Raspberry Pi cannot connect to CentOS VPN

SilverNodashi

Hi,

I am trying to connect a Raspberry Pi 3 to an OpenVPN server but it keeps failing. A Windows machine with a similar config (just changed the name of the config) connects fine. I can telnet to port 1194 from the Raspberry Pi, so it's not a routing or firewall issue.

Both server and client runs openvpn 2.4, though the Pi runs 2.4.0 and the CentOS server runs 2.4.6. I am not sure if it's incompatible?

CentOS 7 Server:

root@ns1:[openvpn]$ openvpn --version
OpenVPN 2.4.6 x86_64-redhat-linux-gnu [Fedora EPEL patched] [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Apr 26 2018
library versions: OpenSSL 1.0.1e-fips 11 Feb 2013, LZO 2.03
Originally developed by James Yonan
Copyright (C) 2002-2018 OpenVPN Inc <sales@openvpn.net>
Compile time defines: enable_async_push=no enable_comp_stub=no enable_crypto=yes enable_crypto_ofb_cfb=yes enable_debug=yes enable_def_auth=yes enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown enable_fast_install=yes enable_fragment=yes enable_iproute2=yes enable_libtool_lock=yes enable_lz4=yes enable_lzo=yes enable_management=yes enable_multihome=yes enable_pam_dlopen=no enable_pedantic=no enable_pf=yes enable_pkcs11=yes enable_plugin_auth_pam=yes enable_plugin_down_root=yes enable_plugins=yes enable_port_share=yes enable_selinux=yes enable_server=yes enable_shared=yes enable_shared_with_static_runtimes=no enable_small=no enable_static=yes enable_strict=no enable_strict_options=no enable_systemd=no enable_werror=no enable_win32_dll=yes enable_x509_alt_username=yes with_aix_soname=aix with_crypto_library=openssl with_gnu_ld=yes with_mem_check=no with_sysroot=no

Raspberry Pi:

OpenVPN 2.4.0 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Jul 18 2017
library versions: OpenSSL 1.0.2l  25 May 2017, LZO 2.08
Originally developed by James Yonan
Copyright (C) 2002-2017 OpenVPN Technologies, Inc. <sales@openvpn.net>
Compile time defines: enable_async_push=no enable_comp_stub=no enable_crypto=yes enable_crypto_ofb_cfb=yes enable_debug=yes enable_def_auth=yes enable_dependency_tracking=no enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown enable_fast_install=yes enable_fragment=yes enable_iproute2=yes enable_libtool_lock=yes enable_lz4=yes enable_lzo=yes enable_maintainer_mode=no enable_management=yes enable_multi=yes enable_multihome=yes enable_pam_dlopen=no enable_password_save=yes enable_pedantic=no enable_pf=yes enable_pkcs11=yes enable_plugin_auth_pam=yes enable_plugin_down_root=yes enable_plugins=yes enable_port_share=yes enable_selinux=no enable_server=yes enable_shared=yes enable_shared_with_static_runtimes=no enable_silent_rules=no enable_small=no enable_static=yes enable_strict=no enable_strict_options=no enable_systemd=yes enable_werror=no enable_win32_dll=yes enable_x509_alt_username=yes with_crypto_library=openssl with_gnu_ld=yes with_mem_check=no with_plugindir='${prefix}/lib/openvpn' with_sysroot=no

Here's the client error:


root@ICC-Solar3:/etc/openvpn# openvpn  --config Pierre3.ovpn
Tue Nov 13 13:45:28 2018 OpenVPN 2.4.0 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Jul 18 2017
Tue Nov 13 13:45:28 2018 library versions: OpenSSL 1.0.2l  25 May 2017, LZO 2.08
Tue Nov 13 13:45:28 2018 Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Tue Nov 13 13:45:28 2018 Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Tue Nov 13 13:45:28 2018 TCP/UDP: Preserving recently used remote address: [AF_INET]x.x.x.x:1194
Tue Nov 13 13:45:28 2018 Socket Buffers: R=[87380->87380] S=[16384->16384]
Tue Nov 13 13:45:28 2018 Attempting to establish TCP connection with [AF_INET]x.x.x.x:1194 [nonblock]
Tue Nov 13 13:45:29 2018 TCP connection established with [AF_INET]x.x.x.x:1194
Tue Nov 13 13:45:29 2018 TCP_CLIENT link local: (not bound)
Tue Nov 13 13:45:29 2018 TCP_CLIENT link remote: [AF_INET]x.x.x.x:1194
Tue Nov 13 13:45:30 2018 Connection reset, restarting [0]
Tue Nov 13 13:45:30 2018 SIGUSR1[soft,connection-reset] received, process restarting
Tue Nov 13 13:45:30 2018 Restart pause, 5 second(s)
Tue Nov 13 13:45:35 2018 TCP/UDP: Preserving recently used remote address: [AF_INET]x.x.x.x:1194
Tue Nov 13 13:45:35 2018 Socket Buffers: R=[87380->87380] S=[16384->16384]
Tue Nov 13 13:45:35 2018 Attempting to establish TCP connection with [AF_INET]x.x.x.x:1194 [nonblock]
Tue Nov 13 13:45:37 2018 TCP connection established with [AF_INET]x.x.x.x:1194
Tue Nov 13 13:45:37 2018 TCP_CLIENT link local: (not bound)
Tue Nov 13 13:45:37 2018 TCP_CLIENT link remote: [AF_INET]x.x.x.x:1194
Tue Nov 13 13:45:37 2018 Connection reset, restarting [0]
Tue Nov 13 13:45:37 2018 SIGUSR1[soft,connection-reset] received, process restarting
Tue Nov 13 13:45:37 2018 Restart pause, 5 second(s)

And the client config:

client
proto tcp
remote x.x.x.x 1194
dev tun
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
verify-x509-name server_GxdZxEOWDKbetQ9i name
auth SHA256
auth-nocache
cipher AES-128-CBC
tls-client
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256
;setenv opt block-outside-dns # Prevent Windows 10 DNS leak
verb 3
<ca>

And the server config:

port 1194
proto tcp
client-to-client
dev tun
user nobody
group nobody
persist-key
persist-tun
keepalive 10 120
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 10.8.0.1"
;push "redirect-gateway def1 bypass-dhcp"
dh none
ecdh-curve prime256v1
tls-crypt tls-crypt.key 0
crl-verify crl.pem
ca ca.crt
cert server_GxdZxEOWDKbetQ9i.crt
key server_GxdZxEOWDKbetQ9i.key
auth SHA256
cipher AES-128-CBC
ncp-ciphers AES-128-CBC
tls-server
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
status /var/log/openvpn/status.log
route 10.8.0.1
push "route 10.8.0.1 255.255.255.0"
verb 7

TinCanTech

You chose to omit the most important information .. the server log. (--verb 4 not --verb 7)

SilverNodashi

This is with verb 4 in the server config:

Nov 13 15:05:21 ns1 openvpn[29741]: TCP connection established with [AF_INET]x.x.x.x:36426
Nov 13 15:05:21 ns1 openvpn[29741]: TCPv4_SERVER link local: (not bound)
Nov 13 15:05:21 ns1 openvpn[29741]: TCPv4_SERVER link remote: [AF_INET]x.x.x.x:36426
Nov 13 15:05:21 ns1 openvpn[29741]: x.x.x.x:36426 TLS: Initial packet from [AF_INET]x.x.x.x:36426, sid=90b08899 49f0aae6
Nov 13 15:05:21 ns1 openvpn[29741]: x.x.x.x:36426 tls-crypt unwrap error: packet too short
Nov 13 15:05:21 ns1 openvpn[29741]: x.x.x.x:36426 TLS Error: tls-crypt unwrapping failed from [AF_INET]x.x.x.x:36426
Nov 13 15:05:21 ns1 openvpn[29741]: x.x.x.x:36426 Fatal TLS error (check_tls_errors_co), restarting
Nov 13 15:05:21 ns1 openvpn[29741]: x.x.x.x:36426 SIGUSR1[soft,tls-error] received, client-instance restarting
Nov 13 15:05:21 ns1 openvpn[29741]: TCP/UDP: Closing socket
Nov 13 15:05:31 ns1 openvpn[29741]: MULTI: multi_create_instance called
Nov 13 15:05:31 ns1 openvpn[29741]: Re-using SSL/TLS context
Nov 13 15:05:31 ns1 openvpn[29741]: Control Channel MTU parms [ L:1623 D:1154 EF:96 EB:0 ET:0 EL:3 ]
Nov 13 15:05:31 ns1 openvpn[29741]: Data Channel MTU parms [ L:1623 D:1450 EF:123 EB:406 ET:0 EL:3 ]
Nov 13 15:05:31 ns1 openvpn[29741]: Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1571,tun-mtu 1500,proto TCPv4_SERVER,cipher AES-128-CBC,auth SHA256,keysize 128,key-method 2,tls-server'
Nov 13 15:05:31 ns1 openvpn[29741]: Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1571,tun-mtu 1500,proto TCPv4_CLIENT,cipher AES-128-CBC,auth SHA256,keysize 128,key-method 2,tls-client'
Nov 13 15:05:31 ns1 openvpn[29741]: TCP connection established with [AF_INET]x.x.x.x:36427
Nov 13 15:05:31 ns1 openvpn[29741]: TCPv4_SERVER link local: (not bound)
Nov 13 15:05:31 ns1 openvpn[29741]: TCPv4_SERVER link remote: [AF_INET]x.x.x.x:36427
Nov 13 15:05:31 ns1 openvpn[29741]: x.x.x.x:36427 TLS: Initial packet from [AF_INET]x.x.x.x:36427, sid=06c1f027 8b0b450d
Nov 13 15:05:31 ns1 openvpn[29741]: x.x.x.x:36427 tls-crypt unwrap error: packet too short
Nov 13 15:05:31 ns1 openvpn[29741]: x.x.x.x:36427 TLS Error: tls-crypt unwrapping failed from [AF_INET]x.x.x.x:36427
Nov 13 15:05:31 ns1 openvpn[29741]: x.x.x.x:36427 Fatal TLS error (check_tls_errors_co), restarting
Nov 13 15:05:31 ns1 openvpn[29741]: x.x.x.x:36427 SIGUSR1[soft,tls-error] received, client-instance restarting
Nov 13 15:05:31 ns1 openvpn[29741]: TCP/UDP: Closing socket
Nov 13 15:05:41 ns1 openvpn[29741]: MULTI: multi_create_instance called
Nov 13 15:05:41 ns1 openvpn[29741]: Re-using SSL/TLS context
Nov 13 15:05:41 ns1 openvpn[29741]: Control Channel MTU parms [ L:1623 D:1154 EF:96 EB:0 ET:0 EL:3 ]
Nov 13 15:05:41 ns1 openvpn[29741]: Data Channel MTU parms [ L:1623 D:1450 EF:123 EB:406 ET:0 EL:3 ]
Nov 13 15:05:41 ns1 openvpn[29741]: Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1571,tun-mtu 1500,proto TCPv4_SERVER,cipher AES-128-CBC,auth SHA256,keysize 128,key-method 2,tls-server'
Nov 13 15:05:41 ns1 openvpn[29741]: Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1571,tun-mtu 1500,proto TCPv4_CLIENT,cipher AES-128-CBC,auth SHA256,keysize 128,key-method 2,tls-client'
Nov 13 15:05:41 ns1 openvpn[29741]: TCP connection established with [AF_INET]x.x.x.x:36428
Nov 13 15:05:41 ns1 openvpn[29741]: TCPv4_SERVER link local: (not bound)
Nov 13 15:05:41 ns1 openvpn[29741]: TCPv4_SERVER link remote: [AF_INET]x.x.x.x:36428
Nov 13 15:05:41 ns1 openvpn[29741]: x.x.x.x:36428 TLS: Initial packet from [AF_INET]x.x.x.x:36428, sid=41f626ad 77eb458c
Nov 13 15:05:41 ns1 openvpn[29741]: x.x.x.x:36428 tls-crypt unwrap error: packet too short
Nov 13 15:05:41 ns1 openvpn[29741]: x.x.x.x:36428 TLS Error: tls-crypt unwrapping failed from [AF_INET]x.x.x.x:36428
Nov 13 15:05:41 ns1 openvpn[29741]: x.x.x.x:36428 Fatal TLS error (check_tls_errors_co), restarting
Nov 13 15:05:41 ns1 openvpn[29741]: x.x.x.x:36428 SIGUSR1[soft,tls-error] received, client-instance restarting
Nov 13 15:05:41 ns1 openvpn[29741]: TCP/UDP: Closing socket

TinCanTech

You forgot to add the TLS crypt file to your client.

Also, --tls-crypt does not require a "direction" parameter. (eg: 0 or 1 is not required)