Clients Mysteriously Dropped Offline - TLS Handshake

[deleted]

Hi All,

Using Mikrotik routers (aware they dont support UDP and LZO).
Have had 2 months of happy service where remote devices connected over a cellular 4G dongle flawlessly, even despite some periods of bad connectivity.

Suddenly at 3am one morning 3 devices in vastly different geographical locations stopped connecting. Other routers using dongles and or wired connections are currently online.

The ones not connecting are still calling home but get the dreaded:

"TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)"

They appear as "UNDEF" in the status log.

Considering the attached configs what can anyone suggest would cause this?

port 443
proto tcp
dev tun
sndbuf 0
rcvbuf 0
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA1
topology subnet
server 10.8.0.0 255.255.255.0
route 172.16.0.0 255.255.0.0
push "route 172.16.0.0 255.255.0.0"
push "route 172.31.0.0 255.255.0.0"
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
ifconfig-pool-persist ipp.txt
keepalive 10 120
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log-append /var/log/openvpn.log
verb 4
crl-verify crl.pem
client-config-dir ccd
mssfix 1460

client
dev tun
proto tcp
sndbuf 0
rcvbuf 0
remote SERVERIP 443
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
#auth SHA512
auth SHA1
cipher AES-256-CBC
setenv opt block-outside-dns
key-direction 1
verb 4

Sat Mar 3 15:52:17 2018 us=968351 TCP connection established with [AF_INET]REMOTE_IP:REMOTE_PORT
Sat Mar 3 15:52:17 2018 us=968358 TCP_SERVER link local: (not bound)
Sat Mar 3 15:52:17 2018 us=968364 TCP_SERVER link remote: [AF_INET]REMOTE_IP:REMOTE_PORT
Sat Mar 3 15:53:03 2018 us=414887 REMOTE_IP:REMOTE_PORT TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sat Mar 3 15:53:03 2018 us=414970 REMOTE_IP:REMOTE_PORT TLS Error: TLS handshake failed
Sat Mar 3 15:53:03 2018 us=415083 REMOTE_IP:REMOTE_PORT Fatal TLS error (check_tls_errors_co), restarting
Sat Mar 3 15:53:03 2018 us=415160 REMOTE_IP:REMOTE_PORT SIGUSR1[soft,tls-error] received, client-instance restarting
Sat Mar 3 15:53:03 2018 us=415289 TCP/UDP: Closing socket

I cant see how my certs would have failed after 2 months? Nothing else has changed.

TinCanTech

specialised wrote REMOTE_IP:REMOTE_PORT TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)

I cant see how my certs would have failed after 2 months? Nothing else has changed

That is a network error not a certificate error ..

[deleted]

For this to be a network issue 3 cellular dongles in geographically disperse locations must have gone offline at the same time.
The thing that throws me is that some cellular dongles are fine (for now).
I have a strong suspicion this is a telco blocking the return traffic and hence the time out.
I have poured over TCP dumps and cannot see anything beyond my VPN server returning the acknowledgement (SYN, ACK handshake) only to not get the final acknowledgement.

So

Client calls home
Server responds
Nothing

Will update after chatting to the telco.

[deleted]

I am so mad at optus in Australia right now.

I activated several dongles on 1st Feb.
1 month later 2nd March at 4am they killed the service, despite me paying $130 for 45Gb of data (each).

Turns out even though it was activated they didnt apply the credit.

Surprisingly though I can still see the dongle call home which is what made me go nuts trying to figure out the problem.

Case closed - optus and their absurd activation process blows.
Thanks for replying Tincan.