Experiencing some grief with setting up my own ddwrt > aws openvpn server. I'm using the commercial/gui version of the openvpn server for simplicity. I am able to use my viscosity client on my mac to connect fine to the machine. When I use the same settings from the OVPN file inside the ddwrt router (linksys E900) it won't work. I am even able to vpn through the router using my laptop, so I know the traffic is being passed fine. This is what i'm seeing in the log as the ddwrt tries to connect:
//////// blanked out remote ip with xxx //////
20160318 12:12:46 Socket Buffers: R=[114688->131072] S=[114688->131072]
20160318 12:12:46 I UDPv4 link local: [undef]
20160318 12:12:46 I UDPv4 link remote: [AF_INET]52.xx.xxx.xxx:1194
20160318 12:12:46 N TLS_ERROR: BIO read tls_read_plaintext error: error:140830B5:lib(20):func(131):reason(181)
20160318 12:12:46 N TLS Error: TLS object -> incoming plaintext read error
20160318 12:12:46 N TLS Error: TLS handshake failed
20160318 12:12:46 I SIGUSR1[soft tls-error] received process restarting
20160318 12:12:46 Restart pause 2 second(s)
20160318 12:12:48 W WARNING: No server certificate verification method has been enabled. See
http://openvpn.net/howto.html#mitm for more info.
20160318 12:12:48 W NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
20160318 12:12:48 Socket Buffers: R=[114688->131072] S=[114688->131072]
20160318 12:12:48 I UDPv4 link local: [undef]
20160318 12:12:48 I UDPv4 link remote: [AF_INET]52.x.xxx.xx:1194
20160318 12:12:48 N TLS_ERROR: BIO read tls_read_plaintext error: error:140830B5:lib(20):func(131):reason(181)
20160318 12:12:48 N TLS Error: TLS object -> incoming plaintext read error
20160318 12:12:48 N TLS Error: TLS handshake failed
20160318 12:12:48 I SIGUSR1[soft tls-error] received process restarting
20160318 12:12:48 Restart pause 2 second(s)
20160318 12:12:48 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16
20160318 12:12:48 D MANAGEMENT: CMD 'state'
20160318 12:12:48 MANAGEMENT: Client disconnected
20160318 12:12:48 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16
20160318 12:12:48 D MANAGEMENT: CMD 'state'
20160318 12:12:48 MANAGEMENT: Client disconnected
20160318 12:12:49 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16
20160318 12:12:49 D MANAGEMENT: CMD 'state'
20160318 12:12:49 MANAGEMENT: Client disconnected
20160318 12:12:49 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16
20160318 12:12:49 D MANAGEMENT: CMD 'status 2'
20160318 12:12:49 MANAGEMENT: Client disconnected
20160318 12:12:49 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16
20160318 12:12:49 D MANAGEMENT: CMD 'log 500'
19700101 01:00:00
///////////////
From the openvpn web gui login screen, i've tried download both:
Yourself (user-locked profile)
Yourself (autologin profile)
profiles and used that info inside the ddwrt, still no luck. Unsure why the TLS handshake is failing.
I did adjust the TLS cipher and the error become what it was above, before it was just TLS timing out. So I guess i'm on the right track. Attaching my OVPN file below:
//// ovpn which works on mac client viscosity ///
# Automatically generated OpenVPN client config file
# Generated on Fri Mar 18 10:23:34 2016 by ip-1xx-30-0-1xx
# Note: this config file contains inline private keys
# and therefore should be kept confidential!
# Note: this configuration is user-locked to the username below
# OVPN_ACCESS_SERVER_USERNAME=netflix
# Define the profile name of this particular configuration file
# OVPN_ACCESS_SERVER_PROFILE=
xxxxxx@xxxxxxxx.com
# OVPN_ACCESS_SERVER_CLI_PREF_ALLOW_WEB_IMPORT=True
# OVPN_ACCESS_SERVER_CLI_PREF_ENABLE_CONNECT=True
# OVPN_ACCESS_SERVER_CLI_PREF_ENABLE_XD_PROXY=True
# OVPN_ACCESS_SERVER_WSHOST=xxxxxxxxxxx.com:443
# OVPN_ACCESS_SERVER_WEB_CA_BUNDLE_START
# -----BEGIN CERTIFICATE-----
# xxxxxxxxxxxx
# -----END CERTIFICATE-----
# OVPN_ACCESS_SERVER_WEB_CA_BUNDLE_STOP
# OVPN_ACCESS_SERVER_IS_OPENVPN_WEB_CA=1
# OVPN_ACCESS_SERVER_ORGANIZATION=OpenVPN Technologies, Inc.
setenv FORWARD_COMPATIBLE 1
client
server-poll-timeout 4
nobind
remote xxxxxxxxxx.com 1194 udp
remote xxxxxxxxxx.com 1194 udp
remote xxxxxxxxxx.com 443 tcp
remote xxxxxxxxxx.com 1194 udp
remote xxxxxxxxxx.com 1194 udp
remote xxxxxxxxxx.com 1194 udp
remote xxxxxxxxxx.com 1194 udp
remote xxxxxxxxxx.com 1194 udp
dev tun
dev-type tun
ns-cert-type server
reneg-sec 604800
sndbuf 100000
rcvbuf 100000
auth-user-pass
# NOTE: LZO commands are pushed by the Access Server at connect time.
# NOTE: The below line doesn't disable LZO.
comp-lzo no
verb 3
setenv PUSH_PEER_INFO
<ca>
-----BEGIN CERTIFICATE-----
xxxxxxxxx
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
xxxxx
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
xxxxxxx
-----END PRIVATE KEY-----
</key>
key-direction 1
<tls-auth>
#
# 2048 bit OpenVPN static key (Server Agent)
#
-----BEGIN OpenVPN Static key V1-----
xxxxxx
-----END OpenVPN Static key V1-----
</tls-auth>
## -----BEGIN RSA SIGNATURE-----
## DIGEST:sha256
xxxxxx
## -----END RSA SIGNATURE-----
## -----BEGIN CERTIFICATE-----
xxxxxx
## -----END CERTIFICATE-----
## -----BEGIN CERTIFICATE-----
xxxxx
## -----END CERTIFICATE-----
/////////////////
Probably I have some setting incorrect on my DDWRT setup, see the screenshot attached, I've tried both the options which have 256 in it in the tls cipher section.
Maybe someone can take a look at my ovpn file and compare my settings which I have on DDWRT to see where i'm going wrong. I've tried various combo's, without success yet. Also, I have these sections filled out:
TLS Auth Key
CA Cert
Public Client Cert
Private Client Key
From my ovpn file. I'm sure I copied and pasted correctly..
I disabled the SPI firewall also on the router..
You can see a screenshot of my DDWRT router config here:
https://www.dropbox.com/s/ab7hbpjd193r6ag/Screenshot%202016-03-18%2012.23.16.png?dl=0
