Trouble with OpenVpn Server Behind Cisco Firewall

orockacha

Please help. Networking newbie.

Here is the status of my setup:

Clients and servers are both running Ubuntu. Server is behind a Cisco ASA firewall. Firewall has IP address of 24.55.108.31, this is also the server’s public IP address. The server’s private IP is 198.25.67.40. The address of the tun0 interface openvpn created on the server is 10.8.0.1. Openvpn is also installed on the client however it has not created tun0. Both the server and client sides are configured to use port 1195. When I start openvpn on the client side, I get this error: "TLS Error: TLS key negotiation failed to occur within 60 seconds"

I googled the error and results suggested a problem with firewall port forwarding however i am having issues with that. On the client side, I have the server address listed as 24.55.108.31 and i have a rule on the firewall that forwards packets received at 24.55.108.31 on port 1195 to address 198.25.67.40 port 1195, but when I start openvpn on the client side, I am still getting the error about TLS key negotiation. I also tried having the firewall forward the packets directly to the tun0 IP address at port 1195 but I don't think the firewall even recognized the address as part of the network. Any ideas???

FalconTent

Is this for OpenVPN Access Server or Community edition ?

The Johan

This does not look like the Access Server product to me, so it's probably the open source version.

Aside from all other known issues related to bad configuration settings, I should point out that I've seen older versions of OpenVPN (even dating back to December 2014) in the repositories for Ubuntu 14, that had trouble with certain TLS settings (TLS 1.1, TLS 1.2 and such). This can be resolved by making sure you get the latest version from community.openvpn.net. So at the very least try running the latest version. And after that, of course, check your configuration again.

FalconTent

orockacha wrote When I start openvpn on the client side, I get this error: "TLS Error: TLS key negotiation failed to occur within 60 seconds"

If that is the only error then you have set up your network wrong ..

orockacha wroteI also tried having the firewall forward the packets directly to the tun0 IP address at port 1195

You did what ? :lol: