for an Ubuntu 16.04 machine with OpenVPN installed, this is the first time I experience this... and I am not sure how to proceed.
Openvpn Server config:
management localhost 7505
port 1196
proto udp
dev tun
topology subnet
ca /etc/openvpn/ca.JFINCR.crt
cert /etc/openvpn/JFINCRSERVER.crt
key /etc/openvpn/JFINCRSERVER.key # This file should be kept secret
dh /etc/openvpn/dh2048.pem
server 10.9.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.111.0 255.255.255.0"
push "dhcp-option DNS 192.168.111.1"
keepalive 10 120
tls-auth /etc/openvpn/ta.JFINCR.key 0 # This file is secret
key-direction 0
cipher AES-128-CBC # AES
auth SHA256
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log-append openvpn.log
verb 6
this is the client config:
client
dev tun
proto udp
remote 192.168.111.1 1196
;remote example.com 1196
resolv-retry infinite
nobind
persist-key
persist-tun
ca JFINCR.ca.crt
cert JFINCR.KSS1XMAC.crt
key JFINCR.KSS1XMAC.key
tls-auth JFINCR.ta.key 1
cipher AES-128-CBC
auth SHA256
key-direction 1
comp-lzo
verb 3
when I connect to the server using this config file, but only within the LAN, I am able to connect successfully.
but, when I use the same client config, but change the remote to use the WAN side, and use my android phone (for internet) to connect the same VPN server...
A check with the iptables packet counters reveals that the handshake attempt is reaching the 1196 port (packet count is getting updated)...
but for some reason.. the handshake is unable to complete successfully... considering that I have no problems using the same set of config files through the LAN...
here is an excerpt of the openvpn.log
Mon Apr 16 19:05:05 2018 us=177134 MULTI: multi_create_instance called
Mon Apr 16 19:05:05 2018 us=177227 110.54.227.242:36409 Re-using SSL/TLS context
Mon Apr 16 19:05:05 2018 us=177280 110.54.227.242:36409 LZO compression initializedMon Apr 16 19:05:05 2018 us=177392 110.54.227.242:36409 Control Channel MTU parm
s [ L:1570 D:1172 EF:78 EB:0 ET:0 EL:3 ]
Mon Apr 16 19:05:05 2018 us=177412 110.54.227.242:36409 Data Channel MTU parms [ L:1570 D:1450 EF:70 EB:143 ET:0 EL:3 AF:3/1 ]
Mon Apr 16 19:05:05 2018 us=177457 110.54.227.242:36409 Local Options String: 'V4,dev-type tun,link-mtu 1570,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher AES-128-CBC,auth SHA256,keysize 128,tls-auth,key-method 2,tls-server'
Mon Apr 16 19:05:05 2018 us=177474 110.54.227.242:36409 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1570,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher AES-128-CBC,auth SHA256,keysize 128,tls-auth,key-method 2,tls-client'
Mon Apr 16 19:05:05 2018 us=177500 110.54.227.242:36409 Local Options hash (VER=V4): '1089825c'
Mon Apr 16 19:05:05 2018 us=177524 110.54.227.242:36409 Expected Remote Options hash (VER=V4): '6907942a'
Mon Apr 16 19:05:05 2018 us=177559 110.54.227.242:36409 TLS: Initial packet from [AF_INET]110.54.227.242:36409, sid=540a88f9 ea6ce101
Mon Apr 16 19:05:25 2018 us=298347 110.54.227.242:46349 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
