Can't connect to my own PiVPN on college network, other servers are no problem

tuur

Hello, I have a problem connecting to my Raspberry Pi based OpenVPN server (pivpn) on my college's network. However, I can connect to other openvpn servers from vpngate.net. Moreover, it successfully connected one day, but I haven't been able to since. Connecting to my server on a different network (wifi or mobile data) is also no problem. How is this possible? I've already tried changing the ports and protocols to match those of the free servers , but it still doesn't work.

My client configuration:

client
dev tun
proto udp
remote example.noip.me 2325
resolv-retry infinite
nobind
persist-key
persist-tun
key-direction 1
remote-cert-tls server
tls-version-min 1.2
verify-x509-name pivpn name
cipher AES-256-CBC
auth SHA256
comp-lzo
verb 1

Server configuration (left out ca, cert, key and tls-auth blocks):

dev tun
proto udp
port 2532
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/pivpn.crt
key /etc/openvpn/easy-rsa/keys/pivpn.key
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig 10.8.0.1 10.8.0.2
push "route 10.8.0.1 255.255.255.255"
push "route 10.8.0.0 255.255.255.0"
push "route 192.168.1.0 255.255.255.0"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
push "redirect-gateway def1"
client-to-client
duplicate-cn
keepalive 10 120
tls-version-min 1.2
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-256-CBC
auth SHA256
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 1

Logs in the Windows GUI client (also doesn't work on android):

Tue Nov 22 09:33:54 2016 OpenVPN 2.3.13 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Nov  3 2016
Tue Nov 22 09:33:54 2016 Windows version 6.2 (Windows 8 or greater) 64bit
Tue Nov 22 09:33:54 2016 library versions: OpenSSL 1.0.1u  22 Sep 2016, LZO 2.09
Tue Nov 22 09:33:56 2016 Control Channel Authentication: tls-auth using INLINE static key file
Tue Nov 22 09:33:56 2016 UDPv4 link local: [undef]
Tue Nov 22 09:33:56 2016 UDPv4 link remote: [AF_INET]123.123.123.123:2532
Tue Nov 22 09:34:56 2016 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Tue Nov 22 09:34:56 2016 TLS Error: TLS handshake failed
Tue Nov 22 09:34:56 2016 SIGUSR1[soft,tls-error] received, process restarting

TinCanTech

tuur wroteI have a problem connecting to my Raspberry Pi based OpenVPN server (pivpn) on my college's network.

You will do better to contact your college ..

tuur

That's a good idea. Not sure they'll be happy to help though.

TinCanTech

Do you want to hack your friends network instead ?

tuur

I'm afraid I don't understand what you meant by that.

TinCanTech

The details you have so far posted indicate that you do not have access to your friends network.

tuur

Oh, I'm trying to connect to my own network, not a friends. That's what confused me about your post. Anyways, I think I might have already tested this. I installed a webserver on my Raspberry Pi and forwarded the ports. Viewing the webpage from the college network wasn't a problem.

TinCanTech

tuur wroteI'm trying to connect to my own network, not a friends

tuur wroteI have a problem connecting to my Raspberry Pi based OpenVPN server (pivpn) on my college's network

ciao .. :arrow:

tuur

Hello again. I went to the helpdesk as you proposed and found why it's not working. Their enterprise firewall (fortinet) couldn't identify the traffic from server to client as being OpenVPN traffic and thus was being blocked (all unknown communication is blocked). Other servers are getting identified just fine, so I'm guessing it must be a problem with my server configuration, or could it be my router (portforwarding) is messing up the identification process?

TinCanTech

tuur wroteI have a problem connecting to my Raspberry Pi based OpenVPN server (pivpn) on my college's network

tuur wroteConnecting to my server on a different network (wifi or mobile data) is also no problem

tuur wroteI went to the helpdesk as you proposed and found why it's not working. Their enterprise firewall (fortinet) couldn't identify the traffic from server to client as being OpenVPN traffic and thus was being blocked (all unknown communication is blocked)

TinCanTech wroteYou will do better to contact your college

And ask them to allow the data ..

tuur

They said they don't add custom rules for specific ips. And they shouldn't have to. Other connections are identified and allowed just fine. For some reason mine shows up as an unknown application.

TinCanTech

Ask them to give you instructions as to what data they expect.

we cannot read minds on this forum ..

tuur

They probably don't know either. The guy filed a support ticket on the fortinet helpdesk.
Well, thanks for your time. I'll post the solution here if I ever find it, in case future users come across the same problem.

TinCanTech

If the people running you college network don't know what to do then they are not qualified to do their job ..