TLS Error (Synology)

Tobbe

I tried setting up VPN on my synology using this guide https://forum.synology.com/enu/viewtopic.php?f=173&t=100066.

Here is my client config:
client
dev tun

proto udp

# Change <your-ip-or-hostname> to your IP or hostname

remote 8x.xxx.xxx.xx 1194

resolv-retry infinite

nobind

persist-key

persist-tun

ns-cert-type server

comp-lzo

auth-user-pass
key-direction 1
cert username.crt
key username.key
verb 4

<ca> some code </ca> <tls-auth>some code</tls-auth> I have username.key och username.crt and ca.crt in my PC Windows openvpn config directory.
push "route 192.168.1.0 255.255.255.0" #don't know why this line is automatically added when I enable VPN on synology and try to connect
push "route 10.8.0.0 255.255.255.0"

dev tun

management 127.0.0.1 1195

server 10.8.0.0 255.255.255.0

# The backup task will include this location
dh /usr/syno/etc/packages/VPNCenter/openvpn/mykeys/dh2048.pem
ca /usr/syno/etc/packages/VPNCenter/openvpn/mykeys/ca.crt
cert /usr/syno/etc/packages/VPNCenter/openvpn/mykeys/server.crt
key /usr/syno/etc/packages/VPNCenter/openvpn/mykeys/server.key
tls-auth /usr/syno/etc/packages/VPNCenter/openvpn/mykeys/ta.key 0

max-clients 5

comp-lzo

persist-tun
persist-key
verb 4

# Don't forget logrotate script
log-append /var/log/openvpn.log

keepalive 10 60
reneg-sec 0

plugin /var/packages/VPNCenter/target/lib/radiusplugin.so /var/packages/VPNCenter/target/etc/openvpn/radiusplugin.cnf

# KEEP THIS DISABLED
#client-cert-not-required
username-as-common-name
duplicate-cn

status /tmp/ovpn_status_2_result 30
status-version 2
proto udp6 Server log (verb 4)

Sun Jan 29 10:05:19 2017 us=815439 MULTI: multi_create_instance called
Sun Jan 29 10:05:19 2017 us=815631 ::ffff:192.168.1.1(61517) Re-using SSL/TLS context
Sun Jan 29 10:05:19 2017 us=815703 ::ffff:192.168.1.1(61517) LZO compression initialized
Sun Jan 29 10:05:19 2017 us=815937 ::ffff:192.168.1.1(61517) Control Channel MTU parms [ L:1542 D:1184 EF:66 EB:0 ET:0 EL:3 ]
Sun Jan 29 10:05:19 2017 us=816018 ::ffff:192.168.1.1(61517) Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:143 ET:0 EL:3 AF:3/1 ]
Sun Jan 29 10:05:19 2017 us=816125 ::ffff:192.168.1.1(61517) Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Sun Jan 29 10:05:19 2017 us=816177 ::ffff:192.168.1.1(61517) Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Sun Jan 29 10:05:19 2017 us=816260 ::ffff:192.168.1.1(61517) Local Options hash (VER=V4): '14168603'
Sun Jan 29 10:05:19 2017 us=816336 ::ffff:192.168.1.1(61517) Expected Remote Options hash (VER=V4): '504e774e'
Sun Jan 29 10:05:19 2017 us=816465 ::ffff:192.168.1.1(61517) TLS: Initial packet from [AF_INET6]::ffff:192.168.1.1:61517, sid=45357ffb 4fb8b303
Sun Jan 29 10:06:19 2017 us=441257 ::ffff:192.168.1.1(61517) TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sun Jan 29 10:06:19 2017 us=446936 ::ffff:192.168.1.1(61517) SYNO_ERR_CERT
Sun Jan 29 10:06:19 2017 us=447099 ::ffff:192.168.1.1(61517) TLS Error: TLS handshake failed
Sun Jan 29 10:06:19 2017 us=447447 ::ffff:192.168.1.1(61517) SIGUSR1[soft,tls-error] received, client-instance restarting
Sun Jan 29 10:06:25 2017 us=15262 MULTI: multi_create_instance called
Sun Jan 29 10:06:25 2017 us=15476 ::ffff:192.168.1.1(54992) Re-using SSL/TLS context
Sun Jan 29 10:06:25 2017 us=15538 ::ffff:192.168.1.1(54992) LZO compression initialized
Sun Jan 29 10:06:25 2017 us=15811 ::ffff:192.168.1.1(54992) Control Channel MTU parms [ L:1542 D:1184 EF:66 EB:0 ET:0 EL:3 ]
Sun Jan 29 10:06:25 2017 us=15892 ::ffff:192.168.1.1(54992) Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:143 ET:0 EL:3 AF:3/1 ]
Sun Jan 29 10:06:25 2017 us=16033 ::ffff:192.168.1.1(54992) Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Sun Jan 29 10:06:25 2017 us=16089 ::ffff:192.168.1.1(54992) Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Sun Jan 29 10:06:25 2017 us=16171 ::ffff:192.168.1.1(54992) Local Options hash (VER=V4): '14168603'
Sun Jan 29 10:06:25 2017 us=16245 ::ffff:192.168.1.1(54992) Expected Remote Options hash (VER=V4): '504e774e'
Sun Jan 29 10:06:25 2017 us=16402 ::ffff:192.168.1.1(54992) TLS: Initial packet from [AF_INET6]::ffff:192.168.1.1:54992, sid=da22e2c5 6913e416
Sun Jan 29 10:07:25 2017 us=836769 ::ffff:192.168.1.1(54992) TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sun Jan 29 10:07:25 2017 us=841526 ::ffff:192.168.1.1(54992) SYNO_ERR_CERT
Sun Jan 29 10:07:25 2017 us=841664 ::ffff:192.168.1.1(54992) TLS Error: TLS handshake failed
Sun Jan 29 10:07:25 2017 us=842156 ::ffff:192.168.1.1(54992) SIGUSR1[soft,tls-error] received, client-instance restarting
Sun Jan 29 10:07:30 2017 us=141431 MULTI: multi_create_instance called
Sun Jan 29 10:07:30 2017 us=141620 ::ffff:192.168.1.1(50461) Re-using SSL/TLS context
Sun Jan 29 10:07:30 2017 us=141681 ::ffff:192.168.1.1(50461) LZO compression initialized
Sun Jan 29 10:07:30 2017 us=141878 ::ffff:192.168.1.1(50461) Control Channel MTU parms [ L:1542 D:1184 EF:66 EB:0 ET:0 EL:3 ]
Sun Jan 29 10:07:30 2017 us=141954 ::ffff:192.168.1.1(50461) Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:143 ET:0 EL:3 AF:3/1 ]
Sun Jan 29 10:07:30 2017 us=142065 ::ffff:192.168.1.1(50461) Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Sun Jan 29 10:07:30 2017 us=142117 ::ffff:192.168.1.1(50461) Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Sun Jan 29 10:07:30 2017 us=142200 ::ffff:192.168.1.1(50461) Local Options hash (VER=V4): '14168603'
Sun Jan 29 10:07:30 2017 us=142276 ::ffff:192.168.1.1(50461) Expected Remote Options hash (VER=V4): '504e774e'
Sun Jan 29 10:07:30 2017 us=142397 ::ffff:192.168.1.1(50461) TLS: Initial packet from [AF_INET6]::ffff:192.168.1.1:50461, sid=881fcf91 48ee2144

CLIENT LOG (--verb 4):

Sun Jan 29 10:05:08 2017 us=571744 Current Parameter Settings:
Sun Jan 29 10:05:08 2017 us=571744   config = 'my-server.ovpn'
Sun Jan 29 10:05:08 2017 us=571744   mode = 0
Sun Jan 29 10:05:08 2017 us=571744   show_ciphers = DISABLED
Sun Jan 29 10:05:08 2017 us=571744   show_digests = DISABLED
Sun Jan 29 10:05:08 2017 us=571744   show_engines = DISABLED
Sun Jan 29 10:05:08 2017 us=571744   genkey = DISABLED
Sun Jan 29 10:05:08 2017 us=571744   key_pass_file = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=571744   show_tls_ciphers = DISABLED
Sun Jan 29 10:05:08 2017 us=571744   connect_retry_max = 0
Sun Jan 29 10:05:08 2017 us=571744 Connection profiles [0]:
Sun Jan 29 10:05:08 2017 us=571744   proto = udp
Sun Jan 29 10:05:08 2017 us=571744   local = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=571744   local_port = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=571744   remote = '8x.xxx.xxx.xx'
Sun Jan 29 10:05:08 2017 us=571744   remote_port = '1194'
Sun Jan 29 10:05:08 2017 us=571744   remote_float = DISABLED
Sun Jan 29 10:05:08 2017 us=571744   bind_defined = DISABLED
Sun Jan 29 10:05:08 2017 us=571744   bind_local = DISABLED
Sun Jan 29 10:05:08 2017 us=571744   bind_ipv6_only = DISABLED
Sun Jan 29 10:05:08 2017 us=571744   connect_retry_seconds = 5
Sun Jan 29 10:05:08 2017 us=571744   connect_timeout = 120
Sun Jan 29 10:05:08 2017 us=571744   socks_proxy_server = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=571744   socks_proxy_port = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=571744   tun_mtu = 1500
Sun Jan 29 10:05:08 2017 us=571744   tun_mtu_defined = ENABLED
Sun Jan 29 10:05:08 2017 us=571744   link_mtu = 1500
Sun Jan 29 10:05:08 2017 us=571744   link_mtu_defined = DISABLED
Sun Jan 29 10:05:08 2017 us=571744   tun_mtu_extra = 0
Sun Jan 29 10:05:08 2017 us=571744   tun_mtu_extra_defined = DISABLED
Sun Jan 29 10:05:08 2017 us=571744   mtu_discover_type = -1
Sun Jan 29 10:05:08 2017 us=571744   fragment = 0
Sun Jan 29 10:05:08 2017 us=571744   mssfix = 1450
Sun Jan 29 10:05:08 2017 us=571744   explicit_exit_notification = 0
Sun Jan 29 10:05:08 2017 us=571744 Connection profiles END
Sun Jan 29 10:05:08 2017 us=571744   remote_random = DISABLED
Sun Jan 29 10:05:08 2017 us=571744   ipchange = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=571744   dev = 'tun'
Sun Jan 29 10:05:08 2017 us=571744   dev_type = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=571744   dev_node = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=571744   lladdr = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=571744   topology = 1
Sun Jan 29 10:05:08 2017 us=571744   ifconfig_local = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=571744   ifconfig_remote_netmask = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=571744   ifconfig_noexec = DISABLED
Sun Jan 29 10:05:08 2017 us=571744   ifconfig_nowarn = DISABLED
Sun Jan 29 10:05:08 2017 us=571744   ifconfig_ipv6_local = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=571744   ifconfig_ipv6_netbits = 0
Sun Jan 29 10:05:08 2017 us=571744   ifconfig_ipv6_remote = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=571744   shaper = 0
Sun Jan 29 10:05:08 2017 us=571744   mtu_test = 0
Sun Jan 29 10:05:08 2017 us=571744   mlock = DISABLED
Sun Jan 29 10:05:08 2017 us=571744   keepalive_ping = 0
Sun Jan 29 10:05:08 2017 us=571744   keepalive_timeout = 0
Sun Jan 29 10:05:08 2017 us=571744   inactivity_timeout = 0
Sun Jan 29 10:05:08 2017 us=571744   ping_send_timeout = 0
Sun Jan 29 10:05:08 2017 us=571744   ping_rec_timeout = 0
Sun Jan 29 10:05:08 2017 us=571744   ping_rec_timeout_action = 0
Sun Jan 29 10:05:08 2017 us=571744   ping_timer_remote = DISABLED
Sun Jan 29 10:05:08 2017 us=571744   remap_sigusr1 = 0
Sun Jan 29 10:05:08 2017 us=571744   persist_tun = ENABLED
Sun Jan 29 10:05:08 2017 us=571744   persist_local_ip = DISABLED
Sun Jan 29 10:05:08 2017 us=571744   persist_remote_ip = DISABLED
Sun Jan 29 10:05:08 2017 us=571744   persist_key = ENABLED
Sun Jan 29 10:05:08 2017 us=571744   passtos = DISABLED
Sun Jan 29 10:05:08 2017 us=571744   resolve_retry_seconds = 1000000000
Sun Jan 29 10:05:08 2017 us=571744   resolve_in_advance = DISABLED
Sun Jan 29 10:05:08 2017 us=571744   username = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=571744   groupname = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=571744   chroot_dir = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=571744   cd_dir = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=571744   writepid = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=571744   up_script = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=571744   down_script = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=572745   down_pre = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   up_restart = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   up_delay = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   daemon = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   inetd = 0
Sun Jan 29 10:05:08 2017 us=572745   log = ENABLED
Sun Jan 29 10:05:08 2017 us=572745   suppress_timestamps = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   machine_readable_output = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   nice = 0
Sun Jan 29 10:05:08 2017 us=572745   verbosity = 4
Sun Jan 29 10:05:08 2017 us=572745   mute = 0
Sun Jan 29 10:05:08 2017 us=572745   gremlin = 0
Sun Jan 29 10:05:08 2017 us=572745   status_file = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=572745   status_file_version = 1
Sun Jan 29 10:05:08 2017 us=572745   status_file_update_freq = 60
Sun Jan 29 10:05:08 2017 us=572745   occ = ENABLED
Sun Jan 29 10:05:08 2017 us=572745   rcvbuf = 0
Sun Jan 29 10:05:08 2017 us=572745   sndbuf = 0
Sun Jan 29 10:05:08 2017 us=572745   sockflags = 0
Sun Jan 29 10:05:08 2017 us=572745   fast_io = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   comp.alg = 2
Sun Jan 29 10:05:08 2017 us=572745   comp.flags = 1
Sun Jan 29 10:05:08 2017 us=572745   route_script = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=572745   route_default_gateway = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=572745   route_default_metric = 0
Sun Jan 29 10:05:08 2017 us=572745   route_noexec = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   route_delay = 5
Sun Jan 29 10:05:08 2017 us=572745   route_delay_window = 30
Sun Jan 29 10:05:08 2017 us=572745   route_delay_defined = ENABLED
Sun Jan 29 10:05:08 2017 us=572745   route_nopull = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   route_gateway_via_dhcp = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   allow_pull_fqdn = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   management_addr = '127.0.0.1'
Sun Jan 29 10:05:08 2017 us=572745   management_port = '25340'
Sun Jan 29 10:05:08 2017 us=572745   management_user_pass = 'stdin'
Sun Jan 29 10:05:08 2017 us=572745   management_log_history_cache = 250
Sun Jan 29 10:05:08 2017 us=572745   management_echo_buffer_size = 100
Sun Jan 29 10:05:08 2017 us=572745   management_write_peer_info_file = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=572745   management_client_user = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=572745   management_client_group = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=572745   management_flags = 6
Sun Jan 29 10:05:08 2017 us=572745   shared_secret_file = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=572745   key_direction = 2
Sun Jan 29 10:05:08 2017 us=572745   ciphername = 'BF-CBC'
Sun Jan 29 10:05:08 2017 us=572745   ncp_enabled = ENABLED
Sun Jan 29 10:05:08 2017 us=572745   ncp_ciphers = 'AES-256-GCM:AES-128-GCM'
Sun Jan 29 10:05:08 2017 us=572745   authname = 'SHA1'
Sun Jan 29 10:05:08 2017 us=572745   prng_hash = 'SHA1'
Sun Jan 29 10:05:08 2017 us=572745   prng_nonce_secret_len = 16
Sun Jan 29 10:05:08 2017 us=572745   keysize = 0
Sun Jan 29 10:05:08 2017 us=572745   engine = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   replay = ENABLED
Sun Jan 29 10:05:08 2017 us=572745   mute_replay_warnings = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   replay_window = 64
Sun Jan 29 10:05:08 2017 us=572745   replay_time = 15
Sun Jan 29 10:05:08 2017 us=572745   packet_id_file = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=572745   use_iv = ENABLED
Sun Jan 29 10:05:08 2017 us=572745   test_crypto = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   tls_server = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   tls_client = ENABLED
Sun Jan 29 10:05:08 2017 us=572745   key_method = 2
Sun Jan 29 10:05:08 2017 us=572745   ca_file = '[[INLINE]]'
Sun Jan 29 10:05:08 2017 us=572745   ca_path = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=572745   dh_file = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=572745   cert_file = 'client.crt'
Sun Jan 29 10:05:08 2017 us=572745   extra_certs_file = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=572745   priv_key_file = 'client.key'
Sun Jan 29 10:05:08 2017 us=572745   pkcs12_file = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=572745   cryptoapi_cert = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=572745   cipher_list = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=572745   tls_verify = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=572745   tls_export_cert = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=572745   verify_x509_type = 0
Sun Jan 29 10:05:08 2017 us=572745   verify_x509_name = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=572745   crl_file = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=572745   ns_cert_type = 1
Sun Jan 29 10:05:08 2017 us=572745   remote_cert_ku[i] = 0
Sun Jan 29 10:05:08 2017 us=572745   remote_cert_ku[i] = 0
Sun Jan 29 10:05:08 2017 us=572745   remote_cert_ku[i] = 0
Sun Jan 29 10:05:08 2017 us=572745   remote_cert_ku[i] = 0
Sun Jan 29 10:05:08 2017 us=572745   remote_cert_ku[i] = 0
Sun Jan 29 10:05:08 2017 us=572745   remote_cert_ku[i] = 0
Sun Jan 29 10:05:08 2017 us=572745   remote_cert_ku[i] = 0
Sun Jan 29 10:05:08 2017 us=572745   remote_cert_ku[i] = 0
Sun Jan 29 10:05:08 2017 us=572745   remote_cert_ku[i] = 0
Sun Jan 29 10:05:08 2017 us=572745   remote_cert_ku[i] = 0
Sun Jan 29 10:05:08 2017 us=572745   remote_cert_ku[i] = 0
Sun Jan 29 10:05:08 2017 us=572745   remote_cert_ku[i] = 0
Sun Jan 29 10:05:08 2017 us=572745   remote_cert_ku[i] = 0
Sun Jan 29 10:05:08 2017 us=572745   remote_cert_ku[i] = 0
Sun Jan 29 10:05:08 2017 us=572745   remote_cert_ku[i] = 0
Sun Jan 29 10:05:08 2017 us=572745   remote_cert_ku[i] = 0
Sun Jan 29 10:05:08 2017 us=572745   remote_cert_eku = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=572745   ssl_flags = 0
Sun Jan 29 10:05:08 2017 us=572745   tls_timeout = 2
Sun Jan 29 10:05:08 2017 us=572745   renegotiate_bytes = -1
Sun Jan 29 10:05:08 2017 us=572745   renegotiate_packets = 0
Sun Jan 29 10:05:08 2017 us=572745   renegotiate_seconds = 3600
Sun Jan 29 10:05:08 2017 us=572745   handshake_window = 60
Sun Jan 29 10:05:08 2017 us=572745   transition_window = 3600
Sun Jan 29 10:05:08 2017 us=572745   single_session = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   push_peer_info = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   tls_exit = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   tls_auth_file = '[[INLINE]]'
Sun Jan 29 10:05:08 2017 us=572745   tls_crypt_file = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_protected_authentication = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_protected_authentication = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_protected_authentication = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_protected_authentication = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_protected_authentication = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_protected_authentication = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_protected_authentication = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_protected_authentication = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_protected_authentication = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_protected_authentication = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_protected_authentication = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_protected_authentication = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_protected_authentication = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_protected_authentication = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_protected_authentication = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_protected_authentication = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_private_mode = 00000000
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_private_mode = 00000000
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_private_mode = 00000000
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_private_mode = 00000000
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_private_mode = 00000000
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_private_mode = 00000000
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_private_mode = 00000000
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_private_mode = 00000000
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_private_mode = 00000000
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_private_mode = 00000000
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_private_mode = 00000000
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_private_mode = 00000000
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_private_mode = 00000000
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_private_mode = 00000000
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_private_mode = 00000000
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_private_mode = 00000000
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_cert_private = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_cert_private = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_cert_private = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_cert_private = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_cert_private = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_cert_private = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_cert_private = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_cert_private = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_cert_private = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_cert_private = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_cert_private = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_cert_private = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_cert_private = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_cert_private = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_cert_private = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_cert_private = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_pin_cache_period = -1
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_id = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=572745   pkcs11_id_management = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   server_network = 0.0.0.0
Sun Jan 29 10:05:08 2017 us=572745   server_netmask = 0.0.0.0
Sun Jan 29 10:05:08 2017 us=572745   server_network_ipv6 = ::
Sun Jan 29 10:05:08 2017 us=572745   server_netbits_ipv6 = 0
Sun Jan 29 10:05:08 2017 us=572745   server_bridge_ip = 0.0.0.0
Sun Jan 29 10:05:08 2017 us=572745   server_bridge_netmask = 0.0.0.0
Sun Jan 29 10:05:08 2017 us=572745   server_bridge_pool_start = 0.0.0.0
Sun Jan 29 10:05:08 2017 us=572745   server_bridge_pool_end = 0.0.0.0
Sun Jan 29 10:05:08 2017 us=572745   ifconfig_pool_defined = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   ifconfig_pool_start = 0.0.0.0
Sun Jan 29 10:05:08 2017 us=572745   ifconfig_pool_end = 0.0.0.0
Sun Jan 29 10:05:08 2017 us=572745   ifconfig_pool_netmask = 0.0.0.0
Sun Jan 29 10:05:08 2017 us=572745   ifconfig_pool_persist_filename = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=572745   ifconfig_pool_persist_refresh_freq = 600
Sun Jan 29 10:05:08 2017 us=572745   ifconfig_ipv6_pool_defined = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   ifconfig_ipv6_pool_base = ::
Sun Jan 29 10:05:08 2017 us=572745   ifconfig_ipv6_pool_netbits = 0
Sun Jan 29 10:05:08 2017 us=572745   n_bcast_buf = 256
Sun Jan 29 10:05:08 2017 us=572745   tcp_queue_limit = 64
Sun Jan 29 10:05:08 2017 us=572745   real_hash_size = 256
Sun Jan 29 10:05:08 2017 us=572745   virtual_hash_size = 256
Sun Jan 29 10:05:08 2017 us=572745   client_connect_script = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=572745   learn_address_script = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=572745   client_disconnect_script = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=572745   client_config_dir = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=572745   ccd_exclusive = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   tmp_dir = 'C:\Users\username\AppData\Local\Temp\'
Sun Jan 29 10:05:08 2017 us=572745   push_ifconfig_defined = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   push_ifconfig_local = 0.0.0.0
Sun Jan 29 10:05:08 2017 us=572745   push_ifconfig_remote_netmask = 0.0.0.0
Sun Jan 29 10:05:08 2017 us=572745   push_ifconfig_ipv6_defined = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   push_ifconfig_ipv6_local = ::/0
Sun Jan 29 10:05:08 2017 us=572745   push_ifconfig_ipv6_remote = ::
Sun Jan 29 10:05:08 2017 us=572745   enable_c2c = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   duplicate_cn = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   cf_max = 0
Sun Jan 29 10:05:08 2017 us=572745   cf_per = 0
Sun Jan 29 10:05:08 2017 us=572745   max_clients = 1024
Sun Jan 29 10:05:08 2017 us=572745   max_routes_per_client = 256
Sun Jan 29 10:05:08 2017 us=572745   auth_user_pass_verify_script = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=572745   auth_user_pass_verify_script_via_file = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   auth_token_generate = DISABLED
Sun Jan 29 10:05:08 2017 us=572745   auth_token_lifetime = 0
Sun Jan 29 10:05:08 2017 us=572745   client = ENABLED
Sun Jan 29 10:05:08 2017 us=572745   pull = ENABLED
Sun Jan 29 10:05:08 2017 us=572745   auth_user_pass_file = 'stdin'
Sun Jan 29 10:05:08 2017 us=572745   show_net_up = DISABLED
Sun Jan 29 10:05:08 2017 us=573745   route_method = 3
Sun Jan 29 10:05:08 2017 us=573745   block_outside_dns = DISABLED
Sun Jan 29 10:05:08 2017 us=573745   ip_win32_defined = DISABLED
Sun Jan 29 10:05:08 2017 us=573745   ip_win32_type = 3
Sun Jan 29 10:05:08 2017 us=573745   dhcp_masq_offset = 0
Sun Jan 29 10:05:08 2017 us=573745   dhcp_lease_time = 31536000
Sun Jan 29 10:05:08 2017 us=573745   tap_sleep = 0
Sun Jan 29 10:05:08 2017 us=573745   dhcp_options = DISABLED
Sun Jan 29 10:05:08 2017 us=573745   dhcp_renew = DISABLED
Sun Jan 29 10:05:08 2017 us=573745   dhcp_pre_release = DISABLED
Sun Jan 29 10:05:08 2017 us=573745   dhcp_release = DISABLED
Sun Jan 29 10:05:08 2017 us=573745   domain = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=573745   netbios_scope = '[UNDEF]'
Sun Jan 29 10:05:08 2017 us=573745   netbios_node_type = 0
Sun Jan 29 10:05:08 2017 us=573745   disable_nbt = DISABLED
Sun Jan 29 10:05:08 2017 us=573745 OpenVPN 2.4.0 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Dec 27 2016
Sun Jan 29 10:05:08 2017 us=573745 Windows version 6.2 (Windows 8 or greater) 64bit
Sun Jan 29 10:05:08 2017 us=573745 library versions: OpenSSL 1.0.2i  22 Sep 2016, LZO 2.09
Enter Management Password:
Sun Jan 29 10:05:08 2017 us=574745 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Sun Jan 29 10:05:08 2017 us=574745 Need hold release from management interface, waiting...
Sun Jan 29 10:05:09 2017 us=41729 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Sun Jan 29 10:05:09 2017 us=143858 MANAGEMENT: CMD 'state on'
Sun Jan 29 10:05:09 2017 us=143858 MANAGEMENT: CMD 'log all on'
Sun Jan 29 10:05:11 2017 us=5545 MANAGEMENT: CMD 'hold off'
Sun Jan 29 10:05:11 2017 us=22556 MANAGEMENT: CMD 'hold release'
Sun Jan 29 10:05:19 2017 us=631997 MANAGEMENT: CMD 'username "Auth" "my client name"'
Sun Jan 29 10:05:19 2017 us=638999 MANAGEMENT: CMD 'password [...]'
Sun Jan 29 10:05:19 2017 us=744346 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jan 29 10:05:19 2017 us=744346 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jan 29 10:05:19 2017 us=744346 LZO compression initializing
Sun Jan 29 10:05:19 2017 us=744346 Control Channel MTU parms [ L:1622 D:1184 EF:66 EB:0 ET:0 EL:3 ]
Sun Jan 29 10:05:19 2017 us=744346 Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ]
Sun Jan 29 10:05:19 2017 us=744346 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Sun Jan 29 10:05:19 2017 us=744346 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Sun Jan 29 10:05:19 2017 us=744346 TCP/UDP: Preserving recently used remote address: [AF_INET]8x.xxx.xxx.xx:1194
Sun Jan 29 10:05:19 2017 us=744346 Socket Buffers: R=[65536->65536] S=[65536->65536]
Sun Jan 29 10:05:19 2017 us=744346 UDP link local: (not bound)
Sun Jan 29 10:05:19 2017 us=744346 UDP link remote: [AF_INET]8x.xxx.xxx.xx:1194
Sun Jan 29 10:05:19 2017 us=744346 MANAGEMENT: >STATE:1485680719,WAIT,,,,,,
Sun Jan 29 10:05:19 2017 us=749329 MANAGEMENT: >STATE:1485680719,AUTH,,,,,,
Sun Jan 29 10:05:19 2017 us=749329 TLS: Initial packet from [AF_INET]8x.xxx.xxx.xx:1194, sid=5e486b0d d845d099
Sun Jan 29 10:05:19 2017 us=749329 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Sun Jan 29 10:06:19 2017 us=941380 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sun Jan 29 10:06:19 2017 us=941380 TLS Error: TLS handshake failed
Sun Jan 29 10:06:19 2017 us=941380 TCP/UDP: Closing socket
Sun Jan 29 10:06:19 2017 us=941380 SIGUSR1[soft,tls-error] received, process restarting
Sun Jan 29 10:06:19 2017 us=941380 MANAGEMENT: >STATE:1485680779,RECONNECTING,tls-error,,,,,
Sun Jan 29 10:06:19 2017 us=941380 Restart pause, 5 second(s)
Sun Jan 29 10:06:24 2017 us=942664 Re-using SSL/TLS context
Sun Jan 29 10:06:24 2017 us=942664 LZO compression initializing
Sun Jan 29 10:06:24 2017 us=942664 Control Channel MTU parms [ L:1622 D:1184 EF:66 EB:0 ET:0 EL:3 ]
Sun Jan 29 10:06:24 2017 us=942664 Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ]
Sun Jan 29 10:06:24 2017 us=943147 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Sun Jan 29 10:06:24 2017 us=943147 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Sun Jan 29 10:06:24 2017 us=943147 TCP/UDP: Preserving recently used remote address: [AF_INET]8x.xxx.xxx.xx:1194
Sun Jan 29 10:06:24 2017 us=943147 Socket Buffers: R=[65536->65536] S=[65536->65536]
Sun Jan 29 10:06:24 2017 us=943147 UDP link local: (not bound)
Sun Jan 29 10:06:24 2017 us=943147 UDP link remote: [AF_INET]8x.xxx.xxx.xx:1194
Sun Jan 29 10:06:24 2017 us=943147 MANAGEMENT: >STATE:1485680784,WAIT,,,,,,
Sun Jan 29 10:06:24 2017 us=950193 MANAGEMENT: >STATE:1485680784,AUTH,,,,,,
Sun Jan 29 10:06:24 2017 us=950193 TLS: Initial packet from [AF_INET]8x.xxx.xxx.xx:1194, sid=2852eafe 765f08fb
Sun Jan 29 10:07:25 2017 us=68463 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sun Jan 29 10:07:25 2017 us=68463 TLS Error: TLS handshake failed
Sun Jan 29 10:07:25 2017 us=68463 TCP/UDP: Closing socket
Sun Jan 29 10:07:25 2017 us=68463 SIGUSR1[soft,tls-error] received, process restarting
Sun Jan 29 10:07:25 2017 us=68463 MANAGEMENT: >STATE:1485680845,RECONNECTING,tls-error,,,,,
Sun Jan 29 10:07:25 2017 us=68463 Restart pause, 5 second(s)
Sun Jan 29 10:07:30 2017 us=70159 Re-using SSL/TLS context
Sun Jan 29 10:07:30 2017 us=70159 LZO compression initializing
Sun Jan 29 10:07:30 2017 us=70159 Control Channel MTU parms [ L:1622 D:1184 EF:66 EB:0 ET:0 EL:3 ]
Sun Jan 29 10:07:30 2017 us=70159 Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ]
Sun Jan 29 10:07:30 2017 us=70159 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Sun Jan 29 10:07:30 2017 us=70159 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Sun Jan 29 10:07:30 2017 us=71173 TCP/UDP: Preserving recently used remote address: [AF_INET]8x.xxx.xxx.xx:1194
Sun Jan 29 10:07:30 2017 us=71173 Socket Buffers: R=[65536->65536] S=[65536->65536]
Sun Jan 29 10:07:30 2017 us=71173 UDP link local: (not bound)
Sun Jan 29 10:07:30 2017 us=71173 UDP link remote: [AF_INET]8x.xxx.xxx.xx:1194
Sun Jan 29 10:07:30 2017 us=71173 MANAGEMENT: >STATE:1485680850,WAIT,,,,,,
Sun Jan 29 10:07:30 2017 us=77176 MANAGEMENT: >STATE:1485680850,AUTH,,,,,,
Sun Jan 29 10:07:30 2017 us=77176 TLS: Initial packet from [AF_INET]8x.xxx.xxx.xx:1194, sid=504b0cf1 30961752
Sun Jan 29 10:07:48 2017 us=827803 TCP/UDP: Closing socket
Sun Jan 29 10:07:48 2017 us=827803 SIGTERM[hard,] received, process exiting
Sun Jan 29 10:07:48 2017 us=827803 MANAGEMENT: >STATE:1485680868,EXITING,SIGTERM,,,,,

I have checked this list and portforwarded correctly: https://openvpn.net/index.php/open-source/faq/79-client/253-tls-error-tls-key-negotiation-failed-to-occur-within-60-seconds-check-your-network-connectivity.html

Please, what is wrong?

SomeGuy

First suggested change:
In the client config, line 18 in the example,

</ca> <tls-auth>some code</tls-auth>

Change that to:

</ca>
<tls-auth>
some code
</tls-auth>

I doubt that will fix this, but try it anyway. Some clients may not do well with inline import when the line is "too long".

Next, from the client OS, inspect the "some code" between "<tls-auth>" and "</tls-auth>" and compare that to the contents of your server file "/usr/syno/etc/packages/VPNCenter/openvpn/mykeys/ta.key"

Are they the same?

Next, though it should not be a problem, maybe there is a white-space issue between your client OS End-of-Line terminator for the tls-auth "some code" on the client vs the server, when the client tries to read the "tls-auth" inline.

A diagnostic step for this? Try copying the same "tls-auth" file the server is using to the client OpenVPN Config directory, and chage the client config from inline tls-auth to specify a copy of the same tls-auth file with the same name (ta.key) into the same dir as the client config file on the client OS, with permissions for the openvpn server/user to be able to read this file. An example change in the client config from:

<tls-auth>
some code
</tls-auth>

to:

tls-auth ta.key 1

If this solves the problem, then suspect the way the tls-auth key data is being stored inline in the original client config inline compared to the way the tls-auth key is stored on the server in its file.

Also, you appear to be using an auth plugin. You could consider disabling requirement for username/cn auth as part of testing, too.

If/when you find the answer to resolve this, please follow-up here and in the thread you used, to let people know what worked for you.