My server and client have been working for months with no issues. This week this the client disconnects, and I have been working for 10 hours to figure this out. I regen all of the server and client keys, and redid them in both places. Here are the extras that I tried to put in the server config that wasn't there before and seemingly hasn't worked: tls-auth /usr/share/easy-rsa/2.0/keys/ta.key 0 mode server tls-server cipher BF-CBC The other settings are the AS defaults. I have scoured the net and have turned off all firewalls, made sure the keys are pasted correct, they exist, the AS is configured properly, I can connect with the software client just fine. Tested everything one item at a time for 10 hours and I just keep getting this dreaded message. The client has the screenshot configured [url]https://drive.google.com/file/d/0B0P3rhGapJItRUYzTHNxNElIVnM/view?usp=sharing[/url]. I am at a total loss - any help would be awesome... Client: DD-WRT, OpenVPN Client Client Error: 20150929 03:00:43 N TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) 20150929 03:00:43 N TLS Error: TLS handshake failed 20150929 03:00:43 I SIGUSR1[soft tls-error] received process restarting 20150929 03:00:43 Restart pause 2 second(s) Server OpenVPN Open Access Server (10 licenses) Server Error: 015-09-29 03:06:28-0700 [-] OVPN 1 OUT: 'Tue Sep 29 10:06:28 2015 Authenticate/Decrypt packet error: packet HMAC authentication failed' 2015-09-29 03:06:28-0700 [-] OVPN 1 OUT: 'Tue Sep 29 10:06:28 2015 TLS Error: incoming packet authentication failed from [AF_INET]98.191.180.38:41567'

I think you need to enable a [b]TLS Cipher[/b] in your client.

[quote="openholdings"]Here are the extras that I tried to put in the server config that wasn't there before and seemingly hasn't worked: tls-auth /usr/share/easy-rsa/2.0/keys/ta.key 0[/quote]If you did [u]not[/u] have --[b]tls-auth[/b] enabled before then that is probably the source of the problem. Try disabling --[b]tls-auth[/b] for testing.

OpenVPN Access Server documentation: [url]https://openvpn.net/index.php/access-server/docs.html[/url] OpenVPN Access Server support: https://openvpn.net/index.php/login.html

TLS Handshake Error

openholdings

My server and client have been working for months with no issues. This week this the client disconnects, and I have been working for 10 hours to figure this out. I regen all of the server and client keys, and redid them in both places.

Here are the extras that I tried to put in the server config that wasn't there before and seemingly hasn't worked:

tls-auth /usr/share/easy-rsa/2.0/keys/ta.key 0
mode server
tls-server
cipher BF-CBC

The other settings are the AS defaults. I have scoured the net and have turned off all firewalls, made sure the keys are pasted correct, they exist, the AS is configured properly, I can connect with the software client just fine. Tested everything one item at a time for 10 hours and I just keep getting this dreaded message. The client has the screenshot configured https://drive.google.com/file/d/0B0P3rhGapJItRUYzTHNxNElIVnM/view?usp=sharing.

I am at a total loss - any help would be awesome...

Client: DD-WRT, OpenVPN Client

Client Error:

20150929 03:00:43 N TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
20150929 03:00:43 N TLS Error: TLS handshake failed
20150929 03:00:43 I SIGUSR1[soft tls-error] received process restarting
20150929 03:00:43 Restart pause 2 second(s)

Server OpenVPN Open Access Server (10 licenses)

Server Error:

015-09-29 03:06:28-0700 [-] OVPN 1 OUT: 'Tue Sep 29 10:06:28 2015 Authenticate/Decrypt packet error: packet HMAC authentication failed'
2015-09-29 03:06:28-0700 [-] OVPN 1 OUT: 'Tue Sep 29 10:06:28 2015 TLS Error: incoming packet authentication failed from [AF_INET]98.191.180.38:41567'

Traffic

I think you need to enable a TLS Cipher in your client.

openholdings

I added every TLS Cipher to the client, saved and waited a few minutes with the exact same result. I had the TLS Cipher set to none prior and it worked flawless. The Encryption Cipher has been Blowfish CBC the entire time without changing. Which ciper are you referring?

openholdings

I have a the Encryption cipher as Blowfish CBC and the TLS Cipher set to none. This worked forever.

I tried adding one of every TLS ciper there is, saving and testing with no luck. Any other ideas?

openholdings

Any one else have an idea?

Traffic

openholdings wroteHere are the extras that I tried to put in the server config that wasn't there before and seemingly hasn't worked:

tls-auth /usr/share/easy-rsa/2.0/keys/ta.key 0

If you did not have --tls-auth enabled before then that is probably the source of the problem.

Try disabling --tls-auth for testing.

openholdings

I don't really know, because the AS config file referneced nothing, so I assume it was on.

I went to the AS gui and put in -tls-auth and it still failed.

openholdings

How would I make and find the ta file? I think it is that going bad. I am getting to the handshake I think. Never mind the times - I have corresponding ones, just got lazy, but they match up like this:

Client

20150930 23:33:05 N TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
20150930 23:33:05 N TLS Error: TLS handshake failed
20150930 23:33:05 I SIGUSR1[soft tls-error] received process restarting

Server

2015-09-30 23:32:12-0700 [-] OVPN 1 OUT: 'Thu Oct 1 06:32:12 2015 Authenticate/Decrypt packet error: packet HMAC authentication failed'
2015-09-30 23:32:12-0700 [-] OVPN 1 OUT: 'Thu Oct 1 06:32:12 2015 TLS Error: incoming packet authentication failed from [AF_INET]189.195.164.60:44109'

Traffic

OpenVPN Access Server documentation:
https://openvpn.net/index.php/access-server/docs.html

OpenVPN Access Server support:
https://openvpn.net/index.php/login.html