Trying to get VPN work on my synology NAS.
Getting this error and don't know why (see below). Created the keys using this guide
https://forum.synology.com/enu/viewtopic.php?f=173&t=100066. Adjusted som configs according to this guide
http://bpmsg.com/how-to-make-your-synology-disk-station-nas-more-secure/comment-page-1/
Opened up ports correctly on both synology firewall and my router.
I have the ta.key username.key and username.crt and ca.crt in my Windows OPENVPN config subdir.
I have tried to add my certificate to the Synology GUI (security->certificate) with no success.
I have tried re-creating server crt and key and replaced the old ones with the new with no success.
client
dev tun
proto tcp-client
# Change <your-ip-or-hostname> to your IP or hostname
remote my.hostname 8080
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert username.crt
key username.key
tls-auth ta.key 1
ns-cert-type server
comp-lzo
auth-user-pass
verb 4
# This is for using PKCS12 certs imported into Windows credential storage.
#cryptoapicert "THUMB:XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX"
push "route 192.168.1.0 255.255.255.0"
push "route 10.8.0.0 255.255.255.0"
dev tun
management 127.0.0.1 1195
server 10.8.0.0 255.255.255.0
# The backup task will include this location
dh /var/packages/VPNCenter/target/etc/openvpn/keys/dh2048.pem
ca /var/packages/VPNCenter/target/etc/openvpn/keys/ca.crt
cert /var/packages/VPNCenter/target/etc/openvpn/keys/server.crt
key /var/packages/VPNCenter/target/etc/openvpn/keys/server.key
tls-auth /var/packages/VPNCenter/target/etc/openvpn/keys/ta.key 0
max-clients 5
comp-lzo
persist-tun
persist-key
verb 4
# Don't forget logrotate script
log-append /var/log/openvpn.log
keepalive 10 60
reneg-sec 0
plugin /var/packages/VPNCenter/target/lib/radiusplugin.so /var/packages/VPNCenter/target/etc/openvpn/radiusplugin.cnf
# KEEP THIS DISABLED
#client-cert-not-required
username-as-common-name
duplicate-cn
status /tmp/ovpn_status_2_result 30
status-version 2
proto tcp6-server
port 8080
Server log
Tue Jan 31 20:19:33 2017 us=543960 MULTI: multi_create_instance called
Tue Jan 31 20:19:33 2017 us=544120 Re-using SSL/TLS context
Tue Jan 31 20:19:33 2017 us=544178 LZO compression initialized
Tue Jan 31 20:19:33 2017 us=544381 Control Channel MTU parms [ L:1544 D:1182 EF:68 EB:0 ET:0 EL:3 ]
Tue Jan 31 20:19:33 2017 us=544468 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:143 ET:0 EL:3 AF:3/1 ]
Tue Jan 31 20:19:33 2017 us=544569 Local Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,keydir 0,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Tue Jan 31 20:19:33 2017 us=544614 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,keydir 1,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Tue Jan 31 20:19:33 2017 us=544693 Local Options hash (VER=V4): 'bd577cd1'
Tue Jan 31 20:19:33 2017 us=544765 Expected Remote Options hash (VER=V4): 'ee93268d'
Tue Jan 31 20:19:33 2017 us=544853 TCP connection established with [AF_INET6]::ffff:192.168.1.1:49381
Tue Jan 31 20:19:33 2017 us=544905 TCPv6_SERVER link local (bound): [undef]
Tue Jan 31 20:19:33 2017 us=544959 TCPv6_SERVER link remote: [AF_INET6]::ffff:192.168.1.1:49381
Tue Jan 31 20:19:34 2017 us=542073 ::ffff:192.168.1.1(49381) TLS: Initial packet from [AF_INET6]::ffff:192.168.1.1:49381, sid=d72eeb98 9d0eb6a3
Tue Jan 31 20:19:34 2017 us=735475 ::ffff:192.168.1.1(49381) Connection reset, restarting [0]
Tue Jan 31 20:19:34 2017 us=735571 ::ffff:192.168.1.1(49381) SIGUSR1[soft,connection-reset] received, client-instance restarting
Tue Jan 31 20:19:34 2017 us=735764 TCP/UDP: Closing socket
Client log
Tue Jan 31 19:47:09 2017 us=50005 Control Channel MTU parms [ L:1544 D:1182 EF:68 EB:0 ET:0 EL:3 ]
Tue Jan 31 19:47:09 2017 us=50504 Socket Buffers: R=[65536->65536] S=[65536->65536]
Tue Jan 31 19:47:09 2017 us=50504 MANAGEMENT: >STATE:1485888429,RESOLVE,,,
Tue Jan 31 19:47:09 2017 us=51506 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:143 ET:0 EL:3 AF:3/1 ]
Tue Jan 31 19:47:09 2017 us=51506 Local Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,keydir 1,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Tue Jan 31 19:47:09 2017 us=51506 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,keydir 0,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Tue Jan 31 19:47:09 2017 us=52006 Local Options hash (VER=V4): 'ee93268d'
Tue Jan 31 19:47:09 2017 us=52006 Expected Remote Options hash (VER=V4): 'bd577cd1'
Tue Jan 31 19:47:09 2017 us=52006 Attempting to establish TCP connection with [AF_INET]8x.xxx.xxx.xx:8080 [nonblock]
Tue Jan 31 19:47:09 2017 us=52006 MANAGEMENT: >STATE:1485888429,TCP_CONNECT,,,
Tue Jan 31 19:47:10 2017 us=53073 TCP connection established with [AF_INET]8x.xxx.xxx.xx:8080
Tue Jan 31 19:47:10 2017 us=53073 TCPv4_CLIENT link local: [undef]
Tue Jan 31 19:47:10 2017 us=53608 TCPv4_CLIENT link remote: [AF_INET]8x.xxx.xxx.xx:8080
Tue Jan 31 19:47:10 2017 us=53608 MANAGEMENT: >STATE:1485888430,WAIT,,,
Tue Jan 31 19:47:10 2017 us=54081 MANAGEMENT: >STATE:1485888430,AUTH,,,
Tue Jan 31 19:47:10 2017 us=54081 TLS: Initial packet from [AF_INET]8x.xxx.xxx.xx:8080, sid=049bd7ea c4a5f60e
Tue Jan 31 19:47:10 2017 us=246478 VERIFY nsCertType ERROR: C=SE, ST=SK, L=LU, O=Fort-Funston, OU=Tobiascompany, CN=Fort-Funston CA, name=EasyRSA, emailAddress=hostname@hotmail.com, require nsCertType=SERVER
Tue Jan 31 19:47:10 2017 us=246961 OpenSSL: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed
Tue Jan 31 19:47:10 2017 us=246961 TLS_ERROR: BIO read tls_read_plaintext error
Tue Jan 31 19:47:10 2017 us=246961 TLS Error: TLS object -> incoming plaintext read error
Tue Jan 31 19:47:10 2017 us=246961 TLS Error: TLS handshake failed
Tue Jan 31 19:47:10 2017 us=246961 Fatal TLS error (check_tls_errors_co), restarting
Tue Jan 31 19:47:10 2017 us=246961 TCP/UDP: Closing socket
Tue Jan 31 19:47:10 2017 us=247462 SIGUSR1[soft,tls-error] received, process restarting
Tue Jan 31 19:47:10 2017 us=247462 MANAGEMENT: >STATE:1485888430,RECONNECTING,tls-error,,
Tue Jan 31 19:47:10 2017 us=247462 Restart pause, 5 second(s)
Tue Jan 31 19:47:13 2017 us=248867 SIGTERM[hard,init_instance] received, process exiting
Tue Jan 31 19:47:13 2017 us=248867 MANAGEMENT: >STATE:1485888433,EXITING,init_instance,,
Here is the sample synology config that is there when you have installed VPN Packet. I am not using this.
dev tun
management 127.0.0.1 1195
server 10.8.0.0 255.255.255.0
push "route 10.8.0.0 255.255.255.0"
dh /var/packages/VPNCenter/target/etc/openvpn/keys/dh3072.pem
ca /var/packages/VPNCenter/target/etc/openvpn/keys/ca.crt
cert /var/packages/VPNCenter/target/etc/openvpn/keys/server.crt
key /var/packages/VPNCenter/target/etc/openvpn/keys/server.key
max-clients 5
comp-lzo
persist-tun
persist-key
verb 3
#log-append /var/log/openvpn.log
keepalive 10 60
reneg-sec 0
plugin /var/packages/VPNCenter/target/lib/radiusplugin.so /var/packages/VPNCenter/target/etc/openvpn/radiusplugin.cnf
client-cert-not-required
username-as-common-name
duplicate-cn
status /tmp/ovpn_status_2_result 30
status-version 2
proto udp6
Here is the vars file I used when created the keys:
# easy-rsa parameter settings
# NOTE: If you installed from an RPM,
# don't edit this file in place in
# /usr/share/openvpn/easy-rsa --
# instead, you should copy the whole
# easy-rsa directory to another location
# (such as /etc/openvpn) so that your
# edits will not be wiped out by a future
# OpenVPN package upgrade.
# This variable should point to
# the top level of the easy-rsa
# tree.
export EASY_RSA="`pwd`"
#
# This variable should point to
# the requested executables
#
export OPENSSL="openssl"
export PKCS11TOOL="pkcs11-tool"
export GREP="grep"
# This variable should point to
# the openssl.cnf file included
# with easy-rsa.
export KEY_CONFIG=`$EASY_RSA/whichopensslcnf $EASY_RSA`
# Edit this variable to point to
# your soon-to-be-created key
# directory.
#
# WARNING: clean-all will do
# a rm -rf on this directory
# so make sure you define
# it correctly!
export KEY_DIR="$EASY_RSA/keys"
# Issue rm -rf warning
echo NOTE: If you run ./clean-all, I will be doing a rm -rf on $KEY_DIR
# PKCS11 fixes
export PKCS11_MODULE_PATH="dummy"
"vars" 80L, 2072C
PKCS11 fixes
export PKCS11_MODULE_PATH="dummy"
export PKCS11_PIN="dummy"
# Increase this to 2048 if you
# are paranoid. This will slow
# down TLS negotiation performance
# as well as the one-time DH parms
# generation process.
export KEY_SIZE=2048
# In how many days should the root CA key expire?
export CA_EXPIRE=3650
# In how many days should certificates expire?
export KEY_EXPIRE=3650
# These are the default values for fields
# which will be placed in the certificate.
# Don't leave any of these fields blank.
export KEY_COUNTRY="SE"
export KEY_PROVINCE="SK"
export KEY_CITY="LU"
export KEY_ORG="Fort-Funston"
export KEY_EMAIL="hostname@hotmail.com"
export KEY_OU="namecompany"
# X509 Subject Field
export KEY_NAME="EasyRSA"
# PKCS11 Smart Card
# export PKCS11_MODULE_PATH="/usr/lib/changeme.so"
# export PKCS11_PIN=1234
# If you'd like to sign all keys with the same Common Name, uncomment the KEY_CN export below
# You will also need to make sure your OpenVPN server config has the duplicate-cn option set
# export KEY_CN="CommonName"
