dlpco
I am using my ASUS RT-N66U VPN services and having some trouble. I am using Windows 7 64bit and the Android is a Galaxy S III mini.
If I configure it to tunnel over TCP, the Android seems to work but there is no DNS under windows. If I configure it as UDP, it works (has DNS) in windows, but will not even connect with the Android. What am I doing wrong. Been working on this for hours and getting no where fast. I got a feeling that the Android can't handle UDP through the WiFi LAN Connection.
Any help????
Thanks...
DonC
Traffic
As the problem appears to be for Android/UDP only .. please post your server and client config and logs when trying to connect with Android/UDP.
dlpco
You are going to have to be kind as I am an IT guy who does not know a lot about VPN. (I think I will soon though!)
The client config:
client
dev tun
proto udp
remote xxxx.asuscomm.com 1194
float
comp-lzo adaptive
keepalive 15 60
auth-user-pass
ns-cert-type server
<ca>
-----BEGIN CERTIFICATE-----
cert
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
cert
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
key
-----END PRIVATE KEY-----
</key>
resolv-retry infinite
nobind
I am using the same config for both Windows and Android but maybe there needs to be a difference?
The server side is a GUI and I need to figure out how to attach a .png file to this message.
As well, the Android is attached to my network via WiFi (just as the PC is) and I am trying to get a VPN connection to the router.
PC <---WiFi---> Router <--WiFi----> Android
I am going to try the Android away from my network (McDonalds, Carl's r somewhere) to see if it is an issue with being already connected to my router.
dlpco
Oops... Forgot to include - The Server log shows the following: (192.168.1.190 is the DHCP address of my Android)
Mar 25 10:51:20 openvpn[1565]: 192.168.1.190:49958 TLS: Initial packet from [AF_INET]192.168.1.190:49958, sid=2a695770 7c272e5d
Mar 25 10:51:30 openvpn[1565]: 192.168.1.190:39218 TLS: Initial packet from [AF_INET]192.168.1.190:39218, sid=5908ac9b ffaf5b21
Mar 25 10:51:40 openvpn[1565]: 192.168.1.190:53015 TLS: Initial packet from [AF_INET]192.168.1.190:53015, sid=afce1346 82cfb351
Mar 25 10:51:50 openvpn[1565]: 192.168.1.190:41948 TLS: Initial packet from [AF_INET]192.168.1.190:41948, sid=6f7bf2ff a67419f9
Mar 25 10:52:00 openvpn[1565]: 192.168.1.190:37793 TLS: Initial packet from [AF_INET]192.168.1.190:37793, sid=18848a0d 69418322
Mar 25 10:52:10 openvpn[1565]: 192.168.1.190:35058 TLS: Initial packet from [AF_INET]192.168.1.190:35058, sid=7502cf12 573bd417
Mar 25 10:52:20 openvpn[1565]: 192.168.1.190:49958 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Mar 25 10:52:20 openvpn[1565]: 192.168.1.190:49958 TLS Error: TLS handshake failed
Mar 25 10:52:20 openvpn[1565]: 192.168.1.190:49958 SIGUSR1[soft,tls-error] received, client-instance restarting
Mar 25 10:52:31 openvpn[1565]: 192.168.1.190:39218 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Mar 25 10:52:31 openvpn[1565]: 192.168.1.190:39218 TLS Error: TLS handshake failed
Mar 25 10:52:31 openvpn[1565]: 192.168.1.190:39218 SIGUSR1[soft,tls-error] received, client-instance restarting
Mar 25 10:52:40 openvpn[1565]: 192.168.1.190:53015 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Mar 25 10:52:40 openvpn[1565]: 192.168.1.190:53015 TLS Error: TLS handshake failed
Mar 25 10:52:40 openvpn[1565]: 192.168.1.190:53015 SIGUSR1[soft,tls-error] received, client-instance restarting
Mar 25 10:52:50 openvpn[1565]: 192.168.1.190:41948 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Mar 25 10:52:50 openvpn[1565]: 192.168.1.190:41948 TLS Error: TLS handshake failed
Mar 25 10:52:50 openvpn[1565]: 192.168.1.190:41948 SIGUSR1[soft,tls-error] received, client-instance restarting
Mar 25 10:53:00 openvpn[1565]: 192.168.1.190:37793 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Mar 25 10:53:00 openvpn[1565]: 192.168.1.190:37793 TLS Error: TLS handshake failed
Mar 25 10:53:00 openvpn[1565]: 192.168.1.190:37793 SIGUSR1[soft,tls-error] received, client-instance restarting
Mar 25 10:53:10 openvpn[1565]: 192.168.1.190:35058 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Mar 25 10:53:10 openvpn[1565]: 192.168.1.190:35058 TLS Error: TLS handshake failed
Mar 25 10:53:10 openvpn[1565]: 192.168.1.190:35058 SIGUSR1[soft,tls-error] received, client-instance restarting
dlpco
As noted, I tried connecting to PN outside of my network (McDonalds) and the Android worked! So it seems that something is not configured correctly to allow me to connect via UDP TUN within my own network. Kind of encouraging but it would be nice to have this solved all the way - and why just the Android and not the PC as well?
I am using the OpenVPN Connect 1.1.16 (Build 74) of OpenVPN Connect on the Android and OpenVPN 2.3.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Mar 19 2015 for the Windows 7 PC.
Traffic
dlpco wroteI tried connecting to PN outside of my network (McDonalds) and the Android worked!
"PN" .. what is that ?
dlpco wroteSo it seems that something is not configured correctly to allow me to connect via UDP TUN within my own network
can you connect locally from your windows PC ?
dlpco wroteThe server side is a GUI and I need to figure out how to attach a .png file to this message
Much better to get a console on your device and find the actual config file .. if possible.
dlpco wrote192.168.1.190 is the DHCP address of my Android
This is in your home ? probably worth changing if you roam .. I strongly recommend you do this first (example server LAN: 192.168.217.0/24)
- NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
dlpco
What I tried to say was that I went away from my network to McDonalds as well as an open wireless at a hospital I know and tried the OpenVPN (that is the "PN" I wrote) and it worked great on my Android. No issues at all. It is just when I am connected locally to my wireless network the Android fails to even connect. I have turned off the firewall and all the other OpenVPN without issue. Works like a charm. So it is just the Android that fails. I tried a different Android and it fails as well if already connected to my network.
I am trying to get the routers VPN server config file, but it is not really that easy with an ASUS RT-N66U. Working on it though...
Seems strange that the PC would work (maybe using a different driver or something) and the Android will not.
My Internal network is 192.168.1.x so are you saying to change that to 192.168.217.x? I am unsure what that will do for me. Neither are routable IP addresses and would be internal to my router. When OpenVPN connects, I actually get a 10.8.x.x address. Am I missing something???
Traffic
dlpco wroteat a hospital I know and tried the OpenVPN (that is the "PN" I wrote) and it worked great on my Android
PN .. private network .. ok
dlpco wrotewhen I am connected locally to my wireless network the Android fails to even connect. I have turned off the firewall and all the other OpenVPN without issue
"
and all other clients connect to the vpn without issue" ? .. ok .. i guess .. it is andriod or a local firewall .. if all your other clients connect then i presume your router supports
loopback connections. (consult your router documentation) # Is your computer connected by ethernet and your Android over wifi ?
dlpco wroteMy Internal network is 192.168.1.x so are you saying to change that to 192.168.217.x? I am unsure what that will do for me
if your server lan IP (home) is the same as the client lan IP (
hospital) [*192.168.0+1.0/24 or other accidental conflict] the vpn will not function well. *.0+1/24 networks are the most common. If you have a public ipv4 address
on the client .. it should be ok.
dlpco
The Laptop is wireless as is the Android.
So it looks like:
Laptop <---- Wireless 192.168.1.x ----> My ASUS RT-N66U Router <----- Wireless 192.168.1.x -----> Android
The Laptop works but the Android does not. If I change to TCP TUN (not a good thing) the Android will connect but there is no DNS on the Laptop. (Don't want to do that anyway.)
If I am connected through someplace like McDonalds or the hospital via wireless, BOTH work great. (They get to my router using PUBLIC address 216.237... and 64.134...) I did not look to see what they actually assigned to me when I connected - so it could have been a 192 address of some sorts.
So this works:
Android <---- Wireless unknown IP ----> McDonalds/Hospital Router <--- 216.237... or 64.134... ---> My ASUS RT-N66U Router
dlpco
It gets even stranger! My son is heading to China to do some work and when he tries his laptop at work (currently in the USA) he gets connected but has no DNS resolution. Is there some parameter that can be passed along that will set a DNS Server correctly for him? When he connects his Android to the work wireless, all works fine!
So - I took my laptop to McDonalds and tried to connect. It asked for my password and then sat there and timed out. (Android worked great!) Is there something in Windows 7 that needs to be done to allow the PC to create a VPN connection away from it home network? I even tried to connect after disabling the McAfee firewall. Still fails.
dlpco
I finally got the server configuration file from the router.
# Automatically generated configuration
daemon
server 10.8.0.0 255.255.255.0
proto udp
port 1194
dev tun21
comp-lzo adaptive
keepalive 15 60
verb 3
push "route 192.168.1.0 255.255.255.0"
duplicate-cn
push "redirect-gateway def1"
plugin /usr/lib/openvpn-plugin-auth-pam.so openvpn
ca ca.crt
dh dh.pem
cert server.crt
key server.key
status-version 2
status status
# Custom Configuration
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
The last two entries, the Custom Configuration, is what I added to get some sort of DNS sent out so that DNS resolution could take place for my son's PC. He is still at work so I am unsure if this solved his issues or not.
I am not sure what the line
push "route 192.168.1.0 255.255.255.0"
is actually doing - not sure what any of them do except the last two but will be looking into what they do. Hopefully not that both of the configurations are available, someone will figure out what my initial issue is. I am still working on my laptop trying to figure out why it did not work at the free McDonalds. It asked for the password and then just timed out.
Maybe this is the 192.168.x.x address thing raising its head??
Thanks for all of the help so far.
dlpco
Traffic,
I changed the private network to 192.168.218.0/24 and re-worked the router a little for static assigned IPs and the like. Now, the config files show the following...
Server Config: (Off of the router)
# Automatically generated configuration
daemon
server 10.8.0.0 255.255.255.0
proto udp
port 1194
dev tun21
comp-lzo adaptive
keepalive 15 60
verb 3
push "route 192.168.218.0 255.255.255.0"
duplicate-cn
push "redirect-gateway def1"
plugin /usr/lib/openvpn-plugin-auth-pam.so openvpn
ca ca.crt
dh dh.pem
cert server.crt
key server.key
status-version 2
status status
# Custom Configuration
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
Client Config:
client
dev tun
proto udp
remote DLPCO.asuscomm.com 1194
float
comp-lzo adaptive
keepalive 15 60
auth-user-pass
ns-cert-type server
<ca>
-----BEGIN CERTIFICATE-----
[The Certificate]
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
[The Certificate]
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
[The Key]
-----END PRIVATE KEY-----
</key>
resolv-retry infinite
nobind
The issues with the PC's seems to have been resolved by the pushing of the DNS (last two lines in the server configuration) but it still fails the same way if I try and connect my android when it is connected to the local network. To consolidate the messages, the failure log from the server shows:
Mar 28 19:39:51 openvpn[2837]: 192.168.218.153:36724 TLS: Initial packet from [AF_INET]192.168.218.153:36724, sid=c3a8f40c c8c8f5bd
Mar 28 19:40:00 openvpn[2837]: 192.168.218.153:50451 TLS: Initial packet from [AF_INET]192.168.218.153:50451, sid=1ae8cdb2 0d6bdd54
Mar 28 19:40:10 openvpn[2837]: 192.168.218.153:43436 TLS: Initial packet from [AF_INET]192.168.218.153:43436, sid=25ba39a7 978df6e5
Mar 28 19:40:20 openvpn[2837]: 192.168.218.153:38755 TLS: Initial packet from [AF_INET]192.168.218.153:38755, sid=108e3850 c650bb43
Mar 28 19:40:30 openvpn[2837]: 192.168.218.153:34076 TLS: Initial packet from [AF_INET]192.168.218.153:34076, sid=5f7c799f a1786b2b
Mar 28 19:40:41 openvpn[2837]: 192.168.218.153:46804 TLS: Initial packet from [AF_INET]192.168.218.153:46804, sid=c782f327 9c07be3f
Mar 28 19:40:51 openvpn[2837]: 192.168.218.153:36724 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Mar 28 19:40:51 openvpn[2837]: 192.168.218.153:36724 TLS Error: TLS handshake failed
Mar 28 19:40:51 openvpn[2837]: 192.168.218.153:36724 SIGUSR1[soft,tls-error] received, client-instance restarting
Mar 28 19:41:00 openvpn[2837]: 192.168.218.153:50451 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Mar 28 19:41:00 openvpn[2837]: 192.168.218.153:50451 TLS Error: TLS handshake failed
Mar 28 19:41:00 openvpn[2837]: 192.168.218.153:50451 SIGUSR1[soft,tls-error] received, client-instance restarting
Mar 28 19:41:11 openvpn[2837]: 192.168.218.153:43436 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Mar 28 19:41:11 openvpn[2837]: 192.168.218.153:43436 TLS Error: TLS handshake failed
Mar 28 19:41:11 openvpn[2837]: 192.168.218.153:43436 SIGUSR1[soft,tls-error] received, client-instance restarting
Mar 28 19:41:20 openvpn[2837]: 192.168.218.153:38755 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Mar 28 19:41:20 openvpn[2837]: 192.168.218.153:38755 TLS Error: TLS handshake failed
Mar 28 19:41:20 openvpn[2837]: 192.168.218.153:38755 SIGUSR1[soft,tls-error] received, client-instance restarting
Mar 28 19:41:30 openvpn[2837]: 192.168.218.153:34076 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Mar 28 19:41:30 openvpn[2837]: 192.168.218.153:34076 TLS Error: TLS handshake failed
Mar 28 19:41:30 openvpn[2837]: 192.168.218.153:34076 SIGUSR1[soft,tls-error] received, client-instance restarting
Mar 28 19:41:41 openvpn[2837]: 192.168.218.153:46804 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Mar 28 19:41:41 openvpn[2837]: 192.168.218.153:46804 TLS Error: TLS handshake failed
Mar 28 19:41:41 openvpn[2837]: 192.168.218.153:46804 SIGUSR1[soft,tls-error] received, client-instance restarting
The Client log (not sure how to save it with OpenVNP Connect on the Android) says:
1) It is connecting via UDP to the router
2) Event Wait
3) Server Poll Timeout
Thanks for all the help and suggestions.
dlpco
Did I loose everyone???
Don
Traffic
Yes ..
Verify these points:
- When you are home using your private wifi
- can connect locally with Windows PC
can not connect locally with Android
- When you are outside using public wifi
- can connect remotely with your Windows PC
can connect remotely with your Andriod
dlpco
I believe what you say is correct.
When I am connected outside of my network to a "free WiFi" trying to connect with OpenVPN gives me:
Success with my PC.
Success with my Androids.
When I am connected inside of my network to WiFi of the router, trying to connect with OpenVPN gives me:
Success with my PC.
FAILURE with my Androids.
I wanted to be sure we are both saying the same things - and I think we are.
Don
dlpco
BTW....
Just to make things interesting, I changed to use TCP rather than UDP and I can connect the Androids from within the ASUS router inside network. I am not thrilled by this, but it is an interesting observation. Does the OpenVPN Connect app handle things differently than the Windows OpenVPN client? Must be as the Windows one works with UDP and the Android version does not.
But then - outside my network, they both work!
Don
