I am attempting to connect to an openvpn server I created in pfSense using Tunnelblick on a Mac. When I try to connect, there is an error in the TLS handshake. It appears that the initial packet beginning the TLS handshake makes it to the openVPN server, but there is no response sent so the connection repeatedly tries to establish itself until it is manually disconnected. I am using a local CA on the pfSense server, where I generated the certificates and keys for the client. Any help would be appreciated.
Client Config File:
client
dev tap
proto tcp
remote 128.151.18.205 443
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert Mac.crt
key Mac.key
ns-cert-type server
tls-auth ta.key 1
cipher AES-128-CBC
auth SHA1
Server Config File:
dev ovpns1
verb 4
dev-type tap
dev-node /dev/tap1
writepid /var/run/openvpn_server1.pid
#user nobody
#group nobody
script-security 3
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
proto tcp-server
cipher AES-128-CBC
auth SHA1
up /usr/local/sbin/ovpn-linkup
down /usr/local/sbin/ovpn-linkdown
local 128.151.18.205
tls-server
server-bridge 192.168.42.36 255.255.224.0 192.168.40.10 192.168.40.49
client-config-dir /var/etc/openvpn-csc
tls-verify "/usr/local/sbin/ovpn_auth_verify tls 'pfSense-559a8e35a90d9' 1 "
lport 443
management /var/etc/openvpn/server1.sock unix
push "route 192.168.0.0 255.255.0.0"
ca /var/etc/openvpn/server1.ca
cert /var/etc/openvpn/server1.cert
key /var/etc/openvpn/server1.key
dh /etc/dh-parameters.1024
tls-auth /var/etc/openvpn/server1.tls-auth 0
Client Error Log:
2015-07-10 09:22:14 TLS: Initial packet from [AF_INET]128.151.18.205:443, sid=5451e220 0b112c38
2015-07-10 09:22:14 VERIFY ERROR: depth=0, error=self signed certificate: C=US, ST=State, L=Locality, O=pfSense webConfigurator Self-Signed Certificate, emailAddress=
admin@pfSense.localdomain, CN=pfSense-559a8e35a90d9
2015-07-10 09:22:14 TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed
2015-07-10 09:22:14 TLS Error: TLS object -> incoming plaintext read error
2015-07-10 09:22:14 TLS Error: TLS handshake failed
Server Error Log:
Jul 10 09:20:54 openvpn[12430]: 128.151.105.61:49609 TLS: Initial packet from [AF_INET]128.151.105.61:49609, sid=e76a49a2 ebdf7007
Jul 10 09:20:54 openvpn[12430]: 128.151.105.61:49609 Connection reset, restarting [0]
Jul 10 09:20:54 openvpn[12430]: 128.151.105.61:49609 SIGUSR1[soft,connection-reset] received, client-instance restarting
Jul 10 09:20:54 openvpn[12430]: TCP connection established with [AF_INET]128.151.105.61:49610
Jul 10 09:20:55 openvpn[12430]: 128.151.105.61:49610 TLS: Initial packet from [AF_INET]128.151.105.61:49610, sid=87f9aad1 e0c35c73
Jul 10 09:20:55 openvpn[12430]: 128.151.105.61:49610 Connection reset, restarting [0]
Jul 10 09:20:55 openvpn[12430]: 128.151.105.61:49610 SIGUSR1[soft,connection-reset] received, client-instance restarting
Jul 10 09:20:55 openvpn[12430]: TCP connection established with [AF_INET]128.151.105.61:49611
Jul 10 09:20:56 openvpn[12430]: 128.151.105.61:49611 TLS: Initial packet from [AF_INET]128.151.105.61:49611, sid=ef674901 448ac457
Jul 10 09:20:56 openvpn[12430]: 128.151.105.61:49611 Connection reset, restarting [0]
Jul 10 09:20:56 openvpn[12430]: 128.151.105.61:49611 SIGUSR1[soft,connection-reset] received, client-instance restarting
Jul 10 09:20:56 openvpn[12430]: TCP connection established with [AF_INET]128.151.105.61:49612
Jul 10 09:20:57 openvpn[12430]: 128.151.105.61:49612 TLS: Initial packet from [AF_INET]128.151.105.61:49612, sid=e73730c6 71cad131
Jul 10 09:20:57 openvpn[12430]: 128.151.105.61:49612 Connection reset, restarting [0]
Jul 10 09:20:57 openvpn[12430]: 128.151.105.61:49612 SIGUSR1[soft,connection-reset] received, client-instance restarting
Jul 10 09:20:58 openvpn[12430]: TCP connection established with [AF_INET]128.151.105.61:49613
Jul 10 09:20:59 openvpn[12430]: 128.151.105.61:49613 TLS: Initial packet from [AF_INET]128.151.105.61:49613, sid=f7386ec6 cd1903e6
Jul 10 09:20:59 openvpn[12430]: 128.151.105.61:49613 Connection reset, restarting [0]
Jul 10 09:20:59 openvpn[12430]: 128.151.105.61:49613 SIGUSR1[soft,connection-reset] received, client-instance restarting
Jul 10 09:20:59 openvpn[12430]: TCP connection established with [AF_INET]128.151.105.61:49614
Jul 10 09:20:59 openvpn[12430]: 128.151.105.61:49614 Connection reset, restarting [0]
Jul 10 09:20:59 openvpn[12430]: 128.151.105.61:49614 SIGUSR1[soft,connection-reset] received, client-instance restarting
Jul 10 09:21:24 openvpn[12430]: MANAGEMENT: Client connected from /var/etc/openvpn/server1.sock
Jul 10 09:21:24 openvpn[12430]: MANAGEMENT: CMD 'status 2'
Jul 10 09:21:24 openvpn[12430]: MANAGEMENT: CMD 'quit'
Jul 10 09:21:24 openvpn[12430]: MANAGEMENT: Client disconnected
Jul 10 09:22:26 openvpn[12430]: MANAGEMENT: Client connected from /var/etc/openvpn/server1.sock
Jul 10 09:22:26 openvpn[12430]: MANAGEMENT: CMD 'status 2'
Jul 10 09:22:26 openvpn[12430]: MANAGEMENT: CMD 'quit'
Jul 10 09:22:26 openvpn[12430]: MANAGEMENT: Client disconnected
Jul 10 09:23:30 openvpn[12430]: MANAGEMENT: Client connected from /var/etc/openvpn/server1.sock
Jul 10 09:23:30 openvpn[12430]: MANAGEMENT: CMD 'status 2'
Jul 10 09:23:30 openvpn[12430]: MANAGEMENT: CMD 'quit'
Jul 10 09:23:30 openvpn[12430]: MANAGEMENT: Client disconnected
Jul 10 09:24:31 openvpn[12430]: MANAGEMENT: Client connected from /var/etc/openvpn/server1.sock
Jul 10 09:24:31 openvpn[12430]: MANAGEMENT: CMD 'status 2'
Jul 10 09:24:32 openvpn[12430]: MANAGEMENT: CMD 'quit'
Jul 10 09:24:32 openvpn[12430]: MANAGEMENT: Client disconnected
Jul 10 09:25:33 openvpn[12430]: MANAGEMENT: Client connected from /var/etc/openvpn/server1.sock
Jul 10 09:25:33 openvpn[12430]: MANAGEMENT: CMD 'status 2'
Jul 10 09:25:33 openvpn[12430]: MANAGEMENT: CMD 'quit'
Jul 10 09:25:33 openvpn[12430]: MANAGEMENT: Client disconnected
