Hi! We can't get OpenVPN to work. Our Juniper-SA works well. The setup is only working without Firewall: Laptop (static IP 80.0.0.4) attachted to an switch and the OpenVPN server attached to the same switch (eth1, dmz) Our setup: [url]https://live.paloaltonetworks.com/t5/image/serverpage/image-id/1322iED92376098DDD353/image-size/original?v=mpbl-1&px=-1[/url] Our Policies: [url]https://live.paloaltonetworks.com/t5/image/serverpage/image-id/1324i240BDE938F915B95/image-size/original?v=mpbl-1&px=-1[/url] Monitor: [url]https://live.paloaltonetworks.com/t5/image/serverpage/image-id/1325i1A2DBC166FF70423/image-size/original?v=mpbl-1&px=-1[/url] Konfig - OpenVPN server DMZ: iface eth1 inet static address 80.0.0.5 netmask 255.255.255.248 gateway 80.0.0.1 Local: iface eth0 inet static address 172.16.0.2 netmask 255.255.255.0 gateway 172.16.0.254 I know about this: [url]https://openvpn.net/index.php/open-source/faq/79-client/253-tls-error-tls-key-negotiation-failed-to-occur-within-60-seconds-check-your-network-connectivity.html[/url] But ist doesn't help :-( Can anyone help me? Thanks a lot! Error OpenVPN Client: [code]Mon Nov 23 11:59:33 2015 NOTE: --user option is not implemented on Windows Mon Nov 23 11:59:33 2015 NOTE: --group option is not implemented on Windows Mon Nov 23 11:59:33 2015 OpenVPN 2.3.8 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Aug 4 2015 Mon Nov 23 11:59:33 2015 library versions: OpenSSL 1.0.1p 9 Jul 2015, LZO 2.08 Mon Nov 23 11:59:33 2015 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340 Mon Nov 23 11:59:33 2015 Need hold release from management interface, waiting... Mon Nov 23 11:59:34 2015 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340 Mon Nov 23 11:59:34 2015 MANAGEMENT: CMD 'state on' Mon Nov 23 11:59:34 2015 MANAGEMENT: CMD 'log all on' Mon Nov 23 11:59:34 2015 MANAGEMENT: CMD 'hold off' Mon Nov 23 11:59:34 2015 MANAGEMENT: CMD 'hold release' Mon Nov 23 11:59:34 2015 Socket Buffers: R=[8192->8192] S=[8192->8192] Mon Nov 23 11:59:34 2015 UDPv4 link local: [undef] Mon Nov 23 11:59:34 2015 UDPv4 link remote: [AF_INET]80.0.0.5:1194 Mon Nov 23 11:59:34 2015 MANAGEMENT: >STATE:1448276374,WAIT,,, Mon Nov 23 12:00:34 2015 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) Mon Nov 23 12:00:34 2015 TLS Error: TLS handshake failed Mon Nov 23 12:00:34 2015 SIGUSR1[soft,tls-error] received, process restarting Mon Nov 23 12:00:34 2015 MANAGEMENT: >STATE:1448276434,RECONNECTING,tls-error,, Mon Nov 23 12:00:34 2015 Restart pause, 2 second(s) Mon Nov 23 12:00:36 2015 Socket Buffers: R=[8192->8192] S=[8192->8192] Mon Nov 23 12:00:36 2015 UDPv4 link local: [undef] Mon Nov 23 12:00:36 2015 UDPv4 link remote: [AF_INET]80.0.0.5:1194 Mon Nov 23 12:00:36 2015 MANAGEMENT: >STATE:1448276436,WAIT,,, Mon Nov 23 12:01:36 2015 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) Mon Nov 23 12:01:36 2015 TLS Error: TLS handshake failed Mon Nov 23 12:01:36 2015 SIGUSR1[soft,tls-error] received, process restarting Mon Nov 23 12:01:36 2015 MANAGEMENT: >STATE:1448276496,RECONNECTING,tls-error,, Mon Nov 23 12:01:36 2015 Restart pause, 2 second(s) Mon Nov 23 12:01:38 2015 Socket Buffers: R=[8192->8192] S=[8192->8192] Mon Nov 23 12:01:38 2015 UDPv4 link local: [undef] Mon Nov 23 12:01:38 2015 UDPv4 link remote: [AF_INET]80.0.0.5:1194 Mon Nov 23 12:01:38 2015 MANAGEMENT: >STATE:1448276498,WAIT,,, [/code] Should I create routes on the interfaces!? If so, is this OK? [url]https://live.paloaltonetworks.com/t5/image/serverpage/image-id/1326i2CE38F9E13770FDF/image-size/original?v=mpbl-1&px=-1[/url] [url]https://live.paloaltonetworks.com/t5/image/serverpage/image-id/1327i7E390836C27A0977/image-size/original?v=mpbl-1&px=-1[/url]

OpenVPN Server in DMZ - TLS Error

marakki

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

maikcat

if you are convinced that your firewall does NOT block ANY traffic you can always try the following:

run wireshark on both server client capturing openvpn traffic then check both logs
to find any missing packets...

Michael.

marakki

maikcat wroteif you are convinced that your firewall does NOT block ANY traffic you can always try the following:

run wireshark on both server client capturing openvpn traffic then check both logs
to find any missing packets...

Michael.

Hi!

I have installed a new openvpn server for testing purpose:
https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-debian-8

Server tcpdump:

root@vpnsrv01:~# tcpdump -ni eth1 udp and port 1194
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 262144 bytes
11:49:34.308885 IP 93.x.x.x.63303 > 80.0.0.5.1194: UDP, length 14
11:49:36.416845 IP 93.x.x.x.63303 > 80.0.0.5.1194: UDP, length 14
11:49:39.597995 IP 93.x.x.x.63303 > 80.0.0.5.1194: UDP, length 14
11:49:47.899512 IP 93.x.x.x.63303 > 80.0.0.5.1194: UDP, length 14

Firewall
https://live.paloaltonetworks.com/t5/image/serverpage/image-id/1383iEAF442352FCE28AF/image-size/original?v=mpbl-1&px=-1

Monitor (Firewall Log)
https://live.paloaltonetworks.com/t5/image/serverpage/image-id/1382i2752A7E903AF3FBD/image-size/original?v=mpbl-1&px=-1

Thanks for your support!

marakki

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.