TLS Handshake Failure

budghiss

Hi, this is a common problem that has probably been beaten to death, but I have been at it for a while. Any insight provided would be of great help.

Background:
pfsense: 2.2.6
OpenVPN Server
CA, Server Cert, & Client Cert attached to user (https://www.highlnk.com/2013/12/configuring-openvpn-on-pfsense/)
firewall rules created
dynamic DNS assigned

Server Config:

dev ovpns1
verb 5
dev-type tun
tun-ipv6
dev-node /dev/tun1
writepid /var/run/openvpn_server1.pid
#user nobody
#group nobody
script-security 3
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
proto udp
cipher AES-256-CBC
auth SHA1
up /usr/local/sbin/ovpn-linkup
down /usr/local/sbin/ovpn-linkdown
client-connect /usr/local/sbin/openvpn.attributes.sh
client-disconnect /usr/local/sbin/openvpn.attributes.sh
local budghiss.mooo.com
tls-server
server 10.0.8.0 255.255.255.0
client-config-dir /var/etc/openvpn-csc
username-as-common-name
auth-user-pass-verify "/usr/local/sbin/ovpn_auth_verify user 'Local Database' false server1" via-env
tls-verify "/usr/local/sbin/ovpn_auth_verify tls 'budghiss.moo.com' 1 "
lport 1194
management /var/etc/openvpn/server1.sock unix
max-clients 5
push "route x.x.x.0 255.255.255.0"
push "dhcp-option DOMAIN budghiss.mooo.com"
push "dhcp-option DNS x.x.x.1" # ROUTER GATEWAY
push "dhcp-option DNS x.x.x.1" # ISP GATEWAY
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.8.4"
push "redirect-gateway def1"
client-to-client
ca /var/etc/openvpn/server1.ca 
cert /var/etc/openvpn/server1.cert 
key /var/etc/openvpn/server1.key 
dh /etc/dh-parameters.2048
tls-auth /var/etc/openvpn/server1.tls-auth 0
persist-remote-ip
float

Server Log:

Feb 28 10:12:52 pfSense openvpn[38817]: OpenVPN 2.3.8 i386-portbld-freebsd10.1 [SSL (OpenSSL)] [LZO] [MH] [IPv6] built on Aug 21 2015
Feb 28 10:12:52 pfSense openvpn[38817]: library versions: OpenSSL 1.0.1l-freebsd 15 Jan 2015, LZO 2.09
Feb 28 10:12:52 pfSense openvpn[38994]: MANAGEMENT: unix domain socket listening on /var/etc/openvpn/server1.sock
Feb 28 10:12:52 pfSense openvpn[38994]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Feb 28 10:12:52 pfSense openvpn[38994]: Diffie-Hellman initialized with 1024 bit key
Feb 28 10:12:52 pfSense openvpn[38994]: Control Channel Authentication: using '/var/etc/openvpn/server1.tls-auth' as a OpenVPN static key file
Feb 28 10:12:52 pfSense openvpn[38994]: Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Feb 28 10:12:52 pfSense openvpn[38994]: Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Feb 28 10:12:52 pfSense openvpn[38994]: Socket Buffers: R=[42080->65536] S=[57344->65536]
Feb 28 10:12:52 pfSense openvpn[38994]: ROUTE_GATEWAY x.x.x.1
Feb 28 10:12:52 pfSense openvpn[38994]: TUN/TAP device ovpns1 exists previously, keep at program end
Feb 28 10:12:52 pfSense openvpn[38994]: TUN/TAP device /dev/tun1 opened
Feb 28 10:12:52 pfSense openvpn[38994]: ioctl(TUNSIFMODE): Device busy: Device busy (errno=16)
Feb 28 10:12:52 pfSense openvpn[38994]: do_ifconfig, tt->ipv6=1, tt->did_ifconfig_ipv6_setup=0
Feb 28 10:12:52 pfSense openvpn[38994]: /sbin/ifconfig ovpns1 10.0.8.1 10.0.8.2 mtu 1500 netmask 255.255.255.255 up
Feb 28 10:12:52 pfSense openvpn[38994]: /usr/local/sbin/ovpn-linkup ovpns1 1500 1557 10.0.8.1 10.0.8.2 init
Feb 28 10:12:52 pfSense openvpn[38994]: /sbin/route add -net 10.0.8.0 10.0.8.2 255.255.255.0
Feb 28 10:12:52 pfSense openvpn[38994]: UDPv4 link local (bound): [AF_INET]x.x.x.168:1194
Feb 28 10:12:52 pfSense openvpn[38994]: UDPv4 link remote: [undef]
Feb 28 10:12:52 pfSense openvpn[38994]: MULTI: multi_init called, r=256 v=256
Feb 28 10:12:52 pfSense openvpn[38994]: IFCONFIG POOL: base=10.0.8.4 size=62, ipv6=0
Feb 28 10:12:52 pfSense openvpn[38994]: Initialization Sequence Completed
Feb 28 10:13:07 pfSense openvpn[38994]: event_wait : Interrupted system call (code=4)
Feb 28 10:13:07 pfSense openvpn[38994]: /sbin/route delete -net 10.0.8.0 10.0.8.2 255.255.255.0
Feb 28 10:13:07 pfSense openvpn[38994]: Closing TUN/TAP interface
Feb 28 10:13:07 pfSense openvpn[38994]: /usr/local/sbin/ovpn-linkdown ovpns1 1500 1557 10.0.8.1 10.0.8.2 init
Feb 28 10:13:07 pfSense openvpn[38994]: SIGTERM[hard,] received, process exiting
Feb 28 10:14:43 pfSense openvpn[90618]: OpenVPN 2.3.8 i386-portbld-freebsd10.1 [SSL (OpenSSL)] [LZO] [MH] [IPv6] built on Aug 21 2015
Feb 28 10:14:43 pfSense openvpn[90618]: library versions: OpenSSL 1.0.1l-freebsd 15 Jan 2015, LZO 2.09
Feb 28 10:14:43 pfSense openvpn[90828]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Feb 28 10:14:44 pfSense openvpn[90828]: Control Channel Authentication: using '/var/etc/openvpn/server1.tls-auth' as a OpenVPN static key file
Feb 28 10:14:44 pfSense openvpn[90828]: TUN/TAP device ovpns1 exists previously, keep at program end
Feb 28 10:14:44 pfSense openvpn[90828]: TUN/TAP device /dev/tun1 opened
Feb 28 10:14:44 pfSense openvpn[90828]: ioctl(TUNSIFMODE): Device busy: Device busy (errno=16)
Feb 28 10:14:44 pfSense openvpn[90828]: do_ifconfig, tt->ipv6=1, tt->did_ifconfig_ipv6_setup=0
Feb 28 10:14:44 pfSense openvpn[90828]: /sbin/ifconfig ovpns1 10.0.8.1 10.0.8.2 mtu 1500 netmask 255.255.255.255 up
Feb 28 10:14:44 pfSense openvpn[90828]: /usr/local/sbin/ovpn-linkup ovpns1 1500 1557 10.0.8.1 10.0.8.2 init
Feb 28 10:14:44 pfSense openvpn[90828]: UDPv4 link local (bound): [AF_INET]x.x.x.168:1194
Feb 28 10:14:44 pfSense openvpn[90828]: UDPv4 link remote: [undef]
Feb 28 10:14:44 pfSense openvpn[90828]: Initialization Sequence Completed
Feb 28 10:21:45 pfSense openvpn[90828]: event_wait : Interrupted system call (code=4)
Feb 28 10:21:45 pfSense openvpn[90828]: /usr/local/sbin/ovpn-linkdown ovpns1 1500 1557 10.0.8.1 10.0.8.2 init
Feb 28 10:21:45 pfSense openvpn[90828]: SIGTERM[hard,] received, process exiting
Feb 28 10:22:32 pfSense openvpn[20764]: OpenVPN 2.3.8 i386-portbld-freebsd10.1 [SSL (OpenSSL)] [LZO] [MH] [IPv6] built on Aug 21 2015
Feb 28 10:22:32 pfSense openvpn[20764]: library versions: OpenSSL 1.0.1l-freebsd 15 Jan 2015, LZO 2.09
Feb 28 10:22:32 pfSense openvpn[20839]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Feb 28 10:22:32 pfSense openvpn[20839]: Control Channel Authentication: using '/var/etc/openvpn/server1.tls-auth' as a OpenVPN static key file
Feb 28 10:22:32 pfSense openvpn[20839]: TUN/TAP device ovpns1 exists previously, keep at program end
Feb 28 10:22:32 pfSense openvpn[20839]: TUN/TAP device /dev/tun1 opened
Feb 28 10:22:32 pfSense openvpn[20839]: ioctl(TUNSIFMODE): Device busy: Device busy (errno=16)
Feb 28 10:22:32 pfSense openvpn[20839]: do_ifconfig, tt->ipv6=1, tt->did_ifconfig_ipv6_setup=0
Feb 28 10:22:32 pfSense openvpn[20839]: /sbin/ifconfig ovpns1 10.0.8.1 10.0.8.2 mtu 1500 netmask 255.255.255.255 up
Feb 28 10:22:32 pfSense openvpn[20839]: /usr/local/sbin/ovpn-linkup ovpns1 1500 1557 10.0.8.1 10.0.8.2 init
Feb 28 10:22:33 pfSense openvpn[20839]: UDPv4 link local (bound): [AF_INET]x.x.x.168:1194
Feb 28 10:22:33 pfSense openvpn[20839]: UDPv4 link remote: [undef]
Feb 28 10:22:33 pfSense openvpn[20839]: Initialization Sequence Completed
Feb 28 10:23:23 pfSense openvpn[20839]: event_wait : Interrupted system call (code=4)
Feb 28 10:23:23 pfSense openvpn[20839]: /usr/local/sbin/ovpn-linkdown ovpns1 1500 1557 10.0.8.1 10.0.8.2 init
Feb 28 10:23:23 pfSense openvpn[20839]: SIGTERM[hard,] received, process exiting

Client Config
Win7 64-bit
OpenVPN 2.3.10 I602
Firewall turned off

Client Config:

dev tun
persist-tun
persist-key
cipher AES-256-CBC
auth SHA1
tls-client
client
resolv-retry infinite
remote budghiss.mooo.net 1194 udp
lport 0
verify-x509-name "budghiss.moo.com" name
auth-user-pass
pkcs12 budghiss-udp-1194-user.p12
tls-auth budghiss-udp-1194-user-tls.key 1
ns-cert-type server

Client Config: General error, cannot reproduce while on same local 'Blue' network

TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
TLS Error: TLS handshake failed
TCP/UDP: Closing socket
SIGTERM[soft,tls-error] received, process exiting
MANAGEMENT: >STATE:1369146164,EXITING,tls-error,,

Notes:
Same error when connecting from Linux client
Dynamic DNS shows green on pfsense Box
Same failure with no-ip dynamic dns
Can ping Dynamic DNS address from remote connection
nmap shows the Dynamic DNS address 'Host Down'
Can authenticate & connect from 'Blue (local,separate)' network using ISP GATEWAY and setting for Host Name Resolution = Interface IP Address
On pfsense, the setting being used when trying to connect remotely for Host Name Resoution = DynDNS: budghiss.mooo.com
Same issue/error with IPCop distrobution: TLS Handshake Failure 60 sec. timeout
Same failure on TCP/443 instead of UDP/1194

Any help would be greatly appreciated.

Thanks

Traffic

According to your server log the server never sees the incoming client packets ..

Set --verb 4 in your client config then post the client log.

Pippin

Hello,

Also i think this

remote budghiss.mooo.net 1194 udp

and this

lport 0

have a conflict.

Try remove lport 0 ?

budghiss

Hi, thanks so much for the response!

As requested:

Thu Mar 03 20:19:15 2016 us=222845 Current Parameter Settings:
Thu Mar 03 20:19:15 2016 us=238445   config = 'budghiss-udp-1194-user.ovpn'
Thu Mar 03 20:19:15 2016 us=238445   mode = 0
Thu Mar 03 20:19:15 2016 us=238445   show_ciphers = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   show_digests = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   show_engines = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   genkey = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   key_pass_file = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   show_tls_ciphers = DISABLED
Thu Mar 03 20:19:15 2016 us=238445 Connection profiles [default]:
Thu Mar 03 20:19:15 2016 us=238445   proto = udp
Thu Mar 03 20:19:15 2016 us=238445   local = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   local_port = 0
Thu Mar 03 20:19:15 2016 us=238445   remote = 'budghiss.mooo.com'
Thu Mar 03 20:19:15 2016 us=238445   remote_port = 1194
Thu Mar 03 20:19:15 2016 us=238445   remote_float = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   bind_defined = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   bind_local = ENABLED
Thu Mar 03 20:19:15 2016 us=238445   connect_retry_seconds = 5
Thu Mar 03 20:19:15 2016 us=238445   connect_timeout = 10
Thu Mar 03 20:19:15 2016 us=238445   connect_retry_max = 0
Thu Mar 03 20:19:15 2016 us=238445   socks_proxy_server = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   socks_proxy_port = 0
Thu Mar 03 20:19:15 2016 us=238445   socks_proxy_retry = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   tun_mtu = 1500
Thu Mar 03 20:19:15 2016 us=238445   tun_mtu_defined = ENABLED
Thu Mar 03 20:19:15 2016 us=238445   link_mtu = 1500
Thu Mar 03 20:19:15 2016 us=238445   link_mtu_defined = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   tun_mtu_extra = 0
Thu Mar 03 20:19:15 2016 us=238445   tun_mtu_extra_defined = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   mtu_discover_type = -1
Thu Mar 03 20:19:15 2016 us=238445   fragment = 0
Thu Mar 03 20:19:15 2016 us=238445   mssfix = 1450
Thu Mar 03 20:19:15 2016 us=238445   explicit_exit_notification = 0
Thu Mar 03 20:19:15 2016 us=238445 Connection profiles END
Thu Mar 03 20:19:15 2016 us=238445   remote_random = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   ipchange = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   dev = 'tun'
Thu Mar 03 20:19:15 2016 us=238445   dev_type = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   dev_node = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   lladdr = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   topology = 1
Thu Mar 03 20:19:15 2016 us=238445   tun_ipv6 = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   ifconfig_local = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   ifconfig_remote_netmask = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   ifconfig_noexec = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   ifconfig_nowarn = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   ifconfig_ipv6_local = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   ifconfig_ipv6_netbits = 0
Thu Mar 03 20:19:15 2016 us=238445   ifconfig_ipv6_remote = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   shaper = 0
Thu Mar 03 20:19:15 2016 us=238445   mtu_test = 0
Thu Mar 03 20:19:15 2016 us=238445   mlock = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   keepalive_ping = 0
Thu Mar 03 20:19:15 2016 us=238445   keepalive_timeout = 0
Thu Mar 03 20:19:15 2016 us=238445   inactivity_timeout = 0
Thu Mar 03 20:19:15 2016 us=238445   ping_send_timeout = 0
Thu Mar 03 20:19:15 2016 us=238445   ping_rec_timeout = 0
Thu Mar 03 20:19:15 2016 us=238445   ping_rec_timeout_action = 0
Thu Mar 03 20:19:15 2016 us=238445   ping_timer_remote = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   remap_sigusr1 = 0
Thu Mar 03 20:19:15 2016 us=238445   persist_tun = ENABLED
Thu Mar 03 20:19:15 2016 us=238445   persist_local_ip = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   persist_remote_ip = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   persist_key = ENABLED
Thu Mar 03 20:19:15 2016 us=238445   passtos = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   resolve_retry_seconds = 1000000000
Thu Mar 03 20:19:15 2016 us=238445   username = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   groupname = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   chroot_dir = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   cd_dir = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   writepid = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   up_script = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   down_script = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   down_pre = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   up_restart = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   up_delay = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   daemon = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   inetd = 0
Thu Mar 03 20:19:15 2016 us=238445   log = ENABLED
Thu Mar 03 20:19:15 2016 us=238445   suppress_timestamps = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   nice = 0
Thu Mar 03 20:19:15 2016 us=238445   verbosity = 4
Thu Mar 03 20:19:15 2016 us=238445   mute = 0
Thu Mar 03 20:19:15 2016 us=238445   gremlin = 0
Thu Mar 03 20:19:15 2016 us=238445   status_file = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   status_file_version = 1
Thu Mar 03 20:19:15 2016 us=238445   status_file_update_freq = 60
Thu Mar 03 20:19:15 2016 us=238445   occ = ENABLED
Thu Mar 03 20:19:15 2016 us=238445   rcvbuf = 0
Thu Mar 03 20:19:15 2016 us=238445   sndbuf = 0
Thu Mar 03 20:19:15 2016 us=238445   sockflags = 0
Thu Mar 03 20:19:15 2016 us=238445   fast_io = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   lzo = 0
Thu Mar 03 20:19:15 2016 us=238445   route_script = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   route_default_gateway = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   route_default_metric = 0
Thu Mar 03 20:19:15 2016 us=238445   route_noexec = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   route_delay = 5
Thu Mar 03 20:19:15 2016 us=238445   route_delay_window = 30
Thu Mar 03 20:19:15 2016 us=238445   route_delay_defined = ENABLED
Thu Mar 03 20:19:15 2016 us=238445   route_nopull = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   route_gateway_via_dhcp = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   max_routes = 100
Thu Mar 03 20:19:15 2016 us=238445   allow_pull_fqdn = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   management_addr = '127.0.0.1'
Thu Mar 03 20:19:15 2016 us=238445   management_port = 25340
Thu Mar 03 20:19:15 2016 us=238445   management_user_pass = 'stdin'
Thu Mar 03 20:19:15 2016 us=238445   management_log_history_cache = 250
Thu Mar 03 20:19:15 2016 us=238445   management_echo_buffer_size = 100
Thu Mar 03 20:19:15 2016 us=238445   management_write_peer_info_file = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   management_client_user = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   management_client_group = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   management_flags = 6
Thu Mar 03 20:19:15 2016 us=238445   shared_secret_file = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   key_direction = 2
Thu Mar 03 20:19:15 2016 us=238445   ciphername_defined = ENABLED
Thu Mar 03 20:19:15 2016 us=238445   ciphername = 'AES-256-CBC'
Thu Mar 03 20:19:15 2016 us=238445   authname_defined = ENABLED
Thu Mar 03 20:19:15 2016 us=238445   authname = 'SHA1'
Thu Mar 03 20:19:15 2016 us=238445   prng_hash = 'SHA1'
Thu Mar 03 20:19:15 2016 us=238445   prng_nonce_secret_len = 16
Thu Mar 03 20:19:15 2016 us=238445   keysize = 0
Thu Mar 03 20:19:15 2016 us=238445   engine = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   replay = ENABLED
Thu Mar 03 20:19:15 2016 us=238445   mute_replay_warnings = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   replay_window = 64
Thu Mar 03 20:19:15 2016 us=238445   replay_time = 15
Thu Mar 03 20:19:15 2016 us=238445   packet_id_file = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   use_iv = ENABLED
Thu Mar 03 20:19:15 2016 us=238445   test_crypto = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   tls_server = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   tls_client = ENABLED
Thu Mar 03 20:19:15 2016 us=238445   key_method = 2
Thu Mar 03 20:19:15 2016 us=238445   ca_file = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   ca_path = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   dh_file = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   cert_file = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   extra_certs_file = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   priv_key_file = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   pkcs12_file = 'budghiss-udp-1194-user.p12'
Thu Mar 03 20:19:15 2016 us=238445   cryptoapi_cert = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   cipher_list = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   tls_verify = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   tls_export_cert = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   verify_x509_type = 2
Thu Mar 03 20:19:15 2016 us=238445   verify_x509_name = 'budghiss.moo.com'
Thu Mar 03 20:19:15 2016 us=238445   crl_file = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   ns_cert_type = 1
Thu Mar 03 20:19:15 2016 us=238445   remote_cert_ku[i] = 0
Thu Mar 03 20:19:15 2016 us=238445   remote_cert_ku[i] = 0
Thu Mar 03 20:19:15 2016 us=238445   remote_cert_ku[i] = 0
Thu Mar 03 20:19:15 2016 us=238445   remote_cert_ku[i] = 0
Thu Mar 03 20:19:15 2016 us=238445   remote_cert_ku[i] = 0
Thu Mar 03 20:19:15 2016 us=238445   remote_cert_ku[i] = 0
Thu Mar 03 20:19:15 2016 us=238445   remote_cert_ku[i] = 0
Thu Mar 03 20:19:15 2016 us=238445   remote_cert_ku[i] = 0
Thu Mar 03 20:19:15 2016 us=238445   remote_cert_ku[i] = 0
Thu Mar 03 20:19:15 2016 us=238445   remote_cert_ku[i] = 0
Thu Mar 03 20:19:15 2016 us=238445   remote_cert_ku[i] = 0
Thu Mar 03 20:19:15 2016 us=238445   remote_cert_ku[i] = 0
Thu Mar 03 20:19:15 2016 us=238445   remote_cert_ku[i] = 0
Thu Mar 03 20:19:15 2016 us=238445   remote_cert_ku[i] = 0
Thu Mar 03 20:19:15 2016 us=238445   remote_cert_ku[i] = 0
Thu Mar 03 20:19:15 2016 us=238445   remote_cert_ku[i] = 0
Thu Mar 03 20:19:15 2016 us=238445   remote_cert_eku = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   ssl_flags = 0
Thu Mar 03 20:19:15 2016 us=238445   tls_timeout = 2
Thu Mar 03 20:19:15 2016 us=238445   renegotiate_bytes = 0
Thu Mar 03 20:19:15 2016 us=238445   renegotiate_packets = 0
Thu Mar 03 20:19:15 2016 us=238445   renegotiate_seconds = 3600
Thu Mar 03 20:19:15 2016 us=238445   handshake_window = 60
Thu Mar 03 20:19:15 2016 us=238445   transition_window = 3600
Thu Mar 03 20:19:15 2016 us=238445   single_session = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   push_peer_info = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   tls_exit = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   tls_auth_file = 'budghiss-udp-1194-user-tls.key'
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_protected_authentication = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_protected_authentication = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_protected_authentication = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_protected_authentication = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_protected_authentication = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_protected_authentication = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_protected_authentication = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_protected_authentication = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_protected_authentication = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_protected_authentication = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_protected_authentication = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_protected_authentication = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_protected_authentication = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_protected_authentication = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_protected_authentication = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_protected_authentication = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_private_mode = 00000000
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_private_mode = 00000000
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_private_mode = 00000000
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_private_mode = 00000000
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_private_mode = 00000000
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_private_mode = 00000000
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_private_mode = 00000000
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_private_mode = 00000000
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_private_mode = 00000000
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_private_mode = 00000000
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_private_mode = 00000000
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_private_mode = 00000000
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_private_mode = 00000000
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_private_mode = 00000000
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_private_mode = 00000000
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_private_mode = 00000000
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_cert_private = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_cert_private = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_cert_private = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_cert_private = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_cert_private = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_cert_private = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_cert_private = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_cert_private = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_cert_private = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_cert_private = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_cert_private = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_cert_private = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_cert_private = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_cert_private = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_cert_private = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_cert_private = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_pin_cache_period = -1
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_id = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   pkcs11_id_management = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   server_network = 0.0.0.0
Thu Mar 03 20:19:15 2016 us=238445   server_netmask = 0.0.0.0
Thu Mar 03 20:19:15 2016 us=238445   server_network_ipv6 = ::
Thu Mar 03 20:19:15 2016 us=238445   server_netbits_ipv6 = 0
Thu Mar 03 20:19:15 2016 us=238445   server_bridge_ip = 0.0.0.0
Thu Mar 03 20:19:15 2016 us=238445   server_bridge_netmask = 0.0.0.0
Thu Mar 03 20:19:15 2016 us=238445   server_bridge_pool_start = 0.0.0.0
Thu Mar 03 20:19:15 2016 us=238445   server_bridge_pool_end = 0.0.0.0
Thu Mar 03 20:19:15 2016 us=238445   ifconfig_pool_defined = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   ifconfig_pool_start = 0.0.0.0
Thu Mar 03 20:19:15 2016 us=238445   ifconfig_pool_end = 0.0.0.0
Thu Mar 03 20:19:15 2016 us=238445   ifconfig_pool_netmask = 0.0.0.0
Thu Mar 03 20:19:15 2016 us=238445   ifconfig_pool_persist_filename = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   ifconfig_pool_persist_refresh_freq = 600
Thu Mar 03 20:19:15 2016 us=238445   ifconfig_ipv6_pool_defined = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   ifconfig_ipv6_pool_base = ::
Thu Mar 03 20:19:15 2016 us=238445   ifconfig_ipv6_pool_netbits = 0
Thu Mar 03 20:19:15 2016 us=238445   n_bcast_buf = 256
Thu Mar 03 20:19:15 2016 us=238445   tcp_queue_limit = 64
Thu Mar 03 20:19:15 2016 us=238445   real_hash_size = 256
Thu Mar 03 20:19:15 2016 us=238445   virtual_hash_size = 256
Thu Mar 03 20:19:15 2016 us=238445   client_connect_script = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   learn_address_script = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   client_disconnect_script = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   client_config_dir = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   ccd_exclusive = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   tmp_dir = 'C:\TEMP\'
Thu Mar 03 20:19:15 2016 us=238445   push_ifconfig_defined = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   push_ifconfig_local = 0.0.0.0
Thu Mar 03 20:19:15 2016 us=238445   push_ifconfig_remote_netmask = 0.0.0.0
Thu Mar 03 20:19:15 2016 us=238445   push_ifconfig_ipv6_defined = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   push_ifconfig_ipv6_local = ::/0
Thu Mar 03 20:19:15 2016 us=238445   push_ifconfig_ipv6_remote = ::
Thu Mar 03 20:19:15 2016 us=238445   enable_c2c = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   duplicate_cn = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   cf_max = 0
Thu Mar 03 20:19:15 2016 us=238445   cf_per = 0
Thu Mar 03 20:19:15 2016 us=238445   max_clients = 1024
Thu Mar 03 20:19:15 2016 us=238445   max_routes_per_client = 256
Thu Mar 03 20:19:15 2016 us=238445   auth_user_pass_verify_script = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   auth_user_pass_verify_script_via_file = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   client = ENABLED
Thu Mar 03 20:19:15 2016 us=238445   pull = ENABLED
Thu Mar 03 20:19:15 2016 us=238445   auth_user_pass_file = 'stdin'
Thu Mar 03 20:19:15 2016 us=238445   show_net_up = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   route_method = 0
Thu Mar 03 20:19:15 2016 us=238445   block_outside_dns = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   ip_win32_defined = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   ip_win32_type = 3
Thu Mar 03 20:19:15 2016 us=238445   dhcp_masq_offset = 0
Thu Mar 03 20:19:15 2016 us=238445   dhcp_lease_time = 31536000
Thu Mar 03 20:19:15 2016 us=238445   tap_sleep = 0
Thu Mar 03 20:19:15 2016 us=238445   dhcp_options = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   dhcp_renew = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   dhcp_pre_release = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   dhcp_release = DISABLED
Thu Mar 03 20:19:15 2016 us=238445   domain = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   netbios_scope = '[UNDEF]'
Thu Mar 03 20:19:15 2016 us=238445   netbios_node_type = 0
Thu Mar 03 20:19:15 2016 us=238445   disable_nbt = DISABLED
Thu Mar 03 20:19:15 2016 us=238445 OpenVPN 2.3.10 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Feb  1 2016
Thu Mar 03 20:19:15 2016 us=238445 Windows version 6.1 (Windows 7)
Thu Mar 03 20:19:15 2016 us=238445 library versions: OpenSSL 1.0.1r  28 Jan 2016, LZO 2.09
Enter Management Password:
Thu Mar 03 20:19:15 2016 us=238445 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Thu Mar 03 20:19:15 2016 us=238445 Need hold release from management interface, waiting...
Thu Mar 03 20:19:15 2016 us=706446 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Thu Mar 03 20:19:15 2016 us=815646 MANAGEMENT: CMD 'state on'
Thu Mar 03 20:19:15 2016 us=815646 MANAGEMENT: CMD 'log all on'
Thu Mar 03 20:19:16 2016 us=2846 MANAGEMENT: CMD 'hold off'
Thu Mar 03 20:19:16 2016 us=18446 MANAGEMENT: CMD 'hold release'
Thu Mar 03 20:19:24 2016 us=21260 MANAGEMENT: CMD 'username "Auth" "xxxx"'
Thu Mar 03 20:19:24 2016 us=36860 MANAGEMENT: CMD 'password [...]'
Thu Mar 03 20:19:29 2016 us=590470 MANAGEMENT: CMD 'password [...]'
Thu Mar 03 20:19:29 2016 us=590470 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Thu Mar 03 20:19:29 2016 us=606070 Control Channel Authentication: using 'budghiss-udp-1194-user-tls.key' as a OpenVPN static key file
Thu Mar 03 20:19:29 2016 us=606070 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Mar 03 20:19:29 2016 us=606070 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Mar 03 20:19:29 2016 us=606070 Control Channel MTU parms [ L:1557 D:1184 EF:66 EB:0 ET:0 EL:3 ]
Thu Mar 03 20:19:29 2016 us=606070 Socket Buffers: R=[8192->8192] S=[8192->8192]
Thu Mar 03 20:19:29 2016 us=606070 MANAGEMENT: >STATE:1457054369,RESOLVE,,,
Thu Mar 03 20:19:29 2016 us=621670 Data Channel MTU parms [ L:1557 D:1450 EF:57 EB:12 ET:0 EL:3 ]
Thu Mar 03 20:19:29 2016 us=621670 Local Options String: 'V4,dev-type tun,link-mtu 1557,tun-mtu 1500,proto UDPv4,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
Thu Mar 03 20:19:29 2016 us=621670 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1557,tun-mtu 1500,proto UDPv4,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
Thu Mar 03 20:19:29 2016 us=621670 Local Options hash (VER=V4): 'ed844052'
Thu Mar 03 20:19:29 2016 us=621670 Expected Remote Options hash (VER=V4): '8a244582'
Thu Mar 03 20:19:29 2016 us=621670 UDPv4 link local (bound): [undef]
Thu Mar 03 20:19:29 2016 us=621670 UDPv4 link remote: [AF_INET]74.215.155.56:1194
Thu Mar 03 20:19:29 2016 us=621670 MANAGEMENT: >STATE:1457054369,WAIT,,,

Thanks again,

Bud

Pippin

Client

budghiss.mooo.net

resolves too

74.215.155.56:1194

Correct?

Server

UDPv4 link local (bound): [AF_INET]x.x.x.168:1194

Firewall is ok?

budghiss

Hi there,

Yes, budghiss.mooo.com resolves to 74.215.155.56.
The x.x.x.168 is the dynamic IP assigned from my ISP.

I have the DNS on the OpenVPN server set as:
ISP Gateway
pfsense Gateway
8.8.8.8
8.8.4.4

pfsense inserts 2 firewall rules when the server is deployed through the wizard.
1) WAN rule
2) OpenVPN rule
From what I gather, these are correct.

I will be at the server tonight (EST) if you would like to see any changes or logs.

Thanks so much for the input,

Bud

Traffic

Pippin wroteand this
Quote:
lport 0

You should replace this with:

nobind

in your client config.

Does pfsense support Dynamic DNS client ?

budghiss wroteServer Config:
Code:
local budghiss.mooo.com

I think you will have to restart openvpn every time your ISP changes your IP.

Or put a firewall/router between pfsense and internet.

budghiss

Hi,

Thanks for helping me sort this out.

Pfsense does support dynamic DNS client - there is a server that runs that updates accordingly. If fact, the status of green, which mine is, confirms the firewall is resolving.

But on that note, I am not very well-versed in the DNS subject. Could I have the wrong settings for the DNS servers, both on the firewall and on the VPN server? I can get you the details tomorrow (I probably won't be at the server tonight). I was under the impression, in this order, that I wanted my ISP gateway, my WAN gateway, and the google. But again, this in not in my wheelhouse.

Also, I adjusted the config file to

 nobind

on the client, and am getting the same results.

Another note - Even though it does not mean much, I can make a connection from the internal segmented network (172.x.x.1 --> VPN server --> 192.x.x.1), so this authentication error is not a certificate problem. I think it is more of what you alluded to initially; the packets aren't making it to the server.

Lastly, here is the client log with the

 nobind

setting.

Fri Mar 04 17:25:31 2016 us=881239 Current Parameter Settings:
Fri Mar 04 17:25:31 2016 us=896839   config = 'budghiss-udp-1194-user.ovpn'
Fri Mar 04 17:25:31 2016 us=896839   mode = 0
Fri Mar 04 17:25:31 2016 us=896839   show_ciphers = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   show_digests = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   show_engines = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   genkey = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   key_pass_file = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   show_tls_ciphers = DISABLED
Fri Mar 04 17:25:31 2016 us=896839 Connection profiles [default]:
Fri Mar 04 17:25:31 2016 us=896839   proto = udp
Fri Mar 04 17:25:31 2016 us=896839   local = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   local_port = 0
Fri Mar 04 17:25:31 2016 us=896839   remote = 'budghiss.mooo.com'
Fri Mar 04 17:25:31 2016 us=896839   remote_port = 1194
Fri Mar 04 17:25:31 2016 us=896839   remote_float = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   bind_defined = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   bind_local = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   connect_retry_seconds = 5
Fri Mar 04 17:25:31 2016 us=896839   connect_timeout = 10
Fri Mar 04 17:25:31 2016 us=896839   connect_retry_max = 0
Fri Mar 04 17:25:31 2016 us=896839   socks_proxy_server = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   socks_proxy_port = 0
Fri Mar 04 17:25:31 2016 us=896839   socks_proxy_retry = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   tun_mtu = 1500
Fri Mar 04 17:25:31 2016 us=896839   tun_mtu_defined = ENABLED
Fri Mar 04 17:25:31 2016 us=896839   link_mtu = 1500
Fri Mar 04 17:25:31 2016 us=896839   link_mtu_defined = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   tun_mtu_extra = 0
Fri Mar 04 17:25:31 2016 us=896839   tun_mtu_extra_defined = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   mtu_discover_type = -1
Fri Mar 04 17:25:31 2016 us=896839   fragment = 0
Fri Mar 04 17:25:31 2016 us=896839   mssfix = 1450
Fri Mar 04 17:25:31 2016 us=896839   explicit_exit_notification = 0
Fri Mar 04 17:25:31 2016 us=896839 Connection profiles END
Fri Mar 04 17:25:31 2016 us=896839   remote_random = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   ipchange = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   dev = 'tun'
Fri Mar 04 17:25:31 2016 us=896839   dev_type = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   dev_node = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   lladdr = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   topology = 1
Fri Mar 04 17:25:31 2016 us=896839   tun_ipv6 = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   ifconfig_local = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   ifconfig_remote_netmask = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   ifconfig_noexec = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   ifconfig_nowarn = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   ifconfig_ipv6_local = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   ifconfig_ipv6_netbits = 0
Fri Mar 04 17:25:31 2016 us=896839   ifconfig_ipv6_remote = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   shaper = 0
Fri Mar 04 17:25:31 2016 us=896839   mtu_test = 0
Fri Mar 04 17:25:31 2016 us=896839   mlock = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   keepalive_ping = 0
Fri Mar 04 17:25:31 2016 us=896839   keepalive_timeout = 0
Fri Mar 04 17:25:31 2016 us=896839   inactivity_timeout = 0
Fri Mar 04 17:25:31 2016 us=896839   ping_send_timeout = 0
Fri Mar 04 17:25:31 2016 us=896839   ping_rec_timeout = 0
Fri Mar 04 17:25:31 2016 us=896839   ping_rec_timeout_action = 0
Fri Mar 04 17:25:31 2016 us=896839   ping_timer_remote = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   remap_sigusr1 = 0
Fri Mar 04 17:25:31 2016 us=896839   persist_tun = ENABLED
Fri Mar 04 17:25:31 2016 us=896839   persist_local_ip = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   persist_remote_ip = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   persist_key = ENABLED
Fri Mar 04 17:25:31 2016 us=896839   passtos = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   resolve_retry_seconds = 1000000000
Fri Mar 04 17:25:31 2016 us=896839   username = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   groupname = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   chroot_dir = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   cd_dir = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   writepid = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   up_script = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   down_script = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   down_pre = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   up_restart = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   up_delay = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   daemon = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   inetd = 0
Fri Mar 04 17:25:31 2016 us=896839   log = ENABLED
Fri Mar 04 17:25:31 2016 us=896839   suppress_timestamps = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   nice = 0
Fri Mar 04 17:25:31 2016 us=896839   verbosity = 4
Fri Mar 04 17:25:31 2016 us=896839   mute = 0
Fri Mar 04 17:25:31 2016 us=896839   gremlin = 0
Fri Mar 04 17:25:31 2016 us=896839   status_file = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   status_file_version = 1
Fri Mar 04 17:25:31 2016 us=896839   status_file_update_freq = 60
Fri Mar 04 17:25:31 2016 us=896839   occ = ENABLED
Fri Mar 04 17:25:31 2016 us=896839   rcvbuf = 0
Fri Mar 04 17:25:31 2016 us=896839   sndbuf = 0
Fri Mar 04 17:25:31 2016 us=896839   sockflags = 0
Fri Mar 04 17:25:31 2016 us=896839   fast_io = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   lzo = 0
Fri Mar 04 17:25:31 2016 us=896839   route_script = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   route_default_gateway = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   route_default_metric = 0
Fri Mar 04 17:25:31 2016 us=896839   route_noexec = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   route_delay = 5
Fri Mar 04 17:25:31 2016 us=896839   route_delay_window = 30
Fri Mar 04 17:25:31 2016 us=896839   route_delay_defined = ENABLED
Fri Mar 04 17:25:31 2016 us=896839   route_nopull = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   route_gateway_via_dhcp = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   max_routes = 100
Fri Mar 04 17:25:31 2016 us=896839   allow_pull_fqdn = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   management_addr = '127.0.0.1'
Fri Mar 04 17:25:31 2016 us=896839   management_port = 25340
Fri Mar 04 17:25:31 2016 us=896839   management_user_pass = 'stdin'
Fri Mar 04 17:25:31 2016 us=896839   management_log_history_cache = 250
Fri Mar 04 17:25:31 2016 us=896839   management_echo_buffer_size = 100
Fri Mar 04 17:25:31 2016 us=896839   management_write_peer_info_file = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   management_client_user = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   management_client_group = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   management_flags = 6
Fri Mar 04 17:25:31 2016 us=896839   shared_secret_file = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   key_direction = 2
Fri Mar 04 17:25:31 2016 us=896839   ciphername_defined = ENABLED
Fri Mar 04 17:25:31 2016 us=896839   ciphername = 'AES-256-CBC'
Fri Mar 04 17:25:31 2016 us=896839   authname_defined = ENABLED
Fri Mar 04 17:25:31 2016 us=896839   authname = 'SHA1'
Fri Mar 04 17:25:31 2016 us=896839   prng_hash = 'SHA1'
Fri Mar 04 17:25:31 2016 us=896839   prng_nonce_secret_len = 16
Fri Mar 04 17:25:31 2016 us=896839   keysize = 0
Fri Mar 04 17:25:31 2016 us=896839   engine = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   replay = ENABLED
Fri Mar 04 17:25:31 2016 us=896839   mute_replay_warnings = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   replay_window = 64
Fri Mar 04 17:25:31 2016 us=896839   replay_time = 15
Fri Mar 04 17:25:31 2016 us=896839   packet_id_file = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   use_iv = ENABLED
Fri Mar 04 17:25:31 2016 us=896839   test_crypto = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   tls_server = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   tls_client = ENABLED
Fri Mar 04 17:25:31 2016 us=896839   key_method = 2
Fri Mar 04 17:25:31 2016 us=896839   ca_file = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   ca_path = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   dh_file = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   cert_file = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   extra_certs_file = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   priv_key_file = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   pkcs12_file = 'budghiss-udp-1194-user.p12'
Fri Mar 04 17:25:31 2016 us=896839   cryptoapi_cert = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   cipher_list = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   tls_verify = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   tls_export_cert = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   verify_x509_type = 2
Fri Mar 04 17:25:31 2016 us=896839   verify_x509_name = 'budghiss.moo.com'
Fri Mar 04 17:25:31 2016 us=896839   crl_file = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   ns_cert_type = 1
Fri Mar 04 17:25:31 2016 us=896839   remote_cert_ku[i] = 0
Fri Mar 04 17:25:31 2016 us=896839   remote_cert_ku[i] = 0
Fri Mar 04 17:25:31 2016 us=896839   remote_cert_ku[i] = 0
Fri Mar 04 17:25:31 2016 us=896839   remote_cert_ku[i] = 0
Fri Mar 04 17:25:31 2016 us=896839   remote_cert_ku[i] = 0
Fri Mar 04 17:25:31 2016 us=896839   remote_cert_ku[i] = 0
Fri Mar 04 17:25:31 2016 us=896839   remote_cert_ku[i] = 0
Fri Mar 04 17:25:31 2016 us=896839   remote_cert_ku[i] = 0
Fri Mar 04 17:25:31 2016 us=896839   remote_cert_ku[i] = 0
Fri Mar 04 17:25:31 2016 us=896839   remote_cert_ku[i] = 0
Fri Mar 04 17:25:31 2016 us=896839   remote_cert_ku[i] = 0
Fri Mar 04 17:25:31 2016 us=896839   remote_cert_ku[i] = 0
Fri Mar 04 17:25:31 2016 us=896839   remote_cert_ku[i] = 0
Fri Mar 04 17:25:31 2016 us=896839   remote_cert_ku[i] = 0
Fri Mar 04 17:25:31 2016 us=896839   remote_cert_ku[i] = 0
Fri Mar 04 17:25:31 2016 us=896839   remote_cert_ku[i] = 0
Fri Mar 04 17:25:31 2016 us=896839   remote_cert_eku = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   ssl_flags = 0
Fri Mar 04 17:25:31 2016 us=896839   tls_timeout = 2
Fri Mar 04 17:25:31 2016 us=896839   renegotiate_bytes = 0
Fri Mar 04 17:25:31 2016 us=896839   renegotiate_packets = 0
Fri Mar 04 17:25:31 2016 us=896839   renegotiate_seconds = 3600
Fri Mar 04 17:25:31 2016 us=896839   handshake_window = 60
Fri Mar 04 17:25:31 2016 us=896839   transition_window = 3600
Fri Mar 04 17:25:31 2016 us=896839   single_session = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   push_peer_info = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   tls_exit = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   tls_auth_file = 'budghiss-udp-1194-user-tls.key'
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_protected_authentication = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_protected_authentication = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_protected_authentication = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_protected_authentication = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_protected_authentication = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_protected_authentication = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_protected_authentication = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_protected_authentication = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_protected_authentication = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_protected_authentication = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_protected_authentication = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_protected_authentication = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_protected_authentication = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_protected_authentication = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_protected_authentication = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_protected_authentication = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_private_mode = 00000000
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_private_mode = 00000000
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_private_mode = 00000000
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_private_mode = 00000000
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_private_mode = 00000000
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_private_mode = 00000000
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_private_mode = 00000000
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_private_mode = 00000000
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_private_mode = 00000000
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_private_mode = 00000000
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_private_mode = 00000000
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_private_mode = 00000000
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_private_mode = 00000000
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_private_mode = 00000000
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_private_mode = 00000000
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_private_mode = 00000000
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_cert_private = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_cert_private = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_cert_private = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_cert_private = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_cert_private = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_cert_private = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_cert_private = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_cert_private = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_cert_private = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_cert_private = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_cert_private = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_cert_private = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_cert_private = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_cert_private = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_cert_private = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_cert_private = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_pin_cache_period = -1
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_id = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   pkcs11_id_management = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   server_network = 0.0.0.0
Fri Mar 04 17:25:31 2016 us=896839   server_netmask = 0.0.0.0
Fri Mar 04 17:25:31 2016 us=896839   server_network_ipv6 = ::
Fri Mar 04 17:25:31 2016 us=896839   server_netbits_ipv6 = 0
Fri Mar 04 17:25:31 2016 us=896839   server_bridge_ip = 0.0.0.0
Fri Mar 04 17:25:31 2016 us=896839   server_bridge_netmask = 0.0.0.0
Fri Mar 04 17:25:31 2016 us=896839   server_bridge_pool_start = 0.0.0.0
Fri Mar 04 17:25:31 2016 us=896839   server_bridge_pool_end = 0.0.0.0
Fri Mar 04 17:25:31 2016 us=896839   ifconfig_pool_defined = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   ifconfig_pool_start = 0.0.0.0
Fri Mar 04 17:25:31 2016 us=896839   ifconfig_pool_end = 0.0.0.0
Fri Mar 04 17:25:31 2016 us=896839   ifconfig_pool_netmask = 0.0.0.0
Fri Mar 04 17:25:31 2016 us=896839   ifconfig_pool_persist_filename = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   ifconfig_pool_persist_refresh_freq = 600
Fri Mar 04 17:25:31 2016 us=896839   ifconfig_ipv6_pool_defined = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   ifconfig_ipv6_pool_base = ::
Fri Mar 04 17:25:31 2016 us=896839   ifconfig_ipv6_pool_netbits = 0
Fri Mar 04 17:25:31 2016 us=896839   n_bcast_buf = 256
Fri Mar 04 17:25:31 2016 us=896839   tcp_queue_limit = 64
Fri Mar 04 17:25:31 2016 us=896839   real_hash_size = 256
Fri Mar 04 17:25:31 2016 us=896839   virtual_hash_size = 256
Fri Mar 04 17:25:31 2016 us=896839   client_connect_script = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   learn_address_script = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   client_disconnect_script = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   client_config_dir = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   ccd_exclusive = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   tmp_dir = 'C:\TEMP\'
Fri Mar 04 17:25:31 2016 us=896839   push_ifconfig_defined = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   push_ifconfig_local = 0.0.0.0
Fri Mar 04 17:25:31 2016 us=896839   push_ifconfig_remote_netmask = 0.0.0.0
Fri Mar 04 17:25:31 2016 us=896839   push_ifconfig_ipv6_defined = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   push_ifconfig_ipv6_local = ::/0
Fri Mar 04 17:25:31 2016 us=896839   push_ifconfig_ipv6_remote = ::
Fri Mar 04 17:25:31 2016 us=896839   enable_c2c = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   duplicate_cn = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   cf_max = 0
Fri Mar 04 17:25:31 2016 us=896839   cf_per = 0
Fri Mar 04 17:25:31 2016 us=896839   max_clients = 1024
Fri Mar 04 17:25:31 2016 us=896839   max_routes_per_client = 256
Fri Mar 04 17:25:31 2016 us=896839   auth_user_pass_verify_script = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   auth_user_pass_verify_script_via_file = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   client = ENABLED
Fri Mar 04 17:25:31 2016 us=896839   pull = ENABLED
Fri Mar 04 17:25:31 2016 us=896839   auth_user_pass_file = 'stdin'
Fri Mar 04 17:25:31 2016 us=896839   show_net_up = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   route_method = 0
Fri Mar 04 17:25:31 2016 us=896839   block_outside_dns = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   ip_win32_defined = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   ip_win32_type = 3
Fri Mar 04 17:25:31 2016 us=896839   dhcp_masq_offset = 0
Fri Mar 04 17:25:31 2016 us=896839   dhcp_lease_time = 31536000
Fri Mar 04 17:25:31 2016 us=896839   tap_sleep = 0
Fri Mar 04 17:25:31 2016 us=896839   dhcp_options = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   dhcp_renew = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   dhcp_pre_release = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   dhcp_release = DISABLED
Fri Mar 04 17:25:31 2016 us=896839   domain = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   netbios_scope = '[UNDEF]'
Fri Mar 04 17:25:31 2016 us=896839   netbios_node_type = 0
Fri Mar 04 17:25:31 2016 us=896839   disable_nbt = DISABLED
Fri Mar 04 17:25:31 2016 us=896839 OpenVPN 2.3.10 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Feb  1 2016
Fri Mar 04 17:25:31 2016 us=896839 Windows version 6.1 (Windows 7)
Fri Mar 04 17:25:31 2016 us=896839 library versions: OpenSSL 1.0.1r  28 Jan 2016, LZO 2.09
Enter Management Password:
Fri Mar 04 17:25:31 2016 us=896839 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Fri Mar 04 17:25:31 2016 us=896839 Need hold release from management interface, waiting...
Fri Mar 04 17:25:32 2016 us=271240 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Fri Mar 04 17:25:32 2016 us=380440 MANAGEMENT: CMD 'state on'
Fri Mar 04 17:25:32 2016 us=380440 MANAGEMENT: CMD 'log all on'
Fri Mar 04 17:25:32 2016 us=567640 MANAGEMENT: CMD 'hold off'
Fri Mar 04 17:25:32 2016 us=583240 MANAGEMENT: CMD 'hold release'
Fri Mar 04 17:25:39 2016 us=197652 MANAGEMENT: CMD 'username "Auth" "user"'
Fri Mar 04 17:25:39 2016 us=197652 MANAGEMENT: CMD 'password [...]'
Fri Mar 04 17:25:46 2016 us=638865 MANAGEMENT: CMD 'password [...]'
Fri Mar 04 17:25:46 2016 us=638865 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Fri Mar 04 17:25:46 2016 us=654465 Control Channel Authentication: using 'budghiss-udp-1194-user-tls.key' as a OpenVPN static key file
Fri Mar 04 17:25:46 2016 us=654465 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Mar 04 17:25:46 2016 us=654465 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Mar 04 17:25:46 2016 us=654465 Control Channel MTU parms [ L:1557 D:1184 EF:66 EB:0 ET:0 EL:3 ]
Fri Mar 04 17:25:46 2016 us=654465 Socket Buffers: R=[8192->8192] S=[8192->8192]
Fri Mar 04 17:25:46 2016 us=654465 MANAGEMENT: >STATE:1457130346,RESOLVE,,,
Fri Mar 04 17:25:46 2016 us=935266 Data Channel MTU parms [ L:1557 D:1450 EF:57 EB:12 ET:0 EL:3 ]
Fri Mar 04 17:25:46 2016 us=935266 Local Options String: 'V4,dev-type tun,link-mtu 1557,tun-mtu 1500,proto UDPv4,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
Fri Mar 04 17:25:46 2016 us=935266 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1557,tun-mtu 1500,proto UDPv4,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
Fri Mar 04 17:25:46 2016 us=935266 Local Options hash (VER=V4): 'ed844052'
Fri Mar 04 17:25:46 2016 us=935266 Expected Remote Options hash (VER=V4): '8a244582'
Fri Mar 04 17:25:46 2016 us=935266 UDPv4 link local: [undef]
Fri Mar 04 17:25:46 2016 us=935266 UDPv4 link remote: [AF_INET]74.215.155.56:1194
Fri Mar 04 17:25:46 2016 us=935266 MANAGEMENT: >STATE:1457130346,WAIT,,,
Fri Mar 04 17:26:46 2016 us=293370 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Fri Mar 04 17:26:46 2016 us=293370 TLS Error: TLS handshake failed
Fri Mar 04 17:26:46 2016 us=293370 TCP/UDP: Closing socket
Fri Mar 04 17:26:46 2016 us=293370 SIGUSR1[soft,tls-error] received, process restarting
Fri Mar 04 17:26:46 2016 us=293370 MANAGEMENT: >STATE:1457130406,RECONNECTING,tls-error,,
Fri Mar 04 17:26:46 2016 us=293370 Restart pause, 2 second(s)
Fri Mar 04 17:26:48 2016 us=321373 Re-using SSL/TLS context
Fri Mar 04 17:26:48 2016 us=321373 Control Channel MTU parms [ L:1557 D:1184 EF:66 EB:0 ET:0 EL:3 ]
Fri Mar 04 17:26:48 2016 us=321373 Socket Buffers: R=[8192->8192] S=[8192->8192]
Fri Mar 04 17:26:48 2016 us=321373 MANAGEMENT: >STATE:1457130408,RESOLVE,,,
Fri Mar 04 17:26:48 2016 us=321373 Data Channel MTU parms [ L:1557 D:1450 EF:57 EB:12 ET:0 EL:3 ]
Fri Mar 04 17:26:48 2016 us=321373 Local Options String: 'V4,dev-type tun,link-mtu 1557,tun-mtu 1500,proto UDPv4,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
Fri Mar 04 17:26:48 2016 us=321373 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1557,tun-mtu 1500,proto UDPv4,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
Fri Mar 04 17:26:48 2016 us=321373 Local Options hash (VER=V4): 'ed844052'
Fri Mar 04 17:26:48 2016 us=321373 Expected Remote Options hash (VER=V4): '8a244582'
Fri Mar 04 17:26:48 2016 us=321373 UDPv4 link local: [undef]
Fri Mar 04 17:26:48 2016 us=321373 UDPv4 link remote: [AF_INET]74.215.155.56:1194
Fri Mar 04 17:26:48 2016 us=321373 MANAGEMENT: >STATE:1457130408,WAIT,,,
Fri Mar 04 17:27:31 2016 us=533449 TCP/UDP: Closing socket
Fri Mar 04 17:27:31 2016 us=533449 SIGTERM[hard,] received, process exiting
Fri Mar 04 17:27:31 2016 us=533449 MANAGEMENT: >STATE:1457130451,EXITING,SIGTERM,,

Thanks for working with me,

Bud

Traffic

Traffic wroteDoes pfsense support Dynamic DNS client ?
budghiss wrote:
Server Config:
Code:
local budghiss.mooo.com

I think you will have to restart openvpn every time your ISP changes your IP.

Try removing this from the server config.

budghiss

Hi (Traffic),

Ok, I made some discoveries, and yet still no success.

On the tracert, my modem is actually a router. I found this out by talking to my ISP. I asked for a modem, and the only modem they have is a modem with router capabilities.

Logged into the modem, changed the time to EST from CET, turned off the firewall, turned on port forwarding, and DDNS. Now I have the pfsense box w/DDNS & the modem resolving to budghiss.ddns.net, which I changed to no-ip. I don't believe this is right, but the packets are not making it to the pfsense box with just the pfsense using DDNS. There is a hang between the ISP router and the modem from what I can tell. My ISP said they are not blocking traffic. I have tried 8080/TCP & 1194/UDP. What makes me believe this is on wireshark from the client, I am getting some issues with the ISP router and my modem. Continuous ARP requests from my modem to the ISP router. Also, the OpenVPN server is not logging requests. I am getting a timeout with errno=16.

Here is my next step: Turn either DDNS off at the pfsense box or the modem - I believe there should be only one resolving. Secondly, my modem is using internal DNSs I believe, and I have my pfsense box using them as primaries. Either way, I was thinking of changing them to google's DNS. I can't believe I can't hit this box.

I can provide whatever logs needed.

Any insight/ideas will be greatly appreciated.

Thanks,
Bud

Traffic

budghiss wrotemy modem is actually a router

Did you setup appropriate port-forwarding on the router ?

budghiss

Yes, I had to set a custom rule at 192.x.x.1 (modem) to port forward to 192.x.x.10 to the pfsense box.

X------------->X---------->X-------------->X
ISP Router ISP Modem pfsense My Network
192.x.x.25 192.x.x.1 192.x.x.10 10.x.x.x

The tracert is stopping I believe at 192.x.x.25

This is ridiculous.

Thanks Traffic.

Bud

Traffic

It is unlikely you require both a separate modem and router .. contact your ISP for installation help.

(Usually the modem is built into the router)

budghiss

Ok...one note.

About 6 months ago, I had a modem router combo. What I mean by that is the one box for the internet signal, and a wireless router w/ four Ethernet ports on the same box.

I went into the store and swapped it out for just a modem(one input, no router or switch). I wanted to use my own router pfsense. Just recently, I figured out that the new modem has firewall/DDNS/DHCP capabilities, along with a GUI login. But it only has two ports - one for the incoming signal, one Ethernet for the router.

So when I contact my ISP, they say they are not blocking traffic, and there will be a charge for technical support.

I will do another tracert when I get home to verify.

Bud

Traffic

budghiss wroteI figured out that the new modem has firewall/DDNS/DHCP capabilities

Modems do not have those functions .: it is a router not a modem.

budghiss

I would agree.

I was just trying to point out, either box I use, they are both routers with different capabilities (switch port, wifi, etc.).

How would you troubleshoot this?

Thanks,

Bud

Traffic

See the relative manuals for your devices ...

Or pay for technical support.