TLS key negotiation failed to occur within 60 seconds (check your network connectivity)

pranay

Hi, All
I am completely newbie in networking stuff.
I have windows and linux machines. One(Windows) is at home and another is in office(Linux ubuntu). Both are on different networks. I want to connect windows machine database from linux machine that’s why I thought to use OpenVpn.
I have installed OpenVpn on both machines and made server to windows machine as well as made client to linux machine. I have created all necessary keys and modified server.opvn file and client.conf file.
Server.opvn file : port 1194
proto udp
dev tun
server 10.8.3.0 255.255.255.0
;push "route 192.168.1.0 255.255.255.0"
;push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
client-to-client Client.conf file: dev tun
proto udp
remote 10.8.3.1 1194
resolv-retry infinite
nobind
user nobody
group nobody
persist-key
persist-tun When we start OpenVpn server on Windows machine. It connects successfully and assign IP 10.8.3.1.Logs of server is as follows:

Tue Jul 19 17:19:34 2016 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Tue Jul 19 17:19:34 2016 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Tue Jul 19 17:19:34 2016 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Tue Jul 19 17:19:34 2016 Diffie-Hellman initialized with 1024 bit key
Tue Jul 19 17:19:34 2016 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue Jul 19 17:19:34 2016 Socket Buffers: R=[8192->8192] S=[8192->8192]
Tue Jul 19 17:19:34 2016 ROUTE default_gateway=192.168.0.1
Tue Jul 19 17:19:34 2016 TAP-WIN32 device [Local Area Connection 15] opened: \\.\Global\{29BBE2D2-E495-4BE5-898B-2B8162396139}.tap
Tue Jul 19 17:19:34 2016 TAP-Win32 Driver Version 9.9 
Tue Jul 19 17:19:34 2016 TAP-Win32 MTU=1500
Tue Jul 19 17:19:34 2016 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.8.3.1/255.255.255.252 on interface {29BBE2D2-E495-4BE5-898B-2B8162396139} [DHCP-serv: 10.8.3.2, lease-time: 31536000]
Tue Jul 19 17:19:34 2016 Sleeping for 10 seconds...
Tue Jul 19 17:19:44 2016 Successful ARP Flush on interface [4] {29BBE2D2-E495-4BE5-898B-2B8162396139}
Tue Jul 19 17:19:44 2016 C:\WINDOWS\system32\route.exe ADD 10.8.3.0 MASK 255.255.255.0 10.8.3.2
Tue Jul 19 17:19:44 2016 Warning: route gateway is not reachable on any active network adapters: 10.8.3.2
Tue Jul 19 17:19:44 2016 Route addition via IPAPI failed [adaptive]
Tue Jul 19 17:19:44 2016 Route addition fallback to route.exe
The route addition failed: Either the interface index is wrong or the gateway does not lie on the same network as the interface. Check the IP Address Table for the machine.
Tue Jul 19 17:19:44 2016 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Jul 19 17:19:44 2016 UDPv4 link local (bound): [undef]:1194
Tue Jul 19 17:19:44 2016 UDPv4 link remote: [undef]
Tue Jul 19 17:19:44 2016 MULTI: multi_init called, r=256 v=256
Tue Jul 19 17:19:44 2016 IFCONFIG POOL: base=10.8.3.4 size=62
Tue Jul 19 17:19:44 2016 IFCONFIG POOL LIST
Tue Jul 19 17:19:44 2016 Initialization Sequence Completed

But when I try to start client on Linux machine using “openvpn client.conf” command. It doesn’t connect and says the below:

Tue Jul 19 17:23:21 2016 OpenVPN 2.3.10 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Feb  2 2016
Tue Jul 19 17:23:21 2016 library versions: OpenSSL 1.0.2g-fips  1 Mar 2016, LZO 2.08
Tue Jul 19 17:23:21 2016 WARNING: file 'raptlinuxclient.key' is group or others accessible
Tue Jul 19 17:23:21 2016 Socket Buffers: R=[212992->212992] S=[212992->212992]
Tue Jul 19 17:23:21 2016 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Tue Jul 19 17:23:21 2016 UDPv4 link local: [undef]
Tue Jul 19 17:23:21 2016 UDPv4 link remote: [AF_INET]10.8.3.1:1194
Tue Jul 19 17:24:21 2016 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Tue Jul 19 17:24:21 2016 TLS Error: TLS handshake failed
Tue Jul 19 17:24:21 2016 SIGUSR1[soft,tls-error] received, process restarting
Tue Jul 19 17:24:21 2016 Restart pause, 2 second(s)
Tue Jul 19 17:24:23 2016 Socket Buffers: R=[212992->212992] S=[212992->212992]
Tue Jul 19 17:24:23 2016 UDPv4 link local: [undef]
Tue Jul 19 17:24:23 2016 UDPv4 link remote: [AF_INET]10.8.3.1:1194

Client is not connecting to server. Checked firewall on both machines and found it disabled on both machines. Please let me know where I am doing wrong.
Any help would be appreciated.
Thanks in advance,
Pranay

TinCanTech

This is wrong in your client config:

pranay wrote

remote 10.8.3.1 1194

You cannot connect to the VPN IP address to establish a VPN .. you must connect to the real IP address of the server.

Also, get your versions up-to-date !!!

pranay

Hi TinCanTech,

Thanks a lot for your response.

We have up to date openvpn version 2.2.3 on both client and server. As per your suggestion we tried to connect using public and private ip of server but no luck. Logs are as follows:

When tried to connect server using private IP address then got the below:

Wed Jul 20 17:12:43 2016 OpenVPN 2.3.10 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Feb 2 2016
Wed Jul 20 17:12:43 2016 library versions: OpenSSL 1.0.2g-fips 1 Mar 2016, LZO 2.08
Wed Jul 20 17:12:43 2016 WARNING: file 'raptlinuxclient.key' is group or others accessible
Wed Jul 20 17:12:43 2016 Socket Buffers: R=[212992->212992] S=[212992->212992]
Wed Jul 20 17:12:43 2016 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Wed Jul 20 17:12:43 2016 UDPv4 link local: [undef]
Wed Jul 20 17:12:43 2016 UDPv4 link remote: [AF_INET]192.168.1.xx:1194
Wed Jul 20 17:13:43 2016 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Wed Jul 20 17:13:43 2016 TLS Error: TLS handshake failed
Wed Jul 20 17:13:43 2016 SIGUSR1[soft,tls-error] received, process restarting
Wed Jul 20 17:13:43 2016 Restart pause, 2 second(s)
Wed Jul 20 17:13:45 2016 Socket Buffers: R=[212992->212992] S=[212992->212992]
Wed Jul 20 17:13:45 2016 UDPv4 link local: [undef]
Wed Jul 20 17:13:45 2016 UDPv4 link remote: [AF_INET]192.168.1.xx:1194
^CWed Jul 20 17:13:51 2016 event_wait : Interrupted system call (code=4)
Wed Jul 20 17:13:51 2016 SIGINT[hard,] received, process exiting

When tried to connect server using Public IP address then got the below:

Wed Jul 20 17:15:58 2016 OpenVPN 2.3.10 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Feb 2 2016
Wed Jul 20 17:15:58 2016 library versions: OpenSSL 1.0.2g-fips 1 Mar 2016, LZO 2.08
Wed Jul 20 17:15:58 2016 WARNING: file 'raptlinuxclient.key' is group or others accessible
Wed Jul 20 17:15:58 2016 Socket Buffers: R=[212992->212992] S=[212992->212992]
Wed Jul 20 17:15:58 2016 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Wed Jul 20 17:15:58 2016 UDPv4 link local: [undef]
Wed Jul 20 17:15:58 2016 UDPv4 link remote: [AF_INET]106.xx.xx.162:1194
Wed Jul 20 17:16:58 2016 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Wed Jul 20 17:16:58 2016 TLS Error: TLS handshake failed
Wed Jul 20 17:16:58 2016 SIGUSR1[soft,tls-error] received, process restarting
Wed Jul 20 17:16:58 2016 Restart pause, 2 second(s)
Wed Jul 20 17:17:00 2016 Socket Buffers: R=[212992->212992] S=[212992->212992]
Wed Jul 20 17:17:00 2016 UDPv4 link local: [undef]
Wed Jul 20 17:17:00 2016 UDPv4 link remote: [AF_INET]106.xxx.xxx.162:1194
^CWed Jul 20 17:17:06 2016 event_wait : Interrupted system call (code=4)
Wed Jul 20 17:17:06 2016 SIGINT[hard,] received, process exiting

In both cases got the same error. Please advise.

Thanks in advance.

TinCanTech

pranay wrote have windows and linux machines. One(Windows) is at home and another is in office(Linux ubuntu). Both are on different networks

pranay wroteWhen tried to connect server using private IP address then got the below:

Wed Jul 20 17:12:43 2016 OpenVPN 2.3.10 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Feb 2 2016
Wed Jul 20 17:12:43 2016 library versions: OpenSSL 1.0.2g-fips 1 Mar 2016, LZO 2.08
<s>
Wed Jul 20 17:12:43 2016 UDPv4 link remote: [AF_INET]192.168.1.xx:1194

Do I have to explain this any further ?

When connecting via your server public IP address ensure you have configured your server firewall/router to accept incoming packets for openvpn.

pranay

Hi TinCanTech,

Thanks again.

Yes please explain as i am newbie and don't have any idea about setting firewall/router.Please let me know how to do that.

You said "When connecting via your server public IP address ensure you have configured your server firewall/router to accept incoming packets for openvpn." so what's the case if we connect via private ip address..do we need to set firewall/router in that case too?

Thanks in advance

TinCanTech

pranay wroteOne(Windows) is at home and another is in office(Linux ubuntu). Both are on different networks.

You cannot connect to your VPN server via its private IP address.

I strongly advise you contact a qualified professional.

My Email: tincanteksup <at> gmail