OpenVPN TLS won't handshake after initial packet - New ISP

ngkrich

Hello,

I recently got a new ISP (Webpass from ATT) and when I first transitioned to it my OpenVPN setup worked just fine for about a day. Now the server receives the initial packet from the client, but the handshake fails.

I tried starting from scratch again, but still nothing. My firewall in DDWRT and windows is off but I still seem unable to connect from outside. The default Linksys profile works on 1194 with the new ISP, otherwise I would have assumed it was a port issue on their end.

Anyone able to help me with this?

keepalive 10 120
verb 3
mute 3
syslog
writepid /var/run/openvpnd.pid
management 127.0.0.1 14
management-log-cache 100
topology subnet
script-security 2
port 1194
proto udp4
cipher aes-256-cbc
auth sha256
client-connect /tmp/openvpn/clcon.sh
client-disconnect /tmp/openvpn/cldiscon.sh
client-config-dir /tmp/openvpn/ccd
comp-lzo adaptive
tls-server
duplicate-cn
client-to-client
push "redirect-gateway def1"
fast-io
tun-mtu 1500
mtu-disc yes
server 172.19.13.0 255.255.255.0
dev tun2
log-append /var/log/openvpn.log
verb 5
push "dhcp-option DNS 172.19.13.1"
push "dhcp-option DOMAIN ngkrich"
push "route 10.217.64.0 255.255.255.0"

client
dev tun
proto udp
remote [My IP] 1194
tun-mtu 1500
resolv-retry infinite
nobind
persist-key
persist-tun
verb 4
float
auth SHA256
cipher AES-256-CBC
comp-lzo
redirect-gateway def1

iptables -t nat -A POSTROUTING -s 172.19.13.0/24 -j MASQUERADE

Sun Oct 22 23:46:04 2017 us=753143 OpenVPN 2.4.3 arm-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Sep 27 2017
Sun Oct 22 23:46:04 2017 us=753160 library versions: OpenSSL 1.1.0f 25 May 2017, LZO 2.09
Sun Oct 22 23:46:04 2017 us=753991 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:14
Sun Oct 22 23:46:04 2017 us=754204 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Sun Oct 22 23:46:04 2017 us=755047 Diffie-Hellman initialized with 4096 bit key
Sun Oct 22 23:46:04 2017 us=756106 TLS-Auth MTU parms [ L:1622 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Sun Oct 22 23:46:04 2017 us=756445 TUN/TAP device tun2 opened
Sun Oct 22 23:46:04 2017 us=756481 TUN/TAP TX queue length set to 100
Sun Oct 22 23:46:04 2017 us=756510 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Sun Oct 22 23:46:04 2017 us=756555 /sbin/ifconfig tun2 172.19.13.1 netmask 255.255.255.0 mtu 1500 broadcast 172.19.13.255
Sun Oct 22 23:46:04 2017 us=768621 Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ]
Sun Oct 22 23:46:04 2017 us=768676 Socket Buffers: R=[180224->180224] S=[180224->180224]
Sun Oct 22 23:46:04 2017 us=768713 UDPv4 link local (bound): [AF_INET][undef]:1194
Sun Oct 22 23:46:04 2017 us=768732 UDPv4 link remote: [AF_UNSPEC]
Sun Oct 22 23:46:04 2017 us=768755 MULTI: multi_init called, r=256 v=256
Sun Oct 22 23:46:04 2017 us=768813 IFCONFIG POOL: base=172.19.13.2 size=252, ipv6=0
Sun Oct 22 23:46:04 2017 us=768841 IFCONFIG POOL LIST
Sun Oct 22 23:46:04 2017 us=768909 Initialization Sequence Completed
Sun Oct 22 23:46:36 2017 us=16430 MULTI: multi_create_instance called
Sun Oct 22 23:46:36 2017 us=16528 10.217.64.112:57556 Re-using SSL/TLS context
Sun Oct 22 23:46:36 2017 us=16557 10.217.64.112:57556 LZO compression initializing
Sun Oct 22 23:46:36 2017 us=16746 10.217.64.112:57556 Control Channel MTU parms [ L:1622 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Sun Oct 22 23:46:36 2017 us=16777 10.217.64.112:57556 Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ]
Sun Oct 22 23:46:36 2017 us=16853 10.217.64.112:57556 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1570,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA256,keysize 256,key-method 2,tls-server'
Sun Oct 22 23:46:36 2017 us=16874 10.217.64.112:57556 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1570,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA256,keysize 256,key-method 2,tls-client'
RSun Oct 22 23:46:36 2017 us=16933 10.217.64.112:57556 TLS: Initial packet from [AF_INET]10.217.64.112:57556, sid=a781633a 1742b9c7
WWRWWRWRWWRWSun Oct 22 23:47:36 2017 us=365632 10.217.64.112:57556 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sun Oct 22 23:47:36 2017 us=365668 10.217.64.112:57556 TLS Error: TLS handshake failed
Sun Oct 22 23:47:36 2017 us=365808 10.217.64.112:57556 SIGUSR1[soft,tls-error] received, client-instance restarting
Sun Oct 22 23:48:16 2017 us=140623 MULTI: multi_create_instance called

TinCanTech

Where is the client located when you try to connect ?

ngkrich

TinCanTech wrote Where is the client located when you try to connect ?

I have tried from my mobile phone's network while tethered to a laptop mostly, which works fine with the default Linkysys Openvpn (though I have not control or sight on the server config) and used to work fine with my old ISP.

I don't have another network I can try on other than work, and the security on work network never allowed my custom setup to work, only the default Linksys setup (could never figure out why despite a ton of trying and asking on forums, though nobody replied). Due to that issue I do not want to test with the work network, as it never let me connect before with the custom setup.

Hopefully that makes sense. If not, let me know what is confusing and I will clarify.

TinCanTech

This is what I do not understand:

ngkrich wrote Oct 22 23:46:36 2017 us=16933 10.217.64.112:57556 TLS: Initial packet from [AF_INET]10.217.64.112:57556, sid=a781633a 1742b9c7

This is an RFC1918 private address which should not be routed over the internet.

Can you explain how it is your client appears on this address ?

Also, what is:

ngkrich wrote The default Linksys profile works on 1194 with the new ISP

How does it differ from your custom profile ?

ngkrich

TinCanTech wrote This is what I do not understand:
This is an RFC1918 private address which should not be routed over the internet.

Can you explain how it is your client appears on this address ?

20171025 16:11:08 MULTI: multi_create_instance called
20171025 16:11:08 174.221.129.104:6689 Re-using SSL/TLS context
20171025 16:11:08 174.221.129.104:6689 LZO compression initializing
20171025 16:11:08 174.221.129.104:6689 Control Channel MTU parms [ L:1622 D:1212 EF:38 EB:0 ET:0 EL:3 ]
20171025 16:11:08 174.221.129.104:6689 Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ]
20171025 16:11:08 174.221.129.104:6689 Local Options String (VER=V4): 'V4 dev-type tun link-mtu 1570 tun-mtu 1500 proto UDPv4 comp-lzo cipher AES-256-CBC auth SHA256 keysize 256 key-method 2 tls-server'
20171025 16:11:08 174.221.129.104:6689 Expected Remote Options String (VER=V4): 'V4 dev-type tun link-mtu 1570 tun-mtu 1500 proto UDPv4 comp-lzo cipher AES-256-CBC auth SHA256 keysize 256 key-method 2 tls-client'
20171025 16:11:08 174.221.129.104:6689 TLS: Initial packet from [AF_INET]174.221.129.104:6689 sid=08a161c7 c799a965
20171025 16:11:08 174.221.129.104:6689 VERIFY OK: depth=1 C=US ST=IL L=Chicago O=ngkrich OU=changeme CN=NGKRICH-HOME name=ngkrich emailAddress=ngkrich@gmail.com
20171025 16:11:08 174.221.129.104:6689 VERIFY OK: depth=0 C=US ST=IL L=Chicago O=ngkrich OU=changeme CN=ngkrich name=ngkrich emailAddress=ngkrich@gmail.com
20171025 16:11:08 I 174.221.129.104:6689 peer info: IV_VER=2.4.4
20171025 16:11:08 I 174.221.129.104:6689 peer info: IV_PLAT=win
20171025 16:11:08 I 174.221.129.104:6689 peer info: IV_PROTO=2
20171025 16:11:08 I 174.221.129.104:6689 peer info: IV_NCP=2
20171025 16:11:08 I 174.221.129.104:6689 peer info: IV_LZ4=1
20171025 16:11:08 I 174.221.129.104:6689 peer info: IV_LZ4v2=1
20171025 16:11:08 I 174.221.129.104:6689 peer info: IV_LZO=1
20171025 16:11:08 I 174.221.129.104:6689 peer info: IV_COMP_STUB=1
20171025 16:11:08 I 174.221.129.104:6689 peer info: IV_COMP_STUBv2=1
20171025 16:11:08 I 174.221.129.104:6689 peer info: IV_TCPNL=1
20171025 16:11:08 I 174.221.129.104:6689 peer info: IV_GUI_VER=OpenVPN_GUI_11
20171025 16:11:08 174.221.129.104:6689 Control Channel: TLSv1.2 cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 4096 bit RSA
20171025 16:11:08 I 174.221.129.104:6689 [ngkrich] Peer Connection Initiated with [AF_INET]174.221.129.104:6689
20171025 16:11:08 I ngkrich/174.221.129.104:6689 MULTI_sva: pool returned IPv4=172.19.13.2 IPv6=(Not enabled)
20171025 16:11:08 ngkrich/174.221.129.104:6689 OPTIONS IMPORT: reading client specific options from: /tmp/openvpn_cc_3ee682a3f63d578dd65815af9924898c.tmp
20171025 16:11:08 ngkrich/174.221.129.104:6689 MULTI: Learn: 172.19.13.2 -> ngkrich/174.221.129.104:6689
20171025 16:11:08 ngkrich/174.221.129.104:6689 MULTI: primary virtual IP for ngkrich/174.221.129.104:6689: 172.19.13.2
20171025 16:11:09 ngkrich/174.221.129.104:6689 PUSH: Received control message: 'PUSH_REQUEST'
20171025 16:11:09 ngkrich/174.221.129.104:6689 SENT CONTROL [ngkrich]: 'PUSH_REPLY dhcp-option DNS 172.19.13.1 dhcp-option DOMAIN ngkrich route 10.217.64.0 255.255.255.0 route-gateway 172.19.13.1 topology subnet ping 10 ping-restart 120 ifconfig 172.19.13.2 255.255.255.0 peer-id 0 cipher AES-256-GCM' (status=1)
20171025 16:11:09 ngkrich/174.221.129.104:6689 Data Channel: using negotiated cipher 'AES-256-GCM'
20171025 16:11:09 ngkrich/174.221.129.104:6689 Data Channel MTU parms [ L:1550 D:1450 EF:50 EB:406 ET:0 EL:3 ]
20171025 16:11:09 ngkrich/174.221.129.104:6689 Data Channel Encrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
20171025 16:11:09 ngkrich/174.221.129.104:6689 Data Channel Decrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
20171025 16:11:09 ngkrich/174.221.129.104:6689 MULTI: bad source address from client [::] packet dropped

Ok, so it randomly started working now and I have not changed anything. I think I posted the wrong log earlier TinCanTech, my apologies.

It seems I can now ping my other computer based on hostname while on the vpn, which is an improvement, but I cannot ping the NAS server on the router's hostname DD-WRT.

I need to test at work, because I suspect it will still not work.

TinCanTech wrote Also, what is:
ngkrich wrote The default Linksys profile works on 1194 with the new ISP
How does it differ from your custom profile ?

Okay so the custom profile I have full control over via SSH and the DD-WRT GUI. The Linksys profile is setup by Linksys on the default firmware, which does not support SSH or give me access to the server config. Only the client config. The Linksys profile connects at my work network somehow, while my custom one does not. On the client side I cannot see a reason for it. I am not crafty enough to figure out how to get the server config. Unless there is a verb command detailed enough that I am unaware of? The Linksys client config is as follows.

client
dev tun
proto udp
remote 136.30.44.10 1194
tun-mtu 6000
# fragment 0 can be used to improve performance in some instances but
# breaks compatibility with some Android apps
# fragment 0
mssfix 0
resolv-retry infinite
nobind
persist-key
persist-tun
ns-cert-type server
auth-user-pass
verb 3

Happy to dump the ipconfig our route logs for both if that is helpful. I would really love to get my custom setup working on my work network and be able to access the router hostname so I can access the NAS server.

I really appreciate your help so far!

TinCanTech

ngkrich wrote so it randomly started working now and I have not changed anything. I think I posted the wrong log earlier TinCanTech, my apologies

OK ..

ngkrich wrote I can now ping my other computer based on hostname while on the vpn, which is an improvement, but I cannot ping the NAS server on the router's hostname DD-WRT.

Try ping by IP address.

Also see:
HOWTO: Expanding the scope of the VPN to include additional machines

ngkrich

TinCanTech wrote
ngkrich wrote so it randomly started working now and I have not changed anything. I think I posted the wrong log earlier TinCanTech, my apologies
OK ..

ngkrich wrote I can now ping my other computer based on hostname while on the vpn, which is an improvement, but I cannot ping the NAS server on the router's hostname DD-WRT.
Try ping by IP address.

Also see:
HOWTO: Expanding the scope of the VPN to include additional machines

Going to try the Tun instructions in the link below, it looks like I am already doing at least part of it. The IP for the NAS definitely works, just not the hostname.

Any ideas on why the VPN will connect but not allow access to DDWRT or any machines on the network when I am on my work network? But the default Linksys setup will? I could be way off because I am still new to this, but I think they get prioritized differently when I connect to each and look at the route tables.

Alternatively any ideas on how I can get more info to troubleshoot it?

ngkrich

Also tried

dev tun2
proto udp4
comp-lzo adaptive

On the client side and still cannot get internet from some networks like at work, but they all connect.

Otherwise, it works perfectly DNS and all. Except for pinging the router by it's host name. Other host names all work.

Any ideas what the hold up could be?

ngkrich

Bump, still having issues.

TinCanTech

Document the issues properly ..

ngkrich

TinCanTech wrote Document the issues properly ..

Can you help me understand what I need to include besides the logs and configs in OP? I'm happy to add anything, I just am not sure what else to add.

TinCanTech

Read your own posts and the gist of this thread and you tell me what detail it is you are having an actual problem with .. this is all I see:

ngkrich wrote On the client side and still cannot get internet from some networks like at work, but they all connect.
HOWTO: Routing all client traffic (including web-traffic) through the VPN
ngkrich wrote Otherwise, it works perfectly DNS and all. Except for pinging the router by it's host name. Other host names all work.
Sounds like your DNS not OpenVPN ..
ngkrich wrote Ok, so it randomly started working now and I have not changed anything. I think I posted the wrong log earlier TinCanTech, my apologies.
This is where I stop reading any more .. and probably so do most people.

OpenVPN does not do Random things .. you (or somebody) changed something ..

You could start a new thread with all the relevant details ..

HOWTO: Request Help ! {2}

Or just work through this:

HOWTO: For OpenVPN Community Edition