VPN from University to Server

balonfx

Hello All!

I'm currently playing with my OpenVPN configuration, and having issues connecting from my University. While I understand that my University will have safeguards for connecting to something like a VPN, randomly if I leave my connection retrying.. it'll automatically connect.

I'm looking for someone more experienced to look at my connection log and let me know if a setting is automatically being triggered to try to 'fix' the issue, and successfully connecting because of such.

I've tried:
Swapping to port 443 (back to 1194 now)
Swapping to TCP instead of UDP. (Worked first connection, now retrying constantly... might've been luck).

Tue Aug 16 19:34:25 2016 MANAGEMENT: >STATE:1471390465,RECONNECTING,tls-error,,
Tue Aug 16 19:34:25 2016 Restart pause, 2 second(s)
Tue Aug 16 19:34:27 2016 Socket Buffers: R=[65536->65536] S=[65536->65536]
Tue Aug 16 19:34:27 2016 UDPv4 link local: [undef]
Tue Aug 16 19:34:27 2016 UDPv4 link remote: [AF_INET]xxx.xx.xx.xx:1194
Tue Aug 16 19:34:27 2016 MANAGEMENT: >STATE:1471390467,WAIT,,,
Tue Aug 16 19:35:27 2016 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Tue Aug 16 19:35:27 2016 TLS Error: TLS handshake failed
Tue Aug 16 19:35:27 2016 SIGUSR1[soft,tls-error] received, process restarting
Tue Aug 16 19:35:27 2016 MANAGEMENT: >STATE:1471390527,RECONNECTING,tls-error,,
Tue Aug 16 19:35:27 2016 Restart pause, 2 second(s)
Tue Aug 16 19:35:29 2016 Socket Buffers: R=[65536->65536] S=[65536->65536]
Tue Aug 16 19:35:29 2016 UDPv4 link local: [undef]
Tue Aug 16 19:35:29 2016 UDPv4 link remote: [AF_INET]xxx.xx.xx.xx:1194
Tue Aug 16 19:35:29 2016 MANAGEMENT: >STATE:1471390529,WAIT,,,
Tue Aug 16 19:36:30 2016 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Tue Aug 16 19:36:30 2016 TLS Error: TLS handshake failed
Tue Aug 16 19:36:30 2016 SIGUSR1[soft,tls-error] received, process restarting
Tue Aug 16 19:36:30 2016 MANAGEMENT: >STATE:1471390590,RECONNECTING,tls-error,,
Tue Aug 16 19:36:30 2016 Restart pause, 2 second(s)
Tue Aug 16 19:36:32 2016 Socket Buffers: R=[65536->65536] S=[65536->65536]
Tue Aug 16 19:36:32 2016 UDPv4 link local: [undef]
Tue Aug 16 19:36:32 2016 UDPv4 link remote: [AF_INET]xxx.xx.xx.xx:1194
Tue Aug 16 19:36:32 2016 MANAGEMENT: >STATE:1471390592,WAIT,,,
Tue Aug 16 19:37:32 2016 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Tue Aug 16 19:37:32 2016 TLS Error: TLS handshake failed
Tue Aug 16 19:37:32 2016 SIGUSR1[soft,tls-error] received, process restarting
Tue Aug 16 19:37:32 2016 MANAGEMENT: >STATE:1471390652,RECONNECTING,tls-error,,
Tue Aug 16 19:37:32 2016 Restart pause, 2 second(s)
Tue Aug 16 19:37:34 2016 Socket Buffers: R=[65536->65536] S=[65536->65536]
Tue Aug 16 19:37:34 2016 UDPv4 link local: [undef]
Tue Aug 16 19:37:34 2016 UDPv4 link remote: [AF_INET]xxx.xx.xx.xx:1194
Tue Aug 16 19:37:34 2016 MANAGEMENT: >STATE:1471390654,WAIT,,,
Tue Aug 16 19:37:48 2016 MANAGEMENT: >STATE:1471390668,AUTH,,,
Tue Aug 16 19:37:48 2016 TLS: Initial packet from [AF_INET]xxx.xx.xx.xx:1194, sid=dc511582 d65568c3
Tue Aug 16 19:37:48 2016 VERIFY OK: INFO INFO INFO INFO INFO 
Tue Aug 16 19:37:48 2016 VERIFY OK: nsCertType=SERVER
Tue Aug 16 19:37:48 2016 VERIFY OK: INFO INFO INFO INFO INFO 
Tue Aug 16 19:37:48 2016 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Aug 16 19:37:48 2016 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Aug 16 19:37:48 2016 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Aug 16 19:37:48 2016 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Aug 16 19:37:48 2016 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Tue Aug 16 19:37:48 2016 [server] Peer Connection Initiated with [AF_INET]xxx.xx.xx.xx:1194
Tue Aug 16 19:37:49 2016 MANAGEMENT: >STATE:1471390669,GET_CONFIG,,,
Tue Aug 16 19:37:50 2016 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Tue Aug 16 19:37:50 2016 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.22 10.8.0.21'
Tue Aug 16 19:37:50 2016 OPTIONS IMPORT: timers and/or timeouts modified
Tue Aug 16 19:37:50 2016 OPTIONS IMPORT: --ifconfig/up options modified
Tue Aug 16 19:37:50 2016 OPTIONS IMPORT: route options modified
Tue Aug 16 19:37:50 2016 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Aug 16 19:37:50 2016 ROUTE_GATEWAY 172.21.250.254/255.255.0.0 I=4 HWADDR=b0:7f:b9:fb:6e:83
Tue Aug 16 19:37:50 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Aug 16 19:37:50 2016 MANAGEMENT: >STATE:1471390670,ASSIGN_IP,,10.8.0.22,
Tue Aug 16 19:37:50 2016 open_tun, tt->ipv6=0
Tue Aug 16 19:37:50 2016 TAP-WIN32 device [Ethernet 2] opened: \\.\Global\{351BC65A-B9E3-4ADA-8499-69E7BC3AAF32}.tap
Tue Aug 16 19:37:50 2016 TAP-Windows Driver Version 9.21 
Tue Aug 16 19:37:50 2016 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.22/255.255.255.252 on interface {351BC65A-B9E3-4ADA-8499-69E7BC3AAF32} [DHCP-serv: 10.8.0.21, lease-time: 31536000]
Tue Aug 16 19:37:50 2016 Successful ARP Flush on interface [6] {351BC65A-B9E3-4ADA-8499-69E7BC3AAF32}
Tue Aug 16 19:37:55 2016 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Tue Aug 16 19:37:55 2016 C:\Windows\system32\route.exe ADD xxx.xx.xx.xx MASK 255.255.255.255 172.21.250.254
Tue Aug 16 19:37:55 2016 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=10 and dwForwardType=4
Tue Aug 16 19:37:55 2016 Route addition via IPAPI succeeded [adaptive]
Tue Aug 16 19:37:55 2016 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.21
Tue Aug 16 19:37:55 2016 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Tue Aug 16 19:37:55 2016 Route addition via IPAPI succeeded [adaptive]
Tue Aug 16 19:37:55 2016 C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.21
Tue Aug 16 19:37:55 2016 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Tue Aug 16 19:37:55 2016 Route addition via IPAPI succeeded [adaptive]
Tue Aug 16 19:37:55 2016 MANAGEMENT: >STATE:1471390675,ADD_ROUTES,,,
Tue Aug 16 19:37:55 2016 C:\Windows\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.21
Tue Aug 16 19:37:55 2016 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Tue Aug 16 19:37:55 2016 Route addition via IPAPI succeeded [adaptive]
Tue Aug 16 19:37:55 2016 Initialization Sequence Completed
Tue Aug 16 19:37:55 2016 MANAGEMENT: >STATE:1471390675,CONNECTED,SUCCESS,10.8.0.22,xxx.xx.xx.xx

Thank you!

TinCanTech

balonfx wroteWhile I understand that my University will have safeguards for connecting to something like a VPN

and you do not know what measures are in place ..

The simple and most logical course of action is to ask if you can have permission from your University Network admin.

balonfx

TinCanTech wrote
balonfx wroteWhile I understand that my University will have safeguards for connecting to something like a VPN
and you do not know what measures are in place ..

The simple and most logical course of action is to ask if you can have permission from your University Network admin.

I sent in an email. I do know some of the measures as I work for the IT department. To my understanding VPNs aren't really not allowed, though because of the strict firewall, etc some settings would need to be tweaked. I didn't mean to imply they aren't allowed in my original post.

TinCanTech

balonfx wroteI sent in an email

Good plan.

balonfx wroteI didn't mean to imply they aren't allowed in my original post

It is that the problems you describe could easily be adaptive security ..

balonfx

So my boss is the Networking Director, said it was ok.

I'll send the log over to him as well. However, from a glimpse, does anything automatically reconfigure to allow me to log in? He's going to look, he told me to compare from our shop tomorrow so I have to bring my laptop.

TinCanTech

balonfx wroteSo my boss is the Networking Director, said it was ok

Good news.

TinCanTech wroteI'm looking for someone more experienced to look at my connection log and let me know if a setting is automatically being triggered to try to 'fix' the issue

See my other posts .. and also check the rules at the top of the page 8-)