Error in initial connection to OpenVPN server

frbastiat

I got my OpenVPN server setup on a Raspberry Pi 3 using the popular readwrite tutorial: https://readwrite.com/2014/04/10/raspberry-pi-vpn-tutorial-server-secure-web-browsing/#awesm=~oBvYD8BOiTdCQN

My /etc/openvpn/server.conf is here:

local 10.0.2.21 # SWAP THIS NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
dev tun
proto udp #Some people prefer to use tcp. Don't change it if you don't know.
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/kindervpnserver.crt # SWAP WITH YOUR CRT NAME
key /etc/openvpn/easy-rsa/keys/kindervpnserver.key # SWAP WITH YOUR KEY NAME
dh /etc/openvpn/easy-rsa/keys/dh2048.pem # If you changed to 2048, change that here!
server 10.8.0.0 255.255.255.0
# server and remote endpoints
ifconfig 10.8.0.1 10.8.0.2
# Add route to Client routing table for the OpenVPN Server
push "route 10.8.0.1 255.255.255.255"
# Add route to Client routing table for the OpenVPN Subnet
push "route 10.8.0.0 255.255.255.0"
# your local subnet
push "route 10.0.2.21 255.255.255.0" # SWAP THE IP NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
# Set primary domain name server address to the SOHO Router
# If your router does not do DNS, you can use Google DNS 8.8.8.8
push "dhcp-option DNS 10.0.2.1" # This should already match your router address and not need to be changed.
# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
client-to-client
duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-128-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 4

My client .ovpn is:

client
dev tun
proto udp
remote <domain> 1194
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
ns-cert-type server
key-direction 1
cipher AES-128-CBC
comp-lzo
verb 1
mute 20
<ca>
</ca>
<cert>
</cert>
<key>
</key>
<tls-auth>
#
# 2048 bit OpenVPN static key
#
</tls-auth>

My /etc/network/interfaces is:

# interfaces(5) file used by ifup(8) and ifdown(8)

# Please note that this file is written to be used with dhcpcd
# For static IP, consult /etc/dhcpcd.conf and 'man dhcpcd.conf'

# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d

auto lo
iface lo inet loopback

iface eth0 inet dhcp
    pre-up /etc/firewall-openvpn-rules.sh

allow-hotplug wlan0
iface wlan0 inet manual
    wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf

allow-hotplug wlan1
iface wlan1 inet manual
    wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf

/etc/firewall-openvpn-rules.sh is:

#!/bin/sh

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 10.0.2.21

And my log is:

Tue Apr  3 13:51:36 2018 us=846692 OpenVPN 2.3.4 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH]                                                               [IPv6] built on Jun 27 2017
Tue Apr  3 13:51:36 2018 us=846832 library versions: OpenSSL 1.0.1t  3 May 2016, LZO 2.08
Tue Apr  3 13:51:36 2018 us=850445 Diffie-Hellman initialized with 2048 bit key
Tue Apr  3 13:51:36 2018 us=854951 Control Channel Authentication: using '/etc/openvpn/easy-rsa/keys/ta.key' as a OpenVP                                                              N static key file
Tue Apr  3 13:51:36 2018 us=855181 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC a                                                              uthentication
Tue Apr  3 13:51:36 2018 us=855258 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC a                                                              uthentication
Tue Apr  3 13:51:36 2018 us=855368 TLS-Auth MTU parms [ L:1558 D:166 EF:66 EB:0 ET:0 EL:0 ]
Tue Apr  3 13:51:36 2018 us=855493 Socket Buffers: R=[163840->131072] S=[163840->131072]
Tue Apr  3 13:51:36 2018 us=856155 ROUTE_GATEWAY 10.0.2.1/255.255.255.0 IFACE=eth0 HWADDR=b8:27:eb:29:04:6f
Tue Apr  3 13:51:36 2018 us=860700 TUN/TAP device tun1 opened
Tue Apr  3 13:51:36 2018 us=860932 TUN/TAP TX queue length set to 100
Tue Apr  3 13:51:36 2018 us=861079 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Apr  3 13:51:36 2018 us=861305 /sbin/ip link set dev tun1 up mtu 1500
Tue Apr  3 13:51:36 2018 us=868586 /sbin/ip addr add dev tun1 local 10.8.0.1 peer 10.8.0.2
Tue Apr  3 13:51:36 2018 us=877476 /sbin/ip route add 10.8.0.0/24 via 10.8.0.2
Tue Apr  3 13:51:36 2018 us=887442 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Apr  3 13:51:36 2018 us=894812 GID set to nogroup
Tue Apr  3 13:51:36 2018 us=895209 UID set to nobody
Tue Apr  3 13:51:36 2018 us=895338 UDPv4 link local (bound): [AF_INET]10.0.2.21:1194
Tue Apr  3 13:51:36 2018 us=895421 UDPv4 link remote: [undef]
Tue Apr  3 13:51:36 2018 us=895506 MULTI: multi_init called, r=256 v=256
Tue Apr  3 13:51:36 2018 us=896118 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Tue Apr  3 13:51:36 2018 us=896552 Initialization Sequence Completed
Tue Apr  3 13:52:03 2018 us=621374 MULTI: multi_create_instance called
Tue Apr  3 13:52:03 2018 us=621755 <client ip>:8577 Re-using SSL/TLS context
Tue Apr  3 13:52:03 2018 us=621975 <client ip>:8577 LZO compression initialized
Tue Apr  3 13:52:03 2018 us=623017 <client ip>:8577 Control Channel MTU parms [ L:1558 D:166 EF:66 EB:0 ET:0 EL:0 ]
Tue Apr  3 13:52:03 2018 us=623146 <client ip>:8577 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:                                                              3/1 ]
Tue Apr  3 13:52:03 2018 us=623441 <client ip>:8577 Local Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500                                                              ,proto UDPv4,comp-lzo,keydir 0,cipher AES-128-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Tue Apr  3 13:52:03 2018 us=623507 <client ip>:8577 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1558,tu                                                              n-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher AES-128-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Tue Apr  3 13:52:03 2018 us=623657 <client ip>:8577 Local Options hash (VER=V4): 'a2e63101'
Tue Apr  3 13:52:03 2018 us=623763 <client ip>:8577 Expected Remote Options hash (VER=V4): '272f1b58'
Tue Apr  3 13:52:03 2018 us=623941 <client ip>:8577 TLS: Initial packet from [AF_INET]<client ip>:8577, sid=57f9ea                                                              b4 7853f7ae
Tue Apr  3 13:53:03 2018 us=995505 <client ip>:8577 TLS Error: TLS key negotiation failed to occur within 60 seconds                                                               (check your network connectivity)
Tue Apr  3 13:53:03 2018 us=995739 <client ip>:8577 TLS Error: TLS handshake failed
Tue Apr  3 13:53:03 2018 us=996302 <client ip>:8577 SIGUSR1[soft,tls-error] received, client-instance restarting
Tue Apr  3 13:53:41 2018 us=11234 MULTI: multi_create_instance called

I have forwarded UDP 1194 to 10.0.2.21 as well. Could someone help point me to what I am missing in my setup?

TinCanTech

Are you testing this on your home network ?

If so, try this in your client config:

remote 10.0.2.21 1194

frbastiat

I'm remote right now but I will give it a shot when I get home.

TinCanTech

If you are trying it from a remote location and getting the TLS handshake failed then I think your network is probably not setup correctly.

You are using your eth0 to listen for incoming connections .. so disable your wlan devices.

frbastiat

Same response after disabling the wlan interfaces:

# interfaces(5) file used by ifup(8) and ifdown(8)

# Please note that this file is written to be used with dhcpcd
# For static IP, consult /etc/dhcpcd.conf and 'man dhcpcd.conf'

# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d

auto lo
iface lo inet loopback

iface eth0 inet dhcp
    pre-up /etc/firewall-openvpn-rules.sh

#allow-hotplug wlan0
#iface wlan0 inet manual
#    wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf

#allow-hotplug wlan1
#iface wlan1 inet manual
#    wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf

And then running systemctl reload networking.service

frbastiat

Well you were definitely on to something with trying from home. Changing the config to use the direct IP on my home network worked perfectly. Are there other ports I need to forward other than 1194 from outside of the network?