4065-8781-b0198e39e21a}" ]
                         },
                    "CompLZO": "true",
                    "Port": 1194,
                    "Proto": "udp",
                    "RemoteCertTLS":"server",
                    "RemoteCertEKU": "TLS Web Server Authentication",
                    "SaveCredentials": false,
                    "ServerPollTimeout": 10,
                    "Username": "ian",
                    "KeyDirection":"1",
                    "TLSAuthContents":"-----BEGIN OpenVPN Static key V1-----<redacted>-----END OpenVPN Static key V1-----\n"
                     }
             }
                               } ]
}

Here is an extract from the Chromebook which seems to show a failure of tls authentication:

2015-03-04T09:04:54.646241+00:00 INFO shill[1066]: [INFO:openvpn_management_server.cc(405)] SUCCESS: hold release succeeded
2015-03-04T09:04:54.648812+00:00 NOTICE openvpn[8629]: UDPv4 link local: [undef]
2015-03-04T09:04:54.648833+00:00 NOTICE openvpn[8629]: UDPv4 link remote: [AF_INET]45.56.99.179:1194
2015-03-04T09:04:54.685736+00:00 INFO shill[1066]: [INFO:openvpn_management_server.cc(375)] OpenVPN state: RESOLVE
2015-03-04T09:04:54.685757+00:00 INFO shill[1066]: [INFO:openvpn_management_server.cc(375)] OpenVPN state: WAIT
2015-03-04T09:04:54.946117+00:00 INFO shill[1066]: [INFO:openvpn_management_server.cc(375)] OpenVPN state: AUTH
2015-03-04T09:04:56.377733+00:00 ERR openvpn[8629]: VERIFY ERROR: depth=1, error=self signed certificate in certificate chain: C=GB, ST=Shropshire, L=Whitchurch, O=Manor Farm, CN=netflix.wilkesley.net, name=netflix.wilkesley.net, emailAddress=ian@wilkesley.net
2015-03-04T09:04:56.377776+00:00 ERR openvpn[8629]: TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
2015-03-04T09:04:56.377781+00:00 ERR openvpn[8629]: TLS Error: TLS object -> incoming plaintext read error
2015-03-04T09:04:56.377786+00:00 ERR openvpn[8629]: TLS Error: TLS handshake failed
2015-03-04T09:04:56.377789+00:00 NOTICE openvpn[8629]: SIGUSR1[soft,tls-error] received, process restarting
2015-03-04T09:04:56.379137+00:00 INFO shill[1066]: [INFO:openvpn_management_server.cc(375)] OpenVPN state: RECONNECTING
2015-03-04T09:04:56.379152+00:00 INFO shill[1066]: [INFO:openvpn_driver.cc(957)] OnReconnecting(2)
2015-03-04T09:04:56.379156+00:00 INFO shill[1066]: [INFO:openvpn_management_server.cc(393)] Client waiting for hold release.
2015-03-04T09:04:56.379160+00:00 INFO shill[1066]: [INFO:openvpn_management_server.cc(144)] Releasing hold.
2015-03-04T09:04:56.379735+00:00 WARNING openvpn[8629]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2015-03-04T09:04:56.379855+00:00 INFO shill[1066]: [INFO:openvpn_management_server.cc(405)] SUCCESS: hold release succeeded
2015-03-04T09:04:56.383424+00:00 NOTICE openvpn[8629]: UDPv4 link local: [undef]
2015-03-04T09:04:56.383444+00:00 NOTICE openvpn[8629]: UDPv4 link remote: [AF_INET]45.56.99.179:1194
2015-03-04T09:04:56.418751+00:00 INFO shill[1066]: [INFO:openvpn_management_server.cc(375)] OpenVPN state: RESOLVE
2015-03-04T09:04:56.418771+00:00 INFO shill[1066]: [INFO:openvpn_management_server.cc(375)] OpenVPN state: WAIT
2015-03-04T09:04:56.506297+00:00 INFO shill[1066]: [INFO:openvpn_management_server.cc(375)] OpenVPN state: AUTH
2015-03-04T09:04:57.668584+00:00 INFO shill[1066]: [INFO:vpn_driver.cc(280)] VPN connect timeout.
2015-03-04T09:04:57.677430+00:00 NOTICE openvpn[8629]: SIGTERM[soft,management-exit] received, process exiting
2015-03-04T09:04:57.678152+00:00 INFO shill[1066]: [INFO:rpc_task.cc(31)] RPCTask 1 destroyed.
2015-03-04T09:04:57.691879+00:00 INFO shill[1066]: [INFO:device.cc(1589)] Already in desired enable state.
2015-03-04T09:04:57.694162+00:00 INFO shill[1066]: [INFO:device.cc(214)] Device destructed: tun0 index 4
2015-03-04T09:04:57.705851+00:00 INFO shill[1066]: [INFO:process_killer.cc(35)] Waiting for pid 8629
2015-03-04T09:04:57.712758+00:00 INFO shill[1066]: [INFO:process_killer.cc(64)] Killing pid 8629
2015-03-04T09:04:57.712780+00:00 INFO shill[1066]: [INFO:service.cc(377)] Service 4: state Associating -> Failure
2015-03-04T09:04:57.712784+00:00 INFO shill[1066]: [INFO:service.cc(958)] Noting an unexpected failure to connect.
2015-03-04T09:04:57.714813+00:00 INFO shill[1066]: [INFO:manager.cc(1225)] Service 4 updated; state: Failure failure: connect-failed
2015-03-04T09:04:57.783093+00:00 INFO shill[1066]: [INFO:process_killer.cc(74)] pid 8629 died, status 0
2015-03-04T09:04:57.783115+00:00 INFO shill[1066]: [INFO:process_killer.cc(82)] Running callback for dead pid 8629
2015-03-04T09:04:57.783120+00:00 INFO shill[1066]: [INFO:openvpn_driver.cc(357)] Deleting interface 4
2015-03-04T09:04:57.790443+00:00 ERR shill[1066]: [ERROR:error.cc(103)] Operation failed (no other information)

Traffic

geekinthesticks wroteHere is my server config:
Code:

ca /root/easy-rsa/keys/ca.crt
cert /root/easy-rsa/keys/netflix.crt

Did you create these files yourself or download them from somewhere ?