Cannot connect to OpenVPN after changes in server.conf: TLS handshake failure

lolareN

Hi,

Earlier today, life was good because I could connect to my OpenVPN, just the way I intended. Later, I added two lines in the server.conf file, namely
push "route 10.8.0.1 255.255.255.255"
push "route 10.8.0.0 255.255.255.0" When I was finished with the changes, I executed the following command:

sudo systemctl restart openvpn.service

Now, I cannot connect to the VPN any more. The error that I receive is this:

Thu Nov 17 02:09:43 2016 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Thu Nov 17 02:09:43 2016 TLS Error: TLS handshake failed

Of course, I tried to revert to the old settings in the config-file, but to no avail.

I searched and found http://serverfault.com/questions/709860/fix-tls-error-tls-handshake-failed-on-openvpn-client, but that got me nowhere. I did execute the command

sudo tcpdump -ni eth0 udp and port 1194

and according to that, it seems as if UDP-packages arrive.

When I launch the OpenVPN, I use a .ovpn-file. Below, I will post my server.conf and base.conf, respectively.
Please note that only the un-commented lines are included.
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir ccd
route 192.168.0.0 255.255.255.0
push "route 10.8.0.1 255.255.255.255"
push "route 10.8.0.0 255.255.255.0"
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
client-to-client
push "route 192.168.0.0 255.255.255.0"
keepalive 10 120
tls-auth ta.key 0 # This file is secret
key-direction 0
cipher AES-128-CBC # AES
auth SHA256
comp-lzo
user nobody
group nogroup
persist-key
persist-tun client
dev tun
proto udp
remote MY_IP_ADDRESS 1194
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
remote-cert-tls server
tls-auth ta.key 1
cipher AES-128-CBC
auth SHA256
key-direction 1
comp-lzo
verb 3 Here is also part of the .ovpn-file
client
dev tun
proto udp
remote MY_IP_ADDRESS 1194
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
remote-cert-tls server
tls-auth ta.key 1
cipher AES-128-CBC
auth SHA256
key-direction 1
comp-lzo
verb 3
script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

Here comes the certs... Any help and/or suggestions is very appreciated.

/L

TinCanTech

What is the eth0 IP address of your server and client ?

Please see:
HOWTO: Request Help !

lolareN

Do you mean the address I labeled "MY_IP_ADDRESS" in the base.conf-file above, or do you mean the IP that I should be able to reach while connected to the VPN?

TinCanTech

$ ifconfig eth0 (Server & Client)

Not your public IP address ..

lolareN

When I execute that command (when I've SSHd into the server), I only see the public IP address. If I do it on this computer, where I am running one of the clients, I have to go with the wireless interface, which gives the IP 192.168.1.150.

TinCanTech

Please post your server and client logs at --verb 4 as per this post:
HOWTO: Request Help !

Also, why is your server trying to route 192.168.0.0/24 ?

lolareN

Hrm, I don't understand how I should do that. Am I supposed to edit the config file or is there an actual command that is called --verb 4? If there is, I don't know how to use it.

The reason I route to 192.168.0.0 is because one of my clients have a subnet, and that subnet is 192.168.0.0.

Thanks in advance.

lolareN

Since I'm not able to find/create log files for the server and the client, I can post some of the output from the syslog.
I don't know if it is correct, but I have one line like this in the server.conf and a corresponding one in client.conf

log-append /var/log/server-log

Here goes the output from the syslog:

Nov 18 15:19:28 myvpn-vpn ovpn-server[31974]: Authenticate/Decrypt packet $
Nov 18 15:19:28 myvpn-vpn ovpn-server[31974]: TLS Error: incoming packet a$
Nov 18 15:19:33 myvpn-vpn ovpn-server[31974]: Authenticate/Decrypt packet $
Nov 18 15:19:33 myvpn-vpn ovpn-server[31974]: TLS Error: incoming packet a$
Nov 18 15:19:41 myvpn-vpn ovpn-server[31974]: Authenticate/Decrypt packet $
Nov 18 15:19:41 myvpn-vpn ovpn-server[31974]: TLS Error: incoming packet a$
Nov 18 15:19:49 myvpn-vpn kernel: [666866.668253] [UFW BLOCK] IN=eth0 OUT=$
Nov 18 15:19:57 myvpn-vpn ovpn-server[31974]: Authenticate/Decrypt packet $
Nov 18 15:19:57 myvpn-vpn ovpn-server[31974]: TLS Error: incoming packet a$
Nov 18 15:20:24 myvpn-vpn kernel: [666901.317234] [UFW BLOCK] IN=eth0 OUT=$

TinCanTech

lolareN wrote

Nov 18 15:19:57 myvpn-vpn ovpn-server[31974]: TLS Error: incoming packet a$
Nov 18 15:20:24 myvpn-vpn kernel: [666901.317234] [UFW BLOCK] IN=eth0 OUT=$

UFW .. BLOCK, your firewall ..

lolareN

Okay, so I have now turned off the firewall and rebooted the server, unfortunately there was no difference. Also, I now have some lines added to the server-log, but not the client-log, I have copied the three unique lines in server-log.

Sun Nov 20 03:21:25 2016 us=493926 TLS Error: cannot locate HMAC in incoming packet from [AF_INET]
Sun Nov 20 03:21:27 2016 us=397611 Authenticate/Decrypt packet error: packet HMAC authentication failed
Sun Nov 20 03:21:27 2016 us=397743 TLS Error: incoming packet authentication failed from [AF_INET]

I still cannot believe that all my effort putting in, to make this work, was eradicated by simply adding two lines to a config file and then restart the VPN.

TinCanTech

This suggests you have not used --tls-auth correctly or you have the wrong ta.key on the client.

lolareN

I don't really know what is wrong with the TLS-settings, since they haven't been changed. I might just reset the server tomorrow and start all over again.

By the way, you seem to be knowledgeable about this sort of stuff, so I have a follow-up question on your question regarding routing to 192.168.0.0 (since I don't know if it is correct).

I have one client, lets call it Client A, and another client, Client B. Both Client A and Client B is connected to the server (the server is on the subnet 10.8.0.0 and has internal IP 10.8.0.1). Client B is connected to a network (network 192.168.0.0 with router IP 192.168.0.1), lets call this network Network Q, and has internal IP 192.168.0.60. On Network Q, there are other devices as well, with IP ranging from 192.168.0.50, 192.168.0.51 and so on. How should I setup the routing (both in terms of routing table but also the server.conf) so that I can access, lets say IP 192.168.0.52 from Client A? I can already access Client B from Client A, but I don't seem to be able to reach the other devices.

TinCanTech

Please read:

lolareN

Okay, I've read and done the following changes to my server.conf.

client-config-dir ccd
route 192.168.0.0 255.255.255.0
client-to-client
push "route 192.168.0.0 255.255.255.0"
route 10.8.0.0 255.255.255.252

The file in ccd now looks like this:

iroute 192.168.0.0 255.255.255.0
ifconfig-push 10.8.0.1 10.8.0.2

Also, in the OpenVPN server.conf file, it says that

# Each client will be able to reach the server
# on 10.8.0.1.

I assume that if I type that IP into my web browser, I should get to a "server-page" of some sort. However, I don't get anywhere when I do that.

TinCanTech

Try using ping ..

lolareN

I forgot to mention that, but when I ping 10.8.0.1, i.e. the server, it works fine. But am I not supposed to be able to access some sort of control panel using a browser? I think I've read that somewhere...

lolareN

I thought I'd share the routing table of the client with the LAN.

Routing table client B

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         10.8.0.9        128.0.0.0       UG    0      0        0 tun0
default         192.168.0.1     0.0.0.0         UG    0      0        0 eth0
10.8.0.1        10.8.0.9        255.255.255.255 UGH   0      0        0 tun0
10.8.0.9        *               255.255.255.255 UH    0      0        0 tun0
128.0.0.0       10.8.0.9        128.0.0.0       UG    0      0        0 tun0
MY_VPN_IP		 192.168.0.1     255.255.255.255 UGH   0      0        0 eth0
192.168.0.0     *               255.255.255.0   U     0      0        0 eth0

I cannot say that I'm familiar with interpreting routing tables, so I don't know how it is supposed to look really.