Hello members, i have recently installed a openvpn server on my ARCH 4.4.5-1 i686 GNU/Linux home machine. Aparently the server is running OK as the output show: [img]http://s18.postimg.org/xqw0gu77t/11111.png[/img] My server config: [code]port 1194 proto udp dev tun ca /etc/openvpn/certs/ca.crt cert /etc/openvpn/certs/homeserver.crt key /etc/openvpn/certs/homeserver.key dh /etc/openvpn/certs/dh2048.pem tls-auth /etc/openvpn/certs/ta.key 0 server 192.168.88.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "redirect-gateway def1 bypass-dhcp" push "dhcp-option DNS 8.8.8.8" push "dhcp-option DNS 8.8.4.4" client-to-client keepalive 1800 4000 cipher DES-EDE3-CBC # Triple-DES comp-lzo max-clients 2 user nobody group nobody persist-key persist-tun #log /var/log/openvpn.log #status /var/log/openvpn-status.log verb 5 mute 20 #client-config-dir ccd [/code] and the client config: [code]client remote ca /root/easy-rsa/keys/ca.crt cert /root/easy-rsa/keys/kelsinni.crt key /root/easy-rsa/keys/kelsinni.key cipher DES-EDE3-CBC comp-lzo yes dev tun proto udp tls-auth /root/easy-rsa/keys/ta.key 1 nobind auth-nocache script-security 2 persist-key persist-tun user nobody group nogroup [/code] When i try to connect my server with my android phone (with openvpn for android app installed) with the respective imported keys and cert (ca.crt; kelsinni.crt; kelsinni.key) i got always the same TLS error: [img]http://s23.postimg.org/klhiivj4r/Quick_Memo_2016_04_12_00_53_40.png[/img] I have double checked all the configs but still got this same error all the times...can anyone please give me a tip about the source of this problem? Thanks in advance for all the help given...

Try --[b]comp-lzo yes[/b] in your server as well ..

Please post your [b]Server log[/b] ...

Your server log does not show any connection attempts:[quote="kelsini"]Wed Apr 13 22:17:25 2016 us=293241 Initialization Sequence Completed[/quote][quote="Traffic"]Please post your Server log[/quote]Showing the connection attempt from your client ..

Unable to connect with Openvpn server (TLS Error)

[deleted]

Hello members, i have recently installed a openvpn server on my ARCH 4.4.5-1 i686 GNU/Linux home machine.

Aparently the server is running OK as the output show:

My server config:

port 1194
proto udp
dev tun

ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/homeserver.crt
key /etc/openvpn/certs/homeserver.key
dh /etc/openvpn/certs/dh2048.pem
tls-auth /etc/openvpn/certs/ta.key 0

server 192.168.88.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

client-to-client
keepalive 1800 4000

cipher DES-EDE3-CBC # Triple-DES
comp-lzo

max-clients 2

user nobody
group nobody

persist-key
persist-tun

#log /var/log/openvpn.log
#status /var/log/openvpn-status.log
verb 5
mute 20

#client-config-dir ccd

and the client config:

client
remote
ca /root/easy-rsa/keys/ca.crt
cert /root/easy-rsa/keys/kelsinni.crt
key /root/easy-rsa/keys/kelsinni.key
cipher DES-EDE3-CBC
comp-lzo yes
dev tun
proto udp
tls-auth /root/easy-rsa/keys/ta.key 1
nobind
auth-nocache
script-security 2
persist-key
persist-tun
user nobody
group nogroup

When i try to connect my server with my android phone (with openvpn for android app installed) with the respective imported keys and cert (ca.crt; kelsinni.crt; kelsinni.key) i got always the same TLS error:

I have double checked all the configs but still got this same error all the times...can anyone please give me a tip about the source of this problem?
Thanks in advance for all the help given...

Traffic

Try --comp-lzo yes in your server as well ..

[deleted]

Traffic wroteTry --comp-lzo yes in your server as well ..

Hello...first of all thanks for your reply.
I have changed my server config as you said...

...
client-to-client
keepalive 1800 4000

cipher DES-EDE3-CBC # Triple-DES
comp-lzo yes

max-clients 2

user nobody
group nobody
...

...but still getting the exact same error when trying to access my server with my smartphone...🙁

Traffic

Please post your complete server log showing the failure (remove private data)

[deleted]

Traffic wrotePlease post your complete server log showing the failure (remove private data)

Here it is:

2016-04-12 22:12:23 compilação oficial 0.6.50 running on lge LG-D855 (MSM8974), Android 5.0 (LRX21R.A1445306351) API 21, ABI armeabi-v7a, (lge/g3_global_com/g3:5.0/LRX21R.A1445306351/1445306351:user/release-keys)
 2016-04-12 22:12:23 A preparar a configuração...
 2016-04-12 22:12:23 started Socket Thread
 2016-04-12 22:12:24 Current Parameter Settings:
 2016-04-12 22:12:24   config = '/data/data/de.blinkt.openvpn/cache/android.conf'
 2016-04-12 22:12:24   mode = 0
 2016-04-12 22:12:24   show_ciphers = DISABLED
 2016-04-12 22:12:24   show_digests = DISABLED
 2016-04-12 22:12:24   show_engines = DISABLED
 2016-04-12 22:12:24   genkey = DISABLED
 2016-04-12 22:12:24   key_pass_file = '[UNDEF]'
 2016-04-12 22:12:24   show_tls_ciphers = DISABLED
 2016-04-12 22:12:24   connect_retry_max = 5
 2016-04-12 22:12:24 Connection profiles [0]:
 2016-04-12 22:12:24   proto = udp
 2016-04-12 22:12:24   local = '[UNDEF]'
 2016-04-12 22:12:24   local_port = '1194'
 2016-04-12 22:12:24   remote = 'XXXXXXXXX (My DNS)'
 2016-04-12 22:12:24   remote_port = '1194'
 2016-04-12 22:12:24   remote_float = DISABLED
 2016-04-12 22:12:24   bind_defined = DISABLED
 2016-04-12 22:12:24   bind_local = ENABLED
 2016-04-12 22:12:24   bind_ipv6_only = DISABLED
 2016-04-12 22:12:24   connect_retry_seconds = 5
 2016-04-12 22:12:24   connect_timeout = 240
 2016-04-12 22:12:24   socks_proxy_server = '[UNDEF]'
 2016-04-12 22:12:24   socks_proxy_port = '[UNDEF]'
 2016-04-12 22:12:24   socks_proxy_retry = DISABLED
 2016-04-12 22:12:24   tun_mtu = 1500
 2016-04-12 22:12:24   tun_mtu_defined = ENABLED
 2016-04-12 22:12:24   link_mtu = 1500
 2016-04-12 22:12:24   link_mtu_defined = DISABLED
 2016-04-12 22:12:24   tun_mtu_extra = 0
 2016-04-12 22:12:24   tun_mtu_extra_defined = DISABLED
 2016-04-12 22:12:24   mtu_discover_type = -1
 2016-04-12 22:12:24   fragment = 0
 2016-04-12 22:12:24   mssfix = 1450
 2016-04-12 22:12:24   explicit_exit_notification = 0
 2016-04-12 22:12:24 Connection profiles END
 2016-04-12 22:12:24   remote_random = DISABLED
 2016-04-12 22:12:24   ipchange = '[UNDEF]'
 2016-04-12 22:12:24   dev = 'tun'
 2016-04-12 22:12:24   dev_type = '[UNDEF]'
 2016-04-12 22:12:24   dev_node = '[UNDEF]'
 2016-04-12 22:12:24   lladdr = '[UNDEF]'
 2016-04-12 22:12:24   topology = 1
 2016-04-12 22:12:24   tun_ipv6 = DISABLED
 2016-04-12 22:12:24   ifconfig_local = '[UNDEF]'
 2016-04-12 22:12:24   ifconfig_remote_netmask = '[UNDEF]'
 2016-04-12 22:12:24   ifconfig_noexec = DISABLED
 2016-04-12 22:12:24   ifconfig_nowarn = ENABLED
 2016-04-12 22:12:24   ifconfig_ipv6_local = '[UNDEF]'
 2016-04-12 22:12:24   ifconfig_ipv6_netbits = 0
 2016-04-12 22:12:24   ifconfig_ipv6_remote = '[UNDEF]'
 2016-04-12 22:12:24   shaper = 0
 2016-04-12 22:12:24   mtu_test = 0
 2016-04-12 22:12:24   mlock = DISABLED
 2016-04-12 22:12:24   keepalive_ping = 0
 2016-04-12 22:12:24   keepalive_timeout = 0
 2016-04-12 22:12:24   inactivity_timeout = 0
 2016-04-12 22:12:24   ping_send_timeout = 0
 2016-04-12 22:12:24   ping_rec_timeout = 0
 2016-04-12 22:12:24   ping_rec_timeout_action = 0
 2016-04-12 22:12:24   ping_timer_remote = DISABLED
 2016-04-12 22:12:24   remap_sigusr1 = 0
 2016-04-12 22:12:24   persist_tun = DISABLED
 2016-04-12 22:12:24   persist_local_ip = DISABLED
 2016-04-12 22:12:24   persist_remote_ip = DISABLED
 2016-04-12 22:12:24   persist_key = DISABLED
 2016-04-12 22:12:24   passtos = DISABLED
 2016-04-12 22:12:24   resolve_retry_seconds = 60
 2016-04-12 22:12:24   resolve_in_advance = DISABLED
 2016-04-12 22:12:24   username = '[UNDEF]'
 2016-04-12 22:12:24   groupname = '[UNDEF]'
 2016-04-12 22:12:24   chroot_dir = '[UNDEF]'
 2016-04-12 22:12:24   cd_dir = '[UNDEF]'
 2016-04-12 22:12:24   writepid = '[UNDEF]'
 2016-04-12 22:12:24   up_script = '[UNDEF]'
 2016-04-12 22:12:24   down_script = '[UNDEF]'
 2016-04-12 22:12:24   down_pre = DISABLED
 2016-04-12 22:12:24   up_restart = DISABLED
 2016-04-12 22:12:24   up_delay = DISABLED
 2016-04-12 22:12:24   daemon = DISABLED
 2016-04-12 22:12:24   inetd = 0
 2016-04-12 22:12:24   log = DISABLED
 2016-04-12 22:12:24   suppress_timestamps = DISABLED
 2016-04-12 22:12:24   machine_readable_output = ENABLED
 2016-04-12 22:12:24   nice = 0
 2016-04-12 22:12:24   verbosity = 4
 2016-04-12 22:12:24   mute = 0
 2016-04-12 22:12:24   gremlin = 0
 2016-04-12 22:12:24   status_file = '[UNDEF]'
 2016-04-12 22:12:24   status_file_version = 1
 2016-04-12 22:12:24   status_file_update_freq = 60
 2016-04-12 22:12:24   occ = ENABLED
 2016-04-12 22:12:24   rcvbuf = 0
 2016-04-12 22:12:24   sndbuf = 0
 2016-04-12 22:12:24   sockflags = 0
 2016-04-12 22:12:24   fast_io = DISABLED
 2016-04-12 22:12:24   comp.alg = 2
 2016-04-12 22:12:24   comp.flags = 1
 2016-04-12 22:12:24   route_script = '[UNDEF]'
 2016-04-12 22:12:24   route_default_gateway = '[UNDEF]'
 2016-04-12 22:12:24   route_default_metric = 0
 2016-04-12 22:12:24   route_noexec = DISABLED
 2016-04-12 22:12:24   route_delay = 0
 2016-04-12 22:12:24   route_delay_window = 30
 2016-04-12 22:12:24   route_delay_defined = DISABLED
 2016-04-12 22:12:24   route_nopull = DISABLED
 2016-04-12 22:12:24   route_gateway_via_dhcp = DISABLED
 2016-04-12 22:12:24   allow_pull_fqdn = DISABLED
 2016-04-12 22:12:24   route 0.0.0.0/0.0.0.0/vpn_gateway/nil
 2016-04-12 22:12:24   management_addr = '/data/data/de.blinkt.openvpn/cache/mgmtsocket'
 2016-04-12 22:12:24   management_port = 'unix'
 2016-04-12 22:12:24   management_user_pass = '[UNDEF]'
 2016-04-12 22:12:24   management_log_history_cache = 250
 2016-04-12 22:12:24   management_echo_buffer_size = 100
 2016-04-12 22:12:24   management_write_peer_info_file = '[UNDEF]'
 2016-04-12 22:12:24   management_client_user = '[UNDEF]'
 2016-04-12 22:12:24   management_client_group = '[UNDEF]'
 2016-04-12 22:12:24   management_flags = 4390
 2016-04-12 22:12:24   shared_secret_file = '[UNDEF]'
 2016-04-12 22:12:24   key_direction = 0
 2016-04-12 22:12:24   ciphername_defined = ENABLED
 2016-04-12 22:12:24   ciphername = 'BF-CBC'
 2016-04-12 22:12:24   authname_defined = ENABLED
 2016-04-12 22:12:24   authname = 'SHA1'
 2016-04-12 22:12:24   prng_hash = 'SHA1'
 2016-04-12 22:12:24   prng_nonce_secret_len = 16
 2016-04-12 22:12:24   keysize = 0
 2016-04-12 22:12:24   engine = DISABLED
 2016-04-12 22:12:24   replay = ENABLED
 2016-04-12 22:12:24   mute_replay_warnings = DISABLED
 2016-04-12 22:12:24   replay_window = 64
 2016-04-12 22:12:24   replay_time = 15
 2016-04-12 22:12:24   packet_id_file = '[UNDEF]'
 2016-04-12 22:12:24   use_iv = ENABLED
 2016-04-12 22:12:24   test_crypto = DISABLED
 2016-04-12 22:12:24   tls_server = DISABLED
 2016-04-12 22:12:24   tls_client = ENABLED
 2016-04-12 22:12:24   key_method = 2
 2016-04-12 22:12:24   ca_file = '[[INLINE]]'
 2016-04-12 22:12:24   ca_path = '[UNDEF]'
 2016-04-12 22:12:24   dh_file = '[UNDEF]'
 2016-04-12 22:12:24   cert_file = '[[INLINE]]'
 2016-04-12 22:12:24   extra_certs_file = '[UNDEF]'
 2016-04-12 22:12:24   priv_key_file = '[[INLINE]]'
 2016-04-12 22:12:24   pkcs12_file = '[UNDEF]'
 2016-04-12 22:12:24   cipher_list = '[UNDEF]'
 2016-04-12 22:12:24   tls_verify = '[UNDEF]'
 2016-04-12 22:12:24   tls_export_cert = '[UNDEF]'
 2016-04-12 22:12:24   verify_x509_type = 2
 2016-04-12 22:12:24   verify_x509_name = 'XXXXXXXXX (My DNS)'
 2016-04-12 22:12:24   crl_file = '[UNDEF]'
 2016-04-12 22:12:24   ns_cert_type = 0
 2016-04-12 22:12:24   remote_cert_ku[i] = 0
 2016-04-12 22:12:24   remote_cert_ku[i] = 0
 2016-04-12 22:12:24   remote_cert_ku[i] = 0
 2016-04-12 22:12:24   remote_cert_ku[i] = 0
 2016-04-12 22:12:24   remote_cert_ku[i] = 0
 2016-04-12 22:12:24   remote_cert_ku[i] = 0
 2016-04-12 22:12:24   remote_cert_ku[i] = 0
 2016-04-12 22:12:24   remote_cert_ku[i] = 0
 2016-04-12 22:12:24   remote_cert_ku[i] = 0
 2016-04-12 22:12:24   remote_cert_ku[i] = 0
 2016-04-12 22:12:24   remote_cert_ku[i] = 0
 2016-04-12 22:12:24   remote_cert_ku[i] = 0
 2016-04-12 22:12:24   remote_cert_ku[i] = 0
 2016-04-12 22:12:24   remote_cert_ku[i] = 0
 2016-04-12 22:12:24   remote_cert_ku[i] = 0
 2016-04-12 22:12:24   remote_cert_ku[i] = 0
 2016-04-12 22:12:24   remote_cert_eku = '[UNDEF]'
 2016-04-12 22:12:24   ssl_flags = 0
 2016-04-12 22:12:24   tls_timeout = 2
 2016-04-12 22:12:24   renegotiate_bytes = 0
 2016-04-12 22:12:24   renegotiate_packets = 0
 2016-04-12 22:12:24   renegotiate_seconds = 3600
 2016-04-12 22:12:24   handshake_window = 60
 2016-04-12 22:12:24   transition_window = 3600
 2016-04-12 22:12:24   single_session = DISABLED
 2016-04-12 22:12:24   push_peer_info = DISABLED
 2016-04-12 22:12:24   tls_exit = DISABLED
 2016-04-12 22:12:24   tls_auth_file = '[UNDEF]'
 2016-04-12 22:12:24   client = ENABLED
 2016-04-12 22:12:24   pull = ENABLED
 2016-04-12 22:12:24   auth_user_pass_file = '[UNDEF]'
 2016-04-12 22:12:24 OpenVPN 2.4-icsopenvpn [git:icsopenvpn-a6eda60c1e79b5c9] android-14-armeabi-v7a [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH] [IPv6] built on Mar  9 2016
 2016-04-12 22:12:24 library versions: OpenSSL 1.0.2g  1 Mar 2016, LZO 2.09
 2016-04-12 22:12:24 MANAGEMENT: Connected to management server at /data/data/de.blinkt.openvpn/cache/mgmtsocket
 2016-04-12 22:12:24 MANAGEMENT: CMD 'hold release'
 2016-04-12 22:12:24 MANAGEMENT: CMD 'proxy NONE'
 2016-04-12 22:12:24 MANAGEMENT: CMD 'bytecount 2'
 2016-04-12 22:12:24 MANAGEMENT: CMD 'state on'
 2016-04-12 22:12:24 Estado da rede: CONNECTED  to WIFI "FON_ZON_FREE_INTERNET"
 2016-04-12 22:12:25 LZO compression initializing
 2016-04-12 22:12:25 Control Channel MTU parms [ L:1542 D:1212 EF:38 EB:0 ET:0 EL:3 ]
 2016-04-12 22:12:25 MANAGEMENT: >STATE:1460495545,RESOLVE,,,,,,
 2016-04-12 22:12:25 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:393 ET:0 EL:3 ]
 2016-04-12 22:12:25 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
 2016-04-12 22:12:25 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
 2016-04-12 22:12:25 TCP/UDP: Preserving recently used remote address: [AF_INET]89.114.238.189:1194
 2016-04-12 22:12:25 Socket Buffers: R=[163840->163840] S=[163840->163840]
 2016-04-12 22:12:25 MANAGEMENT: CMD 'needok 'PROTECTFD' ok'
 2016-04-12 22:12:25 UDP link local (bound): [AF_INET][undef]:1194
 2016-04-12 22:12:25 UDP link remote: [AF_INET]89.114.238.189:1194
 2016-04-12 22:12:25 MANAGEMENT: >STATE:1460495545,WAIT,,,,,,
 2016-04-12 22:13:25 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
 2016-04-12 22:13:25 TLS Error: TLS handshake failed
 2016-04-12 22:13:25 TCP/UDP: Closing s

Traffic

kelsini wrote

Traffic wrotePlease post your complete server log showing the failure (remove private data)

Here it is:

2016-04-12 22:12:23 compilação oficial 0.6.50 running on lge LG-D855 (MSM8974), Android 5.0 (LRX21R.A1445306351) API 21, ABI armeabi-v7a, (lge/g3_global_com/g3:5.0/LRX21R.A1445306351/1445306351:user/release-keys)

 2016-04-12 22:12:24   config = '/data/data/de.blinkt.openvpn/cache/android.conf'

 2016-04-12 22:12:24   remote = 'XXXXXXXXX (My DNS)'
 2016-04-12 22:12:24   remote_port = '1194'

 2016-04-12 22:13:25 TCP/UDP: Closing s

:roll:

[deleted]

I have notice that 'de.blinkt.openvpn' wasnt for sure correct but...i went on the smartphone openvpn for android app and change the "search domain" on "DNS AND IP" tab form 'de.blinkt.openvpn' to my DNS...

The most strange is that after this change the log still give me that 'de.blinkt.openvpn' DNS...and the same TLS error...

2016-04-13 00:04:02 compilação oficial 0.6.50 running on lge LG-D855 (MSM8974), Android 5.0 (LRX21R.A1445306351) API 21, ABI armeabi-v7a, (lge/g3_global_com/g3:5.0/LRX21R.A1445306351/1445306351:user/release-keys)
 2016-04-13 00:04:02 A preparar a configuração...
 2016-04-13 00:04:02 started Socket Thread
 2016-04-13 00:04:02 Current Parameter Settings:
 2016-04-13 00:04:02   config = '/data/data/de.blinkt.openvpn/cache/android.conf'
 2016-04-13 00:04:02   mode = 0
 2016-04-13 00:04:02   show_ciphers = DISABLED
 2016-04-13 00:04:02   show_digests = DISABLED
 2016-04-13 00:04:02   show_engines = DISABLED
 2016-04-13 00:04:02   genkey = DISABLED
 2016-04-13 00:04:02   key_pass_file = '[UNDEF]'
 2016-04-13 00:04:02   show_tls_ciphers = DISABLED
 2016-04-13 00:04:02   connect_retry_max = 5
 2016-04-13 00:04:02 Connection profiles [0]:
 2016-04-13 00:04:02   proto = udp
 2016-04-13 00:04:02   local = '[UNDEF]'
 2016-04-13 00:04:02   local_port = '1194'
 2016-04-13 00:04:02   remote = 'XXXXXX (MY DNS)'
 2016-04-13 00:04:02   remote_port = '1194'
 2016-04-13 00:04:02   remote_float = DISABLED
 2016-04-13 00:04:02   bind_defined = DISABLED
 2016-04-13 00:04:02   bind_local = ENABLED
 2016-04-13 00:04:02   bind_ipv6_only = DISABLED
 2016-04-13 00:04:02   connect_retry_seconds = 5
 2016-04-13 00:04:02   connect_timeout = 240
 2016-04-13 00:04:02   socks_proxy_server = '[UNDEF]'
 2016-04-13 00:04:02   socks_proxy_port = '[UNDEF]'
 2016-04-13 00:04:02   socks_proxy_retry = DISABLED
 2016-04-13 00:04:02   tun_mtu = 1500
 2016-04-13 00:04:02   tun_mtu_defined = ENABLED
 2016-04-13 00:04:02   link_mtu = 1500
 2016-04-13 00:04:02   link_mtu_defined = DISABLED
 2016-04-13 00:04:02   tun_mtu_extra = 0
 2016-04-13 00:04:02   tun_mtu_extra_defined = DISABLED
 2016-04-13 00:04:02   mtu_discover_type = -1
 2016-04-13 00:04:02   fragment = 0
 2016-04-13 00:04:02   mssfix = 1450
 2016-04-13 00:04:02   explicit_exit_notification = 0
 2016-04-13 00:04:02 Connection profiles END
 2016-04-13 00:04:02   remote_random = DISABLED
 2016-04-13 00:04:02   ipchange = '[UNDEF]'
 2016-04-13 00:04:02   dev = 'tun'
 2016-04-13 00:04:02   dev_type = '[UNDEF]'
 2016-04-13 00:04:02   dev_node = '[UNDEF]'
 2016-04-13 00:04:02   lladdr = '[UNDEF]'
 2016-04-13 00:04:02   topology = 1
 2016-04-13 00:04:02   tun_ipv6 = DISABLED
 2016-04-13 00:04:02   ifconfig_local = '[UNDEF]'
 2016-04-13 00:04:02   ifconfig_remote_netmask = '[UNDEF]'
 2016-04-13 00:04:02   ifconfig_noexec = DISABLED
 2016-04-13 00:04:02   ifconfig_nowarn = ENABLED
 2016-04-13 00:04:02   ifconfig_ipv6_local = '[UNDEF]'
 2016-04-13 00:04:02   ifconfig_ipv6_netbits = 0
 2016-04-13 00:04:02   ifconfig_ipv6_remote = '[UNDEF]'
 2016-04-13 00:04:02   shaper = 0
 2016-04-13 00:04:02   mtu_test = 0
 2016-04-13 00:04:02   mlock = DISABLED
 2016-04-13 00:04:02   keepalive_ping = 0
 2016-04-13 00:04:02   keepalive_timeout = 0
 2016-04-13 00:04:02   inactivity_timeout = 0
 2016-04-13 00:04:02   ping_send_timeout = 0
 2016-04-13 00:04:02   ping_rec_timeout = 0
 2016-04-13 00:04:02   ping_rec_timeout_action = 0
 2016-04-13 00:04:02   ping_timer_remote = DISABLED
 2016-04-13 00:04:02   remap_sigusr1 = 0
 2016-04-13 00:04:02   persist_tun = DISABLED
 2016-04-13 00:04:02   persist_local_ip = DISABLED
 2016-04-13 00:04:02   persist_remote_ip = DISABLED
 2016-04-13 00:04:02   persist_key = DISABLED
 2016-04-13 00:04:02   passtos = DISABLED
 2016-04-13 00:04:02   resolve_retry_seconds = 60
 2016-04-13 00:04:02   resolve_in_advance = DISABLED
 2016-04-13 00:04:02   username = '[UNDEF]'
 2016-04-13 00:04:02   groupname = '[UNDEF]'
 2016-04-13 00:04:02   chroot_dir = '[UNDEF]'
 2016-04-13 00:04:02   cd_dir = '[UNDEF]'
 2016-04-13 00:04:02   writepid = '[UNDEF]'
 2016-04-13 00:04:02   up_script = '[UNDEF]'
 2016-04-13 00:04:02   down_script = '[UNDEF]'
 2016-04-13 00:04:02   down_pre = DISABLED
 2016-04-13 00:04:02   up_restart = DISABLED
 2016-04-13 00:04:02   up_delay = DISABLED
 2016-04-13 00:04:02   daemon = DISABLED
 2016-04-13 00:04:02   inetd = 0
 2016-04-13 00:04:02   log = DISABLED
 2016-04-13 00:04:02   suppress_timestamps = DISABLED
 2016-04-13 00:04:02   machine_readable_output = ENABLED
 2016-04-13 00:04:02   nice = 0
 2016-04-13 00:04:02   verbosity = 4
 2016-04-13 00:04:02   mute = 0
 2016-04-13 00:04:02   gremlin = 0
 2016-04-13 00:04:02   status_file = '[UNDEF]'
 2016-04-13 00:04:02   status_file_version = 1
 2016-04-13 00:04:02   status_file_update_freq = 60
 2016-04-13 00:04:02   occ = ENABLED
 2016-04-13 00:04:02   rcvbuf = 0
 2016-04-13 00:04:02 Estado da rede: CONNECTED  to WIFI "FON_ZON_FREE_INTERNET"
 2016-04-13 00:04:02   sndbuf = 0
 2016-04-13 00:04:02   sockflags = 0
 2016-04-13 00:04:02   fast_io = DISABLED
 2016-04-13 00:04:02   comp.alg = 2
 2016-04-13 00:04:02   comp.flags = 1
 2016-04-13 00:04:02   route_script = '[UNDEF]'
 2016-04-13 00:04:02   route_default_gateway = '[UNDEF]'
 2016-04-13 00:04:02   route_default_metric = 0
 2016-04-13 00:04:02   route_noexec = DISABLED
 2016-04-13 00:04:02   route_delay = 0
 2016-04-13 00:04:02   route_delay_window = 30
 2016-04-13 00:04:02   route_delay_defined = DISABLED
 2016-04-13 00:04:02   route_nopull = DISABLED
 2016-04-13 00:04:02   route_gateway_via_dhcp = DISABLED
 2016-04-13 00:04:02   allow_pull_fqdn = DISABLED
 2016-04-13 00:04:02   route 0.0.0.0/0.0.0.0/vpn_gateway/nil
 2016-04-13 00:04:02   management_addr = '/data/data/de.blinkt.openvpn/cache/mgmtsocket'
 2016-04-13 00:04:02   management_port = 'unix'
 2016-04-13 00:04:02   management_user_pass = '[UNDEF]'
 2016-04-13 00:04:02   management_log_history_cache = 250
 2016-04-13 00:04:02   management_echo_buffer_size = 100
 2016-04-13 00:04:02   management_write_peer_info_file = '[UNDEF]'
 2016-04-13 00:04:02   management_client_user = '[UNDEF]'
 2016-04-13 00:04:02   management_client_group = '[UNDEF]'
 2016-04-13 00:04:02   management_flags = 4390
 2016-04-13 00:04:02   shared_secret_file = '[UNDEF]'
 2016-04-13 00:04:02   key_direction = 0
 2016-04-13 00:04:02   ciphername_defined = ENABLED
 2016-04-13 00:04:02   ciphername = 'BF-CBC'
 2016-04-13 00:04:02   authname_defined = ENABLED
 2016-04-13 00:04:02   authname = 'SHA1'
 2016-04-13 00:04:02   prng_hash = 'SHA1'
 2016-04-13 00:04:02   prng_nonce_secret_len = 16
 2016-04-13 00:04:02   keysize = 0
 2016-04-13 00:04:02   engine = DISABLED
 2016-04-13 00:04:02   replay = ENABLED
 2016-04-13 00:04:02   mute_replay_warnings = DISABLED
 2016-04-13 00:04:02   replay_window = 64
 2016-04-13 00:04:02   replay_time = 15
 2016-04-13 00:04:02   packet_id_file = '[UNDEF]'
 2016-04-13 00:04:02   use_iv = ENABLED
 2016-04-13 00:04:02   test_crypto = DISABLED
 2016-04-13 00:04:02   tls_server = DISABLED
 2016-04-13 00:04:02   tls_client = ENABLED
 2016-04-13 00:04:02   key_method = 2
 2016-04-13 00:04:02   ca_file = '[[INLINE]]'
 2016-04-13 00:04:02   ca_path = '[UNDEF]'
 2016-04-13 00:04:02   dh_file = '[UNDEF]'
 2016-04-13 00:04:02   cert_file = '[[INLINE]]'
 2016-04-13 00:04:02   extra_certs_file = '[UNDEF]'
 2016-04-13 00:04:02   priv_key_file = '[[INLINE]]'
 2016-04-13 00:04:02   pkcs12_file = '[UNDEF]'
 2016-04-13 00:04:02   cipher_list = '[UNDEF]'
 2016-04-13 00:04:02   tls_verify = '[UNDEF]'
 2016-04-13 00:04:02   tls_export_cert = '[UNDEF]'
 2016-04-13 00:04:02   verify_x509_type = 0
 2016-04-13 00:04:02   verify_x509_name = '[UNDEF]'
 2016-04-13 00:04:02   crl_file = '[UNDEF]'
 2016-04-13 00:04:02   ns_cert_type = 0
 2016-04-13 00:04:02   remote_cert_ku[i] = 0
 2016-04-13 00:04:02   remote_cert_ku[i] = 0
 2016-04-13 00:04:02   remote_cert_ku[i] = 0
 2016-04-13 00:04:02   remote_cert_ku[i] = 0
 2016-04-13 00:04:02   remote_cert_ku[i] = 0
 2016-04-13 00:04:02   remote_cert_ku[i] = 0
 2016-04-13 00:04:02   remote_cert_ku[i] = 0
 2016-04-13 00:04:02   remote_cert_ku[i] = 0
 2016-04-13 00:04:02   remote_cert_ku[i] = 0
 2016-04-13 00:04:02   remote_cert_ku[i] = 0
 2016-04-13 00:04:02   remote_cert_ku[i] = 0
 2016-04-13 00:04:02   remote_cert_ku[i] = 0
 2016-04-13 00:04:02   remote_cert_ku[i] = 0
 2016-04-13 00:04:02   remote_cert_ku[i] = 0
 2016-04-13 00:04:02   remote_cert_ku[i] = 0
 2016-04-13 00:04:02   remote_cert_ku[i] = 0
 2016-04-13 00:04:02   remote_cert_eku = '[UNDEF]'
 2016-04-13 00:04:02   ssl_flags = 0
 2016-04-13 00:04:02   tls_timeout = 2
 2016-04-13 00:04:02   renegotiate_bytes = 0
 2016-04-13 00:04:02   renegotiate_packets = 0
 2016-04-13 00:04:02   renegotiate_seconds = 3600
 2016-04-13 00:04:02   handshake_window = 60
 2016-04-13 00:04:02   transition_window = 3600
 2016-04-13 00:04:02   single_session = DISABLED
 2016-04-13 00:04:02   push_peer_info = DISABLED
 2016-04-13 00:04:02   tls_exit = DISABLED
 2016-04-13 00:04:02   tls_auth_file = '[UNDEF]'
 2016-04-13 00:04:02   client = ENABLED
 2016-04-13 00:04:02   pull = ENABLED
 2016-04-13 00:04:02   auth_user_pass_file = '[UNDEF]'
 2016-04-13 00:04:02 OpenVPN 2.4-icsopenvpn [git:icsopenvpn-a6eda60c1e79b5c9] android-14-armeabi-v7a [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH] [IPv6] built on Mar  9 2016
 2016-04-13 00:04:02 library versions: OpenSSL 1.0.2g  1 Mar 2016, LZO 2.09
 2016-04-13 00:04:02 MANAGEMENT: Connected to management server at /data/data/de.blinkt.openvpn/cache/mgmtsocket
 2016-04-13 00:04:02 MANAGEMENT: CMD 'hold release'
 2016-04-13 00:04:02 MANAGEMENT: CMD 'bytecount 2'
 2016-04-13 00:04:02 MANAGEMENT: CMD 'proxy NONE'
 2016-04-13 00:04:02 MANAGEMENT: CMD 'state on'
 2016-04-13 00:04:03 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
 2016-04-13 00:04:03 LZO compression initializing
 2016-04-13 00:04:03 Control Channel MTU parms [ L:1542 D:1212 EF:38 EB:0 ET:0 EL:3 ]
 2016-04-13 00:04:03 MANAGEMENT: >STATE:1460502243,RESOLVE,,,,,,
 2016-04-13 00:04:03 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:393 ET:0 EL:3 ]
 2016-04-13 00:04:03 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
 2016-04-13 00:04:03 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
 2016-04-13 00:04:03 TCP/UDP: Preserving recently used remote address: [AF_INET]89.114.238.189:1194
 2016-04-13 00:04:03 Socket Buffers: R=[163840->163840] S=[163840->163840]
 2016-04-13 00:04:03 MANAGEMENT: CMD 'needok 'PROTECTFD' ok'
 2016-04-13 00:04:03 UDP link local (bound): [AF_INET][undef]:1194
 2016-04-13 00:04:03 UDP link remote: [AF_INET]89.114.238.189:1194
 2016-04-13 00:04:03 MANAGEMENT: >STATE:1460502243,WAIT,,,,,,
 2016-04-13 00:05:03 TLS Error: TLS key negotiation failed to occur within 60

I cant see in any other tab or any option where that 'de.blinkt.openvpn' is mentioned again...

Traffic

Please post your Server log ...

[deleted]

Traffic wrotePlease post your Server log ...

cd /var/log/
dir
btmp faillog journal lastlog old openvpn.log pacman.log wtmp

I think you are asking openvpn.log...here it is:

Wed Apr 13 22:17:25 2016 us=95312 Current Parameter Settings:
Wed Apr 13 22:17:25 2016 us=95601   config = '/etc/openvpn/homeserver-vpn.conf'
Wed Apr 13 22:17:25 2016 us=95680   mode = 1
Wed Apr 13 22:17:25 2016 us=95744   persist_config = DISABLED
Wed Apr 13 22:17:25 2016 us=95808   persist_mode = 1
Wed Apr 13 22:17:25 2016 us=95868   show_ciphers = DISABLED
Wed Apr 13 22:17:25 2016 us=95927   show_digests = DISABLED
Wed Apr 13 22:17:25 2016 us=95987   show_engines = DISABLED
Wed Apr 13 22:17:25 2016 us=96047   genkey = DISABLED
Wed Apr 13 22:17:25 2016 us=96105   key_pass_file = '[UNDEF]'
Wed Apr 13 22:17:25 2016 us=96167   show_tls_ciphers = DISABLED
Wed Apr 13 22:17:25 2016 us=96229 Connection profiles [default]:
Wed Apr 13 22:17:25 2016 us=96290   proto = udp
Wed Apr 13 22:17:25 2016 us=96349   local = '[UNDEF]'
Wed Apr 13 22:17:25 2016 us=96410   local_port = 1194
Wed Apr 13 22:17:25 2016 us=98947   remote = '[UNDEF]'
Wed Apr 13 22:17:25 2016 us=99502   remote_port = 1194
Wed Apr 13 22:17:25 2016 us=99567   remote_float = DISABLED
Wed Apr 13 22:17:25 2016 us=99615   bind_defined = DISABLED
Wed Apr 13 22:17:25 2016 us=99661   bind_local = ENABLED
Wed Apr 13 22:17:25 2016 us=99708 NOTE: --mute triggered...
Wed Apr 13 22:17:25 2016 us=99770 213 variation(s) on previous 20 message(s) suppressed by --mute
Wed Apr 13 22:17:25 2016 us=99817 OpenVPN 2.3.10 i686-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Mar 14 2016
Wed Apr 13 22:17:25 2016 us=99895 library versions: OpenSSL 1.0.2g  1 Mar 2016, LZO 2.09
Wed Apr 13 22:17:25 2016 us=115220 Diffie-Hellman initialized with 2048 bit key
Wed Apr 13 22:17:25 2016 us=139828 Control Channel Authentication: using '/etc/openvpn/certs/ta.key' as a OpenVPN static key file
Wed Apr 13 22:17:25 2016 us=139975 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Apr 13 22:17:25 2016 us=140056 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Apr 13 22:17:25 2016 us=140147 TLS-Auth MTU parms [ L:1542 D:1184 EF:66 EB:0 ET:0 EL:3 ]
Wed Apr 13 22:17:25 2016 us=140259 Socket Buffers: R=[163840->163840] S=[163840->163840]
Wed Apr 13 22:17:25 2016 us=140534 ROUTE: default_gateway=UNDEF
Wed Apr 13 22:17:25 2016 us=245008 TUN/TAP device tun0 opened
Wed Apr 13 22:17:25 2016 us=245172 TUN/TAP TX queue length set to 100
Wed Apr 13 22:17:25 2016 us=245265 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Apr 13 22:17:25 2016 us=245379 /usr/bin/ip link set dev tun0 up mtu 1500
Wed Apr 13 22:17:25 2016 us=271194 /usr/bin/ip addr add dev tun0 local 192.168.88.1 peer 192.168.88.2
Wed Apr 13 22:17:25 2016 us=278962 /usr/bin/ip route add 192.168.88.0/24 via 192.168.88.2
Wed Apr 13 22:17:25 2016 us=285863 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:143 ET:0 EL:3 AF:3/1 ]
Wed Apr 13 22:17:25 2016 us=286998 GID set to nobody
Wed Apr 13 22:17:25 2016 us=287116 UID set to nobody
Wed Apr 13 22:17:25 2016 us=287181 UDPv4 link local (bound): [undef]
Wed Apr 13 22:17:25 2016 us=292745 UDPv4 link remote: [undef]
Wed Apr 13 22:17:25 2016 us=292865 MULTI: multi_init called, r=256 v=256
Wed Apr 13 22:17:25 2016 us=292997 IFCONFIG POOL: base=192.168.88.4 size=62, ipv6=0
Wed Apr 13 22:17:25 2016 us=293098 IFCONFIG POOL LIST
Wed Apr 13 22:17:25 2016 us=293241 Initialization Sequence Completed

Traffic

Your server log does not show any connection attempts:

kelsini wroteWed Apr 13 22:17:25 2016 us=293241 Initialization Sequence Completed

Traffic wrotePlease post your Server log

Showing the connection attempt from your client ..

[deleted]

Here it is again:

Wed Apr 13 22:53:10 2016 us=937880 Current Parameter Settings:
Wed Apr 13 22:53:10 2016 us=938186   config = '/etc/openvpn/homeserver-vpn.conf'
Wed Apr 13 22:53:10 2016 us=938261   mode = 1
Wed Apr 13 22:53:10 2016 us=938326   persist_config = DISABLED
Wed Apr 13 22:53:10 2016 us=938390   persist_mode = 1
Wed Apr 13 22:53:10 2016 us=938453   show_ciphers = DISABLED
Wed Apr 13 22:53:10 2016 us=938515   show_digests = DISABLED
Wed Apr 13 22:53:10 2016 us=938719   show_engines = DISABLED
Wed Apr 13 22:53:10 2016 us=938789   genkey = DISABLED
Wed Apr 13 22:53:10 2016 us=938851   key_pass_file = '[UNDEF]'
Wed Apr 13 22:53:10 2016 us=938915   show_tls_ciphers = DISABLED
Wed Apr 13 22:53:10 2016 us=938976 Connection profiles [default]:
Wed Apr 13 22:53:10 2016 us=939039   proto = udp
Wed Apr 13 22:53:10 2016 us=939101   local = '[UNDEF]'
Wed Apr 13 22:53:10 2016 us=939164   local_port = 1194
Wed Apr 13 22:53:10 2016 us=939230   remote = '[UNDEF]'
Wed Apr 13 22:53:10 2016 us=939293   remote_port = 1194
Wed Apr 13 22:53:10 2016 us=939356   remote_float = DISABLED
Wed Apr 13 22:53:10 2016 us=939417   bind_defined = DISABLED
Wed Apr 13 22:53:10 2016 us=939480   bind_local = ENABLED
Wed Apr 13 22:53:10 2016 us=939542 NOTE: --mute triggered...
Wed Apr 13 22:53:10 2016 us=939625 213 variation(s) on previous 20 message(s) suppressed by --mute
Wed Apr 13 22:53:10 2016 us=939689 OpenVPN 2.3.10 i686-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Mar 14 2016
Wed Apr 13 22:53:10 2016 us=939789 library versions: OpenSSL 1.0.2g  1 Mar 2016, LZO 2.09
Wed Apr 13 22:53:10 2016 us=948982 Diffie-Hellman initialized with 2048 bit key
Wed Apr 13 22:53:10 2016 us=958396 Control Channel Authentication: using '/etc/openvpn/certs/ta.key' as a OpenVPN static key file
Wed Apr 13 22:53:10 2016 us=958536 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Apr 13 22:53:10 2016 us=958612 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Apr 13 22:53:10 2016 us=958697 TLS-Auth MTU parms [ L:1542 D:1184 EF:66 EB:0 ET:0 EL:3 ]
Wed Apr 13 22:53:10 2016 us=958803 Socket Buffers: R=[163840->163840] S=[163840->163840]
Wed Apr 13 22:53:10 2016 us=959092 ROUTE: default_gateway=UNDEF
Wed Apr 13 22:53:10 2016 us=990694 TUN/TAP device tun0 opened
Wed Apr 13 22:53:10 2016 us=990870 TUN/TAP TX queue length set to 100
Wed Apr 13 22:53:10 2016 us=991685 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Apr 13 22:53:10 2016 us=991837 /usr/bin/ip link set dev tun0 up mtu 1500
Wed Apr 13 22:53:11 2016 us=23502 /usr/bin/ip addr add dev tun0 local 192.168.88.1 peer 192.168.88.2
Wed Apr 13 22:53:11 2016 us=31611 /usr/bin/ip route add 192.168.88.0/24 via 192.168.88.2
Wed Apr 13 22:53:11 2016 us=36078 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:143 ET:0 EL:3 AF:3/1 ]
Wed Apr 13 22:53:11 2016 us=41551 GID set to nobody
Wed Apr 13 22:53:11 2016 us=41668 UID set to nobody
Wed Apr 13 22:53:11 2016 us=41730 UDPv4 link local (bound): [undef]
Wed Apr 13 22:53:11 2016 us=41784 UDPv4 link remote: [undef]
Wed Apr 13 22:53:11 2016 us=41847 MULTI: multi_init called, r=256 v=256
Wed Apr 13 22:53:11 2016 us=41962 IFCONFIG POOL: base=192.168.88.4 size=62, ipv6=0
Wed Apr 13 22:53:11 2016 us=42062 IFCONFIG POOL LIST
Wed Apr 13 22:53:11 2016 us=42199 Initialization Sequence Completed
Wed Apr 13 22:53:13 2016 us=125058 TLS Error: cannot locate HMAC in incoming packet from [AF_INET]89.180.151.187:54074
Wed Apr 13 22:53:14 2016 us=864777 TLS Error: cannot locate HMAC in incoming packet from [AF_INET]89.180.151.187:54074
Wed Apr 13 22:53:19 2016 us=540852 TLS Error: cannot locate HMAC in incoming packet from [AF_INET]89.180.151.187:54074

Traffic

kelsini wroteWed Apr 13 22:53:13 2016 us=125058 TLS Error: cannot locate HMAC in incoming packet from [AF_INET]89.180.151.187:54074

This most probably means that you have corrupted your tls-auth ta.key while importing it to you phone .. or possibly imported the wrong file. Try again. make sure the file is exactly the same.

You may have to use inline config: https://community.openvpn.net/openvpn/wiki/IOSinline

FYI: you do not have to call the file ta.key .. you can rename it to anything more memorable.

[deleted]

Traffic wrote
kelsini wroteWed Apr 13 22:53:13 2016 us=125058 TLS Error: cannot locate HMAC in incoming packet from [AF_INET]89.180.151.187:54074
This most probably means that you have corrupted your tls-auth ta.key while importing it to you phone .. or possibly imported the wrong file. Try again. make sure the file is exactly the same.

You may have to use inline config: https://community.openvpn.net/openvpn/wiki/IOSinline

FYI: you do not have to call the file ta.key .. you can rename it to anything more memorable.

I have 2 folders where keys and certs are...

in /root/easy-rsa/keys/
01.pem dh2048.pem index.txt ipp.txt serial
02.pem homeserver.crt index.txt.attr kelsinni.crt serial.old
ca.crt homeserver.csr index.txt.attr.old kelsinni.csr ta.key
ca.key homeserver.key index.txt.old kelsinni.key

and in /etc/openvpn/certs/
ca.crt dh2048.pem homeserver.key
ca.key homeserver.crt ta.key

The keys that i copied to my android were the client certificate (kelsinni.crt), client certificate key (kelsinni.key) and the CA certificate (ca.crt) all locate on /root/easy-rsa/keys/

The app openvpn for android only asks these 3 files CA certificate, Client certificate and Client certificate key...nothing about ta.key:

Im going to copy again the files to the android...

Traffic

kelsini wroteThe app openvpn for android only asks these 3 files CA certificate, Client certificate and Client certificate key...nothing about ta.key

Then you must disable --tls-auth on the server ..

[deleted]

Traffic wrote
kelsini wroteThe app openvpn for android only asks these 3 files CA certificate, Client certificate and Client certificate key...nothing about ta.key
Then you must disable --tls-auth on the server ..

Well...finally i think i got a sucefull connection 🙂

Thu Apr 14 15:06:34 2016 us=45204 Current Parameter Settings:
Thu Apr 14 15:06:34 2016 us=45471   config = '/etc/openvpn/homeserver-vpn.conf'
Thu Apr 14 15:06:34 2016 us=45567   mode = 1
Thu Apr 14 15:06:34 2016 us=45652   persist_config = DISABLED
Thu Apr 14 15:06:34 2016 us=45732   persist_mode = 1
Thu Apr 14 15:06:34 2016 us=45813   show_ciphers = DISABLED
Thu Apr 14 15:06:34 2016 us=45888   show_digests = DISABLED
Thu Apr 14 15:06:34 2016 us=45958   show_engines = DISABLED
Thu Apr 14 15:06:34 2016 us=46018   genkey = DISABLED
Thu Apr 14 15:06:34 2016 us=46077   key_pass_file = '[UNDEF]'
Thu Apr 14 15:06:34 2016 us=46136   show_tls_ciphers = DISABLED
Thu Apr 14 15:06:34 2016 us=46194 Connection profiles [default]:
Thu Apr 14 15:06:34 2016 us=46253   proto = udp
Thu Apr 14 15:06:34 2016 us=46312   local = '[UNDEF]'
Thu Apr 14 15:06:34 2016 us=46381   local_port = 1194
Thu Apr 14 15:06:34 2016 us=46461   remote = '[UNDEF]'
Thu Apr 14 15:06:34 2016 us=46542   remote_port = 1194
Thu Apr 14 15:06:34 2016 us=46619   remote_float = DISABLED
Thu Apr 14 15:06:34 2016 us=46700   bind_defined = DISABLED
Thu Apr 14 15:06:34 2016 us=46772   bind_local = ENABLED
Thu Apr 14 15:06:34 2016 us=46842 NOTE: --mute triggered...
Thu Apr 14 15:06:34 2016 us=46920 213 variation(s) on previous 20 message(s) suppressed by --mute
Thu Apr 14 15:06:34 2016 us=46980 OpenVPN 2.3.10 i686-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Mar 14 2016
Thu Apr 14 15:06:34 2016 us=47077 library versions: OpenSSL 1.0.2g  1 Mar 2016, LZO 2.09
Thu Apr 14 15:06:34 2016 us=88916 Diffie-Hellman initialized with 2048 bit key
Thu Apr 14 15:06:34 2016 us=100742 TLS-Auth MTU parms [ L:1542 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Thu Apr 14 15:06:34 2016 us=100907 Socket Buffers: R=[163840->163840] S=[163840->163840]
Thu Apr 14 15:06:34 2016 us=101191 ROUTE: default_gateway=UNDEF
Thu Apr 14 15:06:34 2016 us=126690 TUN/TAP device tun0 opened
Thu Apr 14 15:06:34 2016 us=127009 TUN/TAP TX queue length set to 100
Thu Apr 14 15:06:34 2016 us=127125 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Apr 14 15:06:34 2016 us=127237 /usr/bin/ip link set dev tun0 up mtu 1500
Thu Apr 14 15:06:34 2016 us=160313 /usr/bin/ip addr add dev tun0 local 192.168.88.1 peer 192.168.88.2
Thu Apr 14 15:06:34 2016 us=163614 /usr/bin/ip route add 192.168.88.0/24 via 192.168.88.2
Thu Apr 14 15:06:34 2016 us=167431 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:143 ET:0 EL:3 AF:3/1 ]
Thu Apr 14 15:06:34 2016 us=168865 GID set to nobody
Thu Apr 14 15:06:34 2016 us=168975 UID set to nobody
Thu Apr 14 15:06:34 2016 us=169037 UDPv4 link local (bound): [undef]
Thu Apr 14 15:06:34 2016 us=169092 UDPv4 link remote: [undef]
Thu Apr 14 15:06:34 2016 us=169156 MULTI: multi_init called, r=256 v=256
Thu Apr 14 15:06:34 2016 us=169670 IFCONFIG POOL: base=192.168.88.4 size=62, ipv6=0
Thu Apr 14 15:06:34 2016 us=204863 ifconfig_pool_read(), in='kelsinni,192.168.88.4', TODO: IPv6
Thu Apr 14 15:06:34 2016 us=204970 succeeded -> ifconfig_pool_set()
Thu Apr 14 15:06:34 2016 us=205030 IFCONFIG POOL LIST
Thu Apr 14 15:06:34 2016 us=205087 kelsinni,192.168.88.4
Thu Apr 14 15:06:34 2016 us=205223 Initialization Sequence Completed
Thu Apr 14 15:14:04 2016 us=962812 MULTI: multi_create_instance called
Thu Apr 14 15:14:04 2016 us=963100 89.180.149.129:58052 Re-using SSL/TLS context
Thu Apr 14 15:14:04 2016 us=963251 89.180.149.129:58052 LZO compression initialized
Thu Apr 14 15:14:04 2016 us=963656 89.180.149.129:58052 Control Channel MTU parms [ L:1542 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Thu Apr 14 15:14:04 2016 us=963752 89.180.149.129:58052 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:143 ET:0 EL:3 AF:3/1 ]
Thu Apr 14 15:14:04 2016 us=963901 89.180.149.129:58052 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher DES-EDE3-CBC,auth SHA1,keysize 192,key-method 2,tls-server'
Thu Apr 14 15:14:04 2016 us=963965 89.180.149.129:58052 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher DES-EDE3-CBC,auth SHA1,keysize 192,key-method 2,tls-client'
Thu Apr 14 15:14:04 2016 us=964100 89.180.149.129:58052 Local Options hash (VER=V4): '974bef3f'
Thu Apr 14 15:14:04 2016 us=964192 89.180.149.129:58052 Expected Remote Options hash (VER=V4): '827c9ed0'
RThu Apr 14 15:14:04 2016 us=964398 89.180.149.129:58052 TLS: Initial packet from [AF_INET]89.180.149.129:58052, sid=9cc8d214 1064ccf7
WRRWWWRRRWRThu Apr 14 15:14:05 2016 us=454820 89.180.149.129:58052 VERIFY OK: depth=1, C=PT, ST=LX, L=LX, O=SV, OU=MY, CN=HOME, name=SERVER, emailAddress=MYEMAIL
Thu Apr 14 15:14:05 2016 us=457938 89.180.149.129:58052 VERIFY OK: depth=0, C=PT, ST=LX, L=LX, O=SV, OU=MY, CN=kelsinni, name=server, emailAddress=MYEMAIL
WRWRThu Apr 14 15:14:05 2016 us=702731 89.180.149.129:58052 WARNING: 'cipher' is used inconsistently, local='cipher DES-EDE3-CBC', remote='cipher BF-CBC'
Thu Apr 14 15:14:05 2016 us=702866 89.180.149.129:58052 WARNING: 'keysize' is used inconsistently, local='keysize 192', remote='keysize 128'
Thu Apr 14 15:14:05 2016 us=703748 89.180.149.129:58052 Data Channel Encrypt: Cipher 'DES-EDE3-CBC' initialized with 192 bit key
Thu Apr 14 15:14:05 2016 us=703887 89.180.149.129:58052 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Apr 14 15:14:05 2016 us=703971 89.180.149.129:58052 Data Channel Decrypt: Cipher 'DES-EDE3-CBC' initialized with 192 bit key
Thu Apr 14 15:14:05 2016 us=704049 89.180.149.129:58052 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
WRThu Apr 14 15:14:05 2016 us=740252 89.180.149.129:58052 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Thu Apr 14 15:14:05 2016 us=740379 89.180.149.129:58052 [kelsinni] Peer Connection Initiated with [AF_INET]89.180.149.129:58052
Thu Apr 14 15:14:05 2016 us=740488 kelsinni/89.180.149.129:58052 MULTI_sva: pool returned IPv4=192.168.88.6, IPv6=(Not enabled)
Thu Apr 14 15:14:05 2016 us=740672 kelsinni/89.180.149.129:58052 MULTI: Learn: 192.168.88.6 -> kelsinni/89.180.149.129:58052
Thu Apr 14 15:14:05 2016 us=740733 kelsinni/89.180.149.129:58052 MULTI: primary virtual IP for kelsinni/89.180.149.129:58052: 192.168.88.6
RThu Apr 14 15:14:06 2016 us=974533 kelsinni/89.180.149.129:58052 PUSH: Received control message: 'PUSH_REQUEST'
Thu Apr 14 15:14:06 2016 us=974632 kelsinni/89.180.149.129:58052 send_push_reply(): safe_cap=940
Thu Apr 14 15:14:06 2016 us=974906 kelsinni/89.180.149.129:58052 SENT CONTROL [kelsinni]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 192.168.88.0 255.255.255.0,topology net30,ping$
WWR

The problem now its i have no internet access on my cellphone after the connection...i dont know if it has to be with that IP 192.168.88.6 that is showed on the log...because its out of range of my internal LAN IP range (192.168.1.xxx)

Traffic

kelsini wrotefinally i think i got a sucefull connection

kelsini wroteThe problem now its i have no internet access on my cellphone after the connection

You should read this:
HOWTO: Routing all client traffic (including web-traffic) through the VPN

Note: iptables NAT

[deleted]

Traffic wrote
kelsini wrotefinally i think i got a sucefull connection
kelsini wroteThe problem now its i have no internet access on my cellphone after the connection
You should read this:
HOWTO: Routing all client traffic (including web-traffic) through the VPN

Note: iptables NAT

I think i had already did that when the instalation of the openvpn in my Arch Linux...

Below is my server config:
It have already that push "redirect-gateway" line...

port 1194
proto udp
dev tun

ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/homeserver.crt
key /etc/openvpn/certs/homeserver.key
dh /etc/openvpn/certs/dh2048.pem
#tls-auth /etc/openvpn/certs/ta.key 0

server 192.168.88.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

client-to-client
keepalive 1800 4000

cipher DES-EDE3-CBC # Triple-DES
comp-lzo yes

max-clients 2

user nobody
group nobody

persist-key
persist-tun

log /var/log/openvpn.log
#status /var/log/openvpn-status.log
verb 5
mute 20

#client-config-dir ccd

About iptables the commands that i have used were:
iptables -A INPUT -i tun+ -j ACCEPT
iptables -A FORWARD -i tun+ -j ACCEPT
iptables -A INPUT -i tap+ -j ACCEPT
iptables -A FORWARD -i tap+ -j ACCEPT
iptables -t nat -A POSTROUTING -s 192.168.88.0/24 -o enp4s0 -j MASQUERADE

There is any missing line or command that i should place?

Thanks again

[deleted]

I have already compared my configs with that "HOWTO: Routing all client traffic (including web-traffic) through the VPN" and made a few changes to try get internet access but all the times i got no luck...to be honest im now on a dead end and cannot see what should i change to pass this issue 🙁

Any tip would be very grateful...

Thks

Traffic

This looks wrong:

Traffic wroteiptables -t nat -A POSTROUTING -s 192.168.88.0/24 -o enp4s0 -j MASQUERADE

Try: iptables -t nat -A POSTROUTING -s 192.168.88.0/24 -o enp0s4 -j MASQUERADE

If that does not work try this:

iptables -t nat -A POSTROUTING -s 192.168.88.0/24 -j SNAT --to-source 12.34.56.78

replace 12.34.56.78 with the server public IP .. :mrgreen:

[deleted]

Traffic wroteThis looks wrong:
Traffic wroteiptables -t nat -A POSTROUTING -s 192.168.88.0/24 -o enp4s0 -j MASQUERADE
Try: iptables -t nat -A POSTROUTING -s 192.168.88.0/24 -o enp0s4 -j MASQUERADE

If that does not work try this:
iptables -t nat -A POSTROUTING -s 192.168.88.0/24 -j SNAT --to-source 12.34.56.78
replace 12.34.56.78 with the server public IP .. :mrgreen:

First of all thanks once more for your reply...

My wired network device is enp4s0...so i assume that the line that i had (iptables -t nat -A POSTROUTING -s 192.168.88.0/24 -o enp4s0 -j MASQUERADE) was ok...

I tried to insert the rule that you said:
iptables -t nat -A POSTROUTING -s 192.168.88.0/24 -j SNAT --to-source ***.***.***.*** (my home IP)

but unfortunatly despite the connection with the server is established after a couple of seconds...still cannot access the internet with it...🙁