Raspberry PI 2 - OpenVPN Not Working

Xema

Hi there,

My goal is to build my own VPN on my Raspberry PI 2. I followed ReadWrite's tutorial on that matter (you can see this tutorial here : http://readwrite.com/2014/04/10/raspberry-pi-vpn-tutorial-server-secure-web-browsing). After re-doing the tutorial 3 times and a lot of hours of research on the Internet, it's still not working and can't understand why.

Here's the error message on the client's side :

Sun Sep 06 21:16:30 2015 OpenVPN 2.3.8 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Aug  4 2015
Sun Sep 06 21:16:30 2015 library versions: OpenSSL 1.0.1p 9 Jul 2015, LZO 2.08
Sun Sep 06 21:16:35 2015 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Sun Sep 06 21:16:35 2015 Control Channel Authentication: tls-auth using INLINE static key file
Sun Sep 06 21:16:35 2015 UDPv4 link local: [undef]
Sun Sep 06 21:16:35 2015 UDPv4 link remote: [AF_INET]82.120.231.93:1194
Sun Sep 06 21:16:35 2015 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
Sun Sep 06 21:16:38 2015 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
Sun Sep 06 21:16:41 2015 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
Sun Sep 06 21:16:49 2015 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
Sun Sep 06 21:17:06 2015 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
Sun Sep 06 21:17:35 2015 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sun Sep 06 21:17:35 2015 TLS Error: TLS handshake failed
Sun Sep 06 21:17:35 2015 SIGUSR1[soft,tls-error] received, process restarting

Here is the openvpn.log file :

Sun Sep  6 20:59:01 2015 OpenVPN 2.2.1 arm-linux-gnueabihf [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Dec  1 2014
Sun Sep  6 20:59:01 2015 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Sun Sep  6 20:59:01 2015 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Sun Sep  6 20:59:01 2015 Control Channel Authentication: using '/etc/openvpn/easy-rsa/keys/ta.key' as a OpenVPN static key file
Sun Sep  6 20:59:01 2015 TUN/TAP device tun0 opened
Sun Sep  6 20:59:01 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sun Sep  6 20:59:01 2015 /sbin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
Sun Sep  6 20:59:01 2015 GID set to nogroup
Sun Sep  6 20:59:01 2015 UID set to nobody
Sun Sep  6 20:59:01 2015 UDPv4 link local (bound): [AF_INET]192.168.1.65:1194
Sun Sep  6 20:59:01 2015 UDPv4 link remote: [undef]
Sun Sep  6 20:59:01 2015 Initialization Sequence Completed

And here is the openvpn-status.log file :

OpenVPN CLIENT LIST
Updated,Sun Sep  6 21:15:14 2015
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
GLOBAL STATS
Max bcast/mcast queue length,0
END

Now maybe i can link the content of some useful files such as :
/etc/openvpn/easy-rsa/server.conf:

local 192.168.1.XX
dev tun
proto udp
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/Ditto.crt
key /etc/openvpn/easy-rsa/keys/Ditto.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
server 10.8.0.0 255.255.255.0

ifconfig 10.8.0.1 10.8.0.2
push "route 10.8.0.1 255.255.255.255"
push "route 10.8.0.0 255.255.255.0"

push "route 192.168.1.0 255.255.255.0"
push "dhcp-option DNS 192.168.1.1"

push "redirect-gateway def1"
client-to-client
duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-128-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 1

/etc/network/interfaces

auto lo
iface lo inet loopback

auto eth0
allow-hotplug eth0
iface eth0 inet static
        pre-up /etc/firewall-openvpn-rules.sh
address 192.168.1.XX
netmask 255.255.255.0
network 192.168.1.0
broadcast 192.168.1.255
gateway 192.168.1.1

auto wlan0
allow-hotplug wlan0
iface wlan0 inet manual
wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf

auto wlan1
allow-hotplug wlan1
iface wlan1 inet manual
wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf

/etc/firewall-openvpn-rules.sh

#!/bin/sh

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.1.XX

/etc/openvpn/easy-rsa/keys/Default.txt

client
dev tun
proto udp
remote my.router.ip 1194
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
ns-cert-type server
key-direction 1
cipher AES-128-CBC
comp-lzo
verb 1
mute 20

What's wrong guys ? Any idea ? I hope that you will be able to help. Since I'm a beginner in the field, be gentle 🙂.

I already thank you !

Xema

PS : If the topic is in the wrong section, I apology. Feel free to move it to the right one !

Traffic

It looks like you have not opened port UDP:1194 on the server side firewall ..

Also,

NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.