I am connecting two private LANs, at separate locations, via an OpenVPN tunnel. Each location has a Netgear R7000 router running the same Kong firmware (26500M). One is configured as an OpenVPN server, the other as a client. Everything appears to be in order, but the client just gets TLS handshake failures. I've tried moving the service to other ports, thinking perhaps something was being blocked, but no joy. The server firewall isn't locked down, but I added a rule anyway (iptables -I INPUT 2 -p udp --dport 1194 -j ACCEPT), still nothing. I've been staring at this for so long, that I'm hoping I'm just missing something really stupid. Could someone please sanity check this setup?
"Server" location: static public IP, obfuscated as "x.x.x.x" below, private IP range 10.0.1.0/24.
"Client" location: dynamic public IP, private IP range 10.0.2.0/24.
Server config:
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
keepalive 10 120
verb 3
mute 3
syslog
writepid /var/run/openvpnd.pid
management 127.0.0.1 14
management-log-cache 100
topology subnet
script-security 2
port 1194
proto udp
cipher aes-256-cbc
auth sha256
client-connect /tmp/openvpn/clcon.sh
client-disconnect /tmp/openvpn/cldiscon.sh
client-config-dir /tmp/openvpn/ccd
comp-lzo adaptive
tls-server
ifconfig-pool-persist /tmp/openvpn/ip-pool 86400
client-to-client
tls-cipher TLS-DHE-RSA-WITH-AES-128-CBC-SHA
fast-io
tun-mtu 1500
mtu-disc yes
server 10.0.0.0 255.255.255.0
dev tun2
tun-ipv6
tls-auth /tmp/openvpn/ta.key 0
local x.x.x.x
topology subnet
verb 4
ifconfig 10.0.0.1 255.255.255.0
route 10.0.2.0 255.255.255.0
push "route 10.0.1.0 255.255.255.0"
Client config:
ca /tmp/openvpncl/ca.crt
cert /tmp/openvpncl/client.crt
key /tmp/openvpncl/client.key
management 127.0.0.1 16
management-log-cache 100
verb 3
mute 3
syslog
writepid /var/run/openvpncl.pid
client
resolv-retry infinite
nobind
persist-key
persist-tun
script-security 2
dev tun1
proto udp
cipher aes-256-cbc
auth sha256
remote x.x.x.x 1194
comp-lzo adaptive
tls-client
tun-mtu 1500
mtu-disc yes
fast-io
tun-ipv6
tls-auth /tmp/openvpncl/ta.key 1
tls-cipher TLS-DHE-RSA-WITH-AES-128-CBC-SHA
ns-cert-type server
verb 4
Server log:
20150404 16:16:41 Current Parameter Settings:
20150404 16:16:41 config = '/tmp/openvpn/openvpn.conf'
20150404 16:16:41 mode = 1
20150404 16:16:41 NOTE: --mute triggered...
20150404 16:16:41 229 variation(s) on previous 3 message(s) suppressed by --mute
20150404 16:16:41 I OpenVPN 2.3.6 arm-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Mar 23 2015
20150404 16:16:41 I library versions: OpenSSL 1.0.2a 19 Mar 2015 LZO 2.09
20150404 16:16:41 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:14
20150404 16:16:41 W NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
20150404 16:16:41 Diffie-Hellman initialized with 2048 bit key
20150404 16:16:41 W WARNING: file '/tmp/openvpn/ta.key' is group or others accessible
20150404 16:16:41 I Control Channel Authentication: using '/tmp/openvpn/ta.key' as a OpenVPN static key file
20150404 16:16:41 Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
20150404 16:16:41 Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
20150404 16:16:41 TLS-Auth MTU parms [ L:1570 D:178 EF:78 EB:0 ET:0 EL:0 ]
20150404 16:16:41 Socket Buffers: R=[180224->131072] S=[180224->131072]
20150404 16:16:41 I TUN/TAP device tun2 opened
20150404 16:16:41 TUN/TAP TX queue length set to 100
20150404 16:16:41 I do_ifconfig tt->ipv6=1 tt->did_ifconfig_ipv6_setup=0
20150404 16:16:41 I /sbin/ifconfig tun2 10.0.0.1 netmask 255.255.255.0 mtu 1500 broadcast 10.0.0.255
20150404 16:16:41 /sbin/route add -net 10.0.2.0 netmask 255.255.255.0 gw 10.0.0.2
20150404 16:16:41 Data Channel MTU parms [ L:1570 D:1450 EF:70 EB:135 ET:0 EL:0 AF:3/1 ]
20150404 16:16:41 I UDPv4 link local (bound): [AF_INET]x.x.x.x:1194
20150404 16:16:41 I UDPv4 link remote: [undef]
20150404 16:16:41 MULTI: multi_init called r=256 v=256
20150404 16:16:41 IFCONFIG POOL: base=10.0.0.2 size=252 ipv6=0
20150404 16:16:41 IFCONFIG POOL LIST
20150404 16:16:41 I Initialization Sequence Completed
20150404 16:17:33 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14
20150404 16:17:33 D MANAGEMENT: CMD 'state'
20150404 16:17:33 MANAGEMENT: Client disconnected
20150404 16:17:33 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14
20150404 16:17:33 D MANAGEMENT: CMD 'state'
20150404 16:17:33 MANAGEMENT: Client disconnected
20150404 16:17:33 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14
20150404 16:17:33 D MANAGEMENT: CMD 'state'
20150404 16:17:33 MANAGEMENT: Client disconnected
20150404 16:17:33 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14
20150404 16:17:33 MANAGEMENT: Client disconnected
20150404 16:17:33 NOTE: --mute triggered...
20150404 16:17:33 1 variation(s) on previous 3 message(s) suppressed by --mute
20150404 16:17:33 D MANAGEMENT: CMD 'status 2'
20150404 16:17:33 MANAGEMENT: Client disconnected
20150404 16:17:33 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14
20150404 16:17:33 D MANAGEMENT: CMD 'status 2'
20150404 16:17:33 MANAGEMENT: Client disconnected
20150404 16:17:33 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14
20150404 16:17:33 D MANAGEMENT: CMD 'log 500'
Client log:
20150404 16:20:05 Restart pause 2 second(s)
20150404 16:20:07 W NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
20150404 16:20:07 Re-using SSL/TLS context
20150404 16:20:07 LZO compression initialized
20150404 16:20:07 Control Channel MTU parms [ L:1570 D:178 EF:78 EB:0 ET:0 EL:0 ]
20150404 16:20:07 Socket Buffers: R=[180224->131072] S=[180224->131072]
20150404 16:20:07 Data Channel MTU parms [ L:1570 D:1450 EF:70 EB:135 ET:0 EL:0 AF:3/1 ]
20150404 16:20:07 Local Options String: 'V4 dev-type tun link-mtu 1570 tun-mtu 1500 proto UDPv4 comp-lzo keydir 1 cipher AES-256-CBC auth SHA256 keysize 256 tls-auth key-method 2 tls-client'
20150404 16:20:07 Expected Remote Options String: 'V4 dev-type tun link-mtu 1570 tun-mtu 1500 proto UDPv4 comp-lzo keydir 0 cipher AES-256-CBC auth SHA256 keysize 256 tls-auth key-method 2 tls-server'
20150404 16:20:07 Local Options hash (VER=V4): '73e43c96'
20150404 16:20:07 Expected Remote Options hash (VER=V4): '8a3b3cca'
20150404 16:20:07 I UDPv4 link local: [undef]
20150404 16:20:07 I UDPv4 link remote: [AF_INET]x.x.x.x:1194
20150404 16:21:07 N TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
20150404 16:21:07 N TLS Error: TLS handshake failed
20150404 16:21:07 TCP/UDP: Closing socket
20150404 16:21:07 I SIGUSR1[soft tls-error] received process restarting
