Having trouble setting up the OVPN on my raspberry PI three. Tried to use PIVPN ( http://www.pivpn.io/#install ) and it all looks fine but I keep getting the TLS error. Have all the ports forwarded and everything. Sort of lost now though. Server.conf [code]dev tun proto udp port 1194 ca /etc/openvpn/easy-rsa/keys/ca.crt cert /etc/openvpn/easy-rsa/keys/server.crt key /etc/openvpn/easy-rsa/keys/server.key dh /etc/openvpn/easy-rsa/keys/dh2048.pem server 10.8.0.0 255.255.255.0 # server and remote endpoints ifconfig 10.8.0.1 10.8.0.2 # Add route to Client routing table for the OpenVPN Server push "route 10.8.0.1 255.255.255.255" # Add route to Client routing table for the OPenVPN Subnet push "route 10.8.0.0 255.255.255.0" # your local subnet push "route 192.168.0.29 255.255.255.0" # Set your primary domain name server address for clients push "dhcp-option DNS 8.8.8.8" push "dhcp-option DNS 8.8.4.4" # Override the Client default gateway by using 0.0.0.0/1 and # 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of # overriding but not wiping out the original default gateway. push "redirect-gateway def1" client-to-client duplicate-cn keepalive 10 120 tls-version-min 1.2 tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0 cipher AES-256-CBC auth SHA256 comp-lzo user nobody group nogroup persist-key persist-tun #crl-verify /etc/openvpn/crl.pem status /var/log/openvpn-status.log 20 log /var/log/openvpn.log verb 1 [/code] Client ovpn file [code]client dev tun proto udp remote ***.**.**.*** 1194 resolv-retry infinite nobind persist-key persist-tun key-direction 1 remote-cert-tls server tls-version-min 1.2 verify-x509-name server name cipher AES-256-CBC auth SHA256 comp-lzo verb 1 [/code] Var/Log file [code]Wed Jun 29 13:42:33 2016 OpenVPN 2.3.11 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on May 10 2016 Wed Jun 29 13:42:33 2016 Windows version 6.1 (Windows 7) 64bit Wed Jun 29 13:42:33 2016 library versions: OpenSSL 1.0.1t 3 May 2016, LZO 2.09 Enter Management Password: Wed Jun 29 13:42:40 2016 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this Wed Jun 29 13:42:40 2016 SIGUSR1[soft,private-key-password-failure] received, process restarting Wed Jun 29 13:42:44 2016 Control Channel Authentication: tls-auth using INLINE static key file Wed Jun 29 13:42:44 2016 UDPv4 link local: [undef] Wed Jun 29 13:42:44 2016 UDPv4 link remote: [AF_INET]***.**.***.***:1194 Wed Jun 29 13:43:44 2016 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) Wed Jun 29 13:43:44 2016 TLS Error: TLS handshake failed Wed Jun 29 13:43:44 2016 SIGUSR1[soft,tls-error] received, process restarting Wed Jun 29 13:43:46 2016 UDPv4 link local: [undef] Wed Jun 29 13:43:46 2016 UDPv4 link remote: [AF_INET]***.**.***.***:1194 Wed Jun 29 13:44:11 2016 SIGTERM[hard,] received, process exiting[/code]

[quote="Crash"]TLS Error: TLS key negotiation failed to occur within 60 seconds ([b]check your network connectivity[/b])[/quote]This message almost [u]always[/u] means that your client cannot send packets to your server. Try running [b]tcpdump[/b] on your server to see if packets actually arrive to it.

TLS Error

Crash

Having trouble setting up the OVPN on my raspberry PI three. Tried to use PIVPN ( http://www.pivpn.io/#install ) and it all looks fine but I keep getting the TLS error. Have all the ports forwarded and everything. Sort of lost now though.

Server.conf

dev tun
proto udp
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
server 10.8.0.0 255.255.255.0
# server and remote endpoints
ifconfig 10.8.0.1 10.8.0.2
# Add route to Client routing table for the OpenVPN Server
push "route 10.8.0.1 255.255.255.255"
# Add route to Client routing table for the OPenVPN Subnet
push "route 10.8.0.0 255.255.255.0"
# your local subnet
push "route 192.168.0.29 255.255.255.0"
# Set your primary domain name server address for clients
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
client-to-client
duplicate-cn
keepalive 10 120
tls-version-min 1.2
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-256-CBC
auth SHA256
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
#crl-verify /etc/openvpn/crl.pem
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 1

Client ovpn file

client
dev tun
proto udp
remote ***.**.**.*** 1194
resolv-retry infinite
nobind
persist-key
persist-tun
key-direction 1
remote-cert-tls server
tls-version-min 1.2
verify-x509-name server name
cipher AES-256-CBC
auth SHA256
comp-lzo
verb 1
<ca>

Var/Log file

Wed Jun 29 13:42:33 2016 OpenVPN 2.3.11 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on May 10 2016
Wed Jun 29 13:42:33 2016 Windows version 6.1 (Windows 7) 64bit
Wed Jun 29 13:42:33 2016 library versions: OpenSSL 1.0.1t  3 May 2016, LZO 2.09
Enter Management Password:
Wed Jun 29 13:42:40 2016 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Wed Jun 29 13:42:40 2016 SIGUSR1[soft,private-key-password-failure] received, process restarting
Wed Jun 29 13:42:44 2016 Control Channel Authentication: tls-auth using INLINE static key file
Wed Jun 29 13:42:44 2016 UDPv4 link local: [undef]
Wed Jun 29 13:42:44 2016 UDPv4 link remote: [AF_INET]***.**.***.***:1194
Wed Jun 29 13:43:44 2016 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Wed Jun 29 13:43:44 2016 TLS Error: TLS handshake failed
Wed Jun 29 13:43:44 2016 SIGUSR1[soft,tls-error] received, process restarting
Wed Jun 29 13:43:46 2016 UDPv4 link local: [undef]
Wed Jun 29 13:43:46 2016 UDPv4 link remote: [AF_INET]***.**.***.***:1194
Wed Jun 29 13:44:11 2016 SIGTERM[hard,] received, process exiting

TinCanTech

Have you opened and forwarded port UDP:1194 on your server router and firewall ?

Crash

Yes. Forwarded on the router and created the rule to allow incoming and outgoing connections for OpenVPN or port 1194 in ESET Smart Security (firewall)
Thanks for the quick reply btw

TinCanTech

Crash wroteTLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)

This message almost always means that your client cannot send packets to your server.

Try running tcpdump on your server to see if packets actually arrive to it.

Crash

No, it doesn't look like they're getting there. The PI has integrated WIFI though which is connected to the same network as the Ethernet cable is hooked up to. The client computer is connected to a separate network through WIFI. I had issues in the past being on the same network as I discovered that my ISP wouldn't allow my client to connect to the server when they were on the same network. Although I set up my PI to use the eth0 interface, should I disable the WIFI?