TLS handshake fails, server log shows no connection attempt, port confirmed open, server confirmed working

bilowik

I have a raspberry pi with a vpn set up with Pivpn, I wanted to set up a second VPN, this one without encryption, for a few reasons that I won't get into here. What I did was copy the config file, and made just a few modifications:
- Changed the LAN from 10.8.0.0 255.255.255.0 to 172.16.0.0 255.255.255.0
- cipher AES... -> cipher none
- Added ncp-disable
- Changed port
- Log destinations

I then did the same to the client config file, changing the cipher to none and ncp-disable.

When i run the second server, it runs fine, and the logs don't have any errors. And it's basically identical to the one I can connect to (not including of course the port and IP changes and whatnot).

When I try to connect to the second VPN, it fails. Client logs say TLS handshake fails check network connectivity. Server says it didn't hear jack.
Port is confirmed open, I used netcat to confirm. I tried changing ports anyway, confirm the port is open with netcat, then run server but same issue. (And yes i changed the port both client and server side).

Oddly enough, I wanted to see if I could connect to it in LAN, best I could do since I'm away is through the original VPN, so I connected to my original VPN and then attempted to connect to it (after changing the client config to use the local address), and it worked just fine. Confirmed it by SSH-ing into my pi via it's assigned IP address in the second VPN.

So the port is confirmed open, and the VPN server is confirmed functioning properly, but I just can't access it from the outside still.

I'm afraid to test it, because I'm away and don't want to permanently lose connectivity, but is the issue that when the one VPN is running, and then I run the second, it only allows connections from within the original VPN?

SELinux is not active, which I know can cause issues if not configured properly.

(I had already had these up to get help from a friend, if you need them in a textbox within this post I can add them in)
Openvpn 1st Server Config: https://pastebin.com/PKiELUQr (This one works fine).
Openvpn 2nd Server Config: https://pastebin.com/DzehnrtM
Openvpn 2nd Server Log (After trying connection): https://pastebin.com/V1iUigLM
Openvpn censored client config: https://pastebin.com/B0PTfkMS

Edit: Added logs and configs using oconf

Edit 2: Used a bash script to temporarily take down my original VPN server, start the second one, and put the original back up after a few minutes. Even with the original down, I still cannot connect to the second VPN server.
Also would like to note the open ports i had tried to use were 8080, 8081, and 143.

Edit 3: Looking at PiVPN's source, there's this file here that runs a iptables change: https://github.com/pivpn/pivpn/blob/master/firewall-openvpn-rules.txt
I haven't had much practice in iptables configuring, so I'm not sure what it does, but I ran it but with 172.16.0.0/24 instead, but it didn't seem to change much.

Edit 4: Followed the guidelines here: https://forums.openvpn.net/viewtopic.php?f=30&t=22603#p68963
And redid all the logs in verb 4 and properly placed them in BBCODE code tags

# Original server config
dev tun
proto udp
port 443
ca /etc/openvpn/easy-rsa/pki/ca.crt
cert /etc/openvpn/easy-rsa/pki/issued/server.crt
key /etc/openvpn/easy-rsa/pki/private/server.key
dh /etc/openvpn/easy-rsa/pki/dh2048.pem
topology subnet
server 10.8.0.0 255.255.255.0
# server and remote endpoints
ifconfig 10.8.0.1 10.8.0.2
# Add route to Client routing table for the OpenVPN Server
push "route 10.8.0.1 255.255.255.255"
# Add route to Client routing table for the OPenVPN Subnet
push "route 10.8.0.0 255.255.255.0"
# your local subnet
push "route 0.0.0.0 "
# Set your primary domain name server address for clients
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
client-to-client
duplicate-cn
keepalive 10 120
tls-version-min 1.2
tls-auth /etc/openvpn/easy-rsa/pki/ta.key 0
cipher AES-256-CBC
auth SHA256
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
#crl-verify /etc/openvpn/crl.pem
status /var/log/openvpn-status.log 20
status-version 3
log /var/log/openvpn.log
verb 1
# Generated for use by PiVPN.io

# Second server configuration
dev tun
proto udp
port 143 # just one of the ports I had tested since I had it opened for a mail server
ca /etc/openvpn/easy-rsa/pki/ca.crt
cert /etc/openvpn/easy-rsa/pki/issued/server.crt
key /etc/openvpn/easy-rsa/pki/private/server.key
dh /etc/openvpn/easy-rsa/pki/dh2048.pem
topology subnet
server 172.16.0.0 255.255.255.0
# server and remote endpoints
ifconfig 172.16.0.1 172.16.0.2
# Add route to Client routing table for the OpenVPN Server
push "route 172.16.0.1 255.255.255.255"
# Add route to Client routing table for the OPenVPN Subnet
push "route 172.16.0.0 255.255.255.0"
# your local subnet
push "route 0.0.0.0 "
# Set your primary domain name server address for clients
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
client-to-client
duplicate-cn
keepalive 10 120
tls-version-min 1.2
tls-auth /etc/openvpn/easy-rsa/pki/ta.key 0
cipher none
ncp-disable
auth SHA256
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
#crl-verify /etc/openvpn/crl.pem
status /var/log/openvpn2-status.log 20
status-version 3
log /var/log/openvpn2.log
verb 4
# Generated for use by PiVPN.io

Fri Mar 22 21:17:34 2019 OpenVPN 2.4.0 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Oct 14 2018
Fri Mar 22 21:17:34 2019 library versions: OpenSSL 1.0.2r  26 Feb 2019, LZO 2.08
Fri Mar 22 21:17:34 2019 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Fri Mar 22 21:17:34 2019 Diffie-Hellman initialized with 2048 bit key
Fri Mar 22 21:17:34 2019 ******* WARNING *******: null cipher specified, no encryption will be used
Fri Mar 22 21:17:34 2019 Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Mar 22 21:17:34 2019 Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Mar 22 21:17:34 2019 TUN/TAP device tun1 opened
Fri Mar 22 21:17:34 2019 TUN/TAP TX queue length set to 100
Fri Mar 22 21:17:34 2019 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Fri Mar 22 21:17:34 2019 /sbin/ip link set dev tun1 up mtu 1500
Fri Mar 22 21:17:34 2019 /sbin/ip addr add dev tun1 172.16.0.1/24 broadcast 172.16.0.255
Fri Mar 22 21:17:34 2019 Could not determine IPv4/IPv6 protocol. Using AF_INET
Fri Mar 22 21:17:34 2019 Socket Buffers: R=[163840->163840] S=[163840->163840]
Fri Mar 22 21:17:34 2019 UDPv4 link local (bound): [AF_INET][undef]:143
Fri Mar 22 21:17:34 2019 UDPv4 link remote: [AF_UNSPEC]
Fri Mar 22 21:17:34 2019 GID set to nogroup
Fri Mar 22 21:17:34 2019 UID set to nobody
Fri Mar 22 21:17:34 2019 MULTI: multi_init called, r=256 v=256
Fri Mar 22 21:17:34 2019 IFCONFIG POOL: base=172.16.0.2 size=252, ipv6=0
Fri Mar 22 21:17:34 2019 Initialization Sequence Completed

client
dev tun
proto udp
remote ******** 143
resolv-retry infinite
nobind
persist-key
persist-tun
key-direction 1
remote-cert-tls server
tls-version-min 1.2
verify-x509-name server name
cipher none
ncp-disable
auth SHA256
comp-lzo
verb 4

2019-03-22T21:10:27.171507-04:00 aflores-desktop NetworkManager[1287]: <info>  [1553303427.1712] keyfile: add connection /etc/NetworkManager/system-connections/aaronDesktop2.nmconnection (a8596eb5-b915-428d-81a7-dfcd1307e0d6,"aaronDesktop2")
2019-03-22T21:10:27.171667-04:00 aflores-desktop NetworkManager[1287]: <info>  [1553303427.1716] audit: op="connection-add" uuid="a8596eb5-b915-428d-81a7-dfcd1307e0d6" name="aaronDesktop2" pid=31048 uid=1000 result="success" 
2019-03-22T21:10:28.780047-04:00 aflores-desktop NetworkManager[1287]: <info>  [1553303428.7799] audit: op="connection-activate" uuid="a8596eb5-b915-428d-81a7-dfcd1307e0d6" name="aaronDesktop2" pid=31048 uid=1000 result="success"
2019-03-22T21:10:28.788313-04:00 aflores-desktop NetworkManager[1287]: <info>  [1553303428.7881] vpn-connection[0x55c0d5674130,a8596eb5-b915-428d-81a7-dfcd1307e0d6,"aaronDesktop2",0]: Started the VPN service, PID 6903
2019-03-22T21:10:28.799449-04:00 aflores-desktop NetworkManager[1287]: <info>  [1553303428.7974] vpn-connection[0x55c0d5674130,a8596eb5-b915-428d-81a7-dfcd1307e0d6,"aaronDesktop2",0]: Saw the service appear; activating connection
2019-03-22T21:10:37.287800-04:00 aflores-desktop NetworkManager[1287]: <info>  [1553303437.2874] vpn-connection[0x55c0d5674130,a8596eb5-b915-428d-81a7-dfcd1307e0d6,"aaronDesktop2",0]: VPN plugin: state changed: starting (3)
2019-03-22T21:10:37.287923-04:00 aflores-desktop NetworkManager[1287]: <info>  [1553303437.2875] vpn-connection[0x55c0d5674130,a8596eb5-b915-428d-81a7-dfcd1307e0d6,"aaronDesktop2",0]: VPN connection: (ConnectInteractive) reply received
2019-03-22T21:10:37.307724-04:00 aflores-desktop nm-openvpn[6929]: OpenVPN 2.4.6 x86_64-suse-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Apr 24 2018
2019-03-22T21:10:37.307860-04:00 aflores-desktop nm-openvpn[6929]: library versions: OpenSSL 1.1.0h-fips  27 Mar 2018, LZO 2.10
2019-03-22T21:10:37.307919-04:00 aflores-desktop nm-openvpn[6929]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2019-03-22T21:10:37.490330-04:00 aflores-desktop nm-openvpn[6929]: ******* WARNING *******: '--cipher none' was specified. This means NO encryption will be performed and tunnelled data WILL be transmitted in clear text over the network! PLEASE DO RECONSIDER THIS SETTING!
2019-03-22T21:10:37.490878-04:00 aflores-desktop nm-openvpn[6929]: TCP/UDP: Preserving recently used remote address: [AF_INET]x.x.x.x
2019-03-22T21:10:37.490998-04:00 aflores-desktop nm-openvpn[6929]: UDP link local: (not bound)
2019-03-22T21:10:37.491068-04:00 aflores-desktop nm-openvpn[6929]: UDP link remote: [AF_INET]x.x.x.x
2019-03-22T21:10:37.491141-04:00 aflores-desktop nm-openvpn[6929]: NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
2019-03-22T21:11:37.423550-04:00 aflores-desktop NetworkManager[1287]: <warn>  [1553303497.4230] vpn-connection[0x55c0d5674130,a8596eb5-b915-428d-81a7-dfcd1307e0d6,"aaronDesktop2",0]: VPN connection: connect timeout exceeded.
2019-03-22T21:11:37.429215-04:00 aflores-desktop nm-openvpn-serv[6903]: Connect timer expired, disconnecting.
2019-03-22T21:11:37.429485-04:00 aflores-desktop nm-openvpn[6929]: SIGTERM[hard,] received, process exiting
2019-03-22T21:11:37.435303-04:00 aflores-desktop NetworkManager[1287]: <warn>  [1553303497.4351] vpn-connection[0x55c0d5674130,a8596eb5-b915-428d-81a7-dfcd1307e0d6,"aaronDesktop2",0]: VPN plugin: failed: connect-failed (1)
2019-03-22T21:11:37.435428-04:00 aflores-desktop NetworkManager[1287]: <info>  [1553303497.4352] vpn-connection[0x55c0d5674130,a8596eb5-b915-428d-81a7-dfcd1307e0d6,"aaronDesktop2",0]: VPN plugin: state changed: stopping (5)
2019-03-22T21:11:37.435485-04:00 aflores-desktop NetworkManager[1287]: <info>  [1553303497.4352] vpn-connection[0x55c0d5674130,a8596eb5-b915-428d-81a7-dfcd1307e0d6,"aaronDesktop2",0]: VPN plugin: state changed: stopped (6)

TinCanTech

This one is missing some crucial infos:
https://forums.openvpn.net/viewtopic.php?f=30&t=22603#p68963

bilowik

Sorry about that, all should now be within those guidelines

TinCanTech

Your server log indicates that no packets are arriving at the server.

Also, on your client, we recommend that you do not use Network-Manager.

... Until you understand how Network-Manager works.

bilowik

Which I mentioned, but the server does receive packets and I do connect properly when I'm connected to the original VPN and then connect to the second VPN using the local address within the original. If you'd like the logs for that case I can provide them.

Edit: And I confirmed that the ports were open using netcat. so it's not a closed port issue.

TinCanTech

TinCanTech wrote Your server log indicates that no packets are arriving at the server.

bilowik wrote Which I mentioned, but the server does receive packets

I am taking diabolical liberties now ..

bilowik wrote When I try to connect to the second VPN, it fails. Client logs say TLS handshake fails check network connectivity. Server says it didn't hear jack.

8-) you probably did port forwarding wrong.

But on your client you must learn howto configure openvpn ;; We do not support Network-manager

bilowik

Would've replied sooner but it wouldn't let me.
I confirmed the port was open, using netcat, as i said. I even tried swapping the ports with the original server, which I KNOW is open because I can connect to it, even though I KNOW the other ports must be open else netcat would not have received communication from my client, but I tried it anyway. I know how to port forward, I've been doing this for years. I know you get a lot of people here who just jump into linux and networking that have no clue what they're doing, but take my word that the ports are forwarded and look into other possibilities.

And you also misquoted me where I said it did receive packets. I specfically said it received packets and functioned properly ONLY WHEN i was connected to the original VPN and used it's local IP address the Pi is assigned within that VPN.

aflores@aflores-desktop:~> netcat home.af469857.tk 143  
Hello                                                   
World                                                   
This                                                    
Port                                                    
Is                                                      
Open                                                    
^C                                                      
aflores@aflores-desktop:~> netcat home.af469857.tk 8080 
This Port is also open                                  
^C                                                      
aflores@aflores-desktop:~> netcat home.af469857.tk 1234 
This port is closed                                     
^C                                                      
aflores@aflores-desktop:~> netcat home.af469857.tk 1234 
This port is closed                                     
^C                                                      
aflores@aflores-desktop:~>

aflores@aflores-desktop:~> ssh pi
Linux raspberrypi 4.14.98-v7+ #1200 SMP Tue Feb 12 20:27:48 GMT 2019 armv7l 

The programs included with the Debian GNU/Linux system are free software;   
the exact distribution terms for each program are described in the          
individual files in /usr/share/doc/*/copyright.                             

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent           
permitted by applicable law.
You have new mail.
Last login: Fri Mar 22 21:54:54 2019 from 10.8.0.3                          
bu@raspberrypi:~ $ sudo -i
[sudo] password for bu:
root@raspberrypi:~# netcat -l 143
Hello
World
This
Port
Is
Open
root@raspberrypi:~# netcat -l 8080
This Port is also open
root@raspberrypi:~# netcat -l 1234
^C

bilowik

I confirmed the port was open, using netcat, as i said. I even tried swapping the ports with the original server, which I KNOW is open because I can connect to it, even though I KNOW the other ports must be open else netcat would not have received communication from my client, but I tried it anyway. I know how to port forward, I've been doing this for years. I know you get a lot of people here who just jump into linux and networking that have no clue what they're doing, but take my word that the ports are forwarded and look into other possibilities.

aflores@aflores-desktop:~> netcat home.af469857.tk 143  
Hello                                                   
World                                                   
This                                                    
Port                                                    
Is                                                      
Open                                                    
^C                                                      
aflores@aflores-desktop:~> netcat home.af469857.tk 8080 
This Port is also open                                  
^C                                                      
aflores@aflores-desktop:~> netcat home.af469857.tk 1234 
This port is closed                                     
^C                                                      
aflores@aflores-desktop:~> netcat home.af469857.tk 1234 
This port is closed                                     
^C                                                      
aflores@aflores-desktop:~>

aflores@aflores-desktop:~> ssh pi
Linux raspberrypi 4.14.98-v7+ #1200 SMP Tue Feb 12 20:27:48 GMT 2019 armv7l 

The programs included with the Debian GNU/Linux system are free software;   
the exact distribution terms for each program are described in the          
individual files in /usr/share/doc/*/copyright.                             

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent           
permitted by applicable law.
You have new mail.
Last login: Fri Mar 22 21:54:54 2019 from 10.8.0.3                          
bu@raspberrypi:~ $ sudo -i
[sudo] password for bu:
root@raspberrypi:~# netcat -l 143
Hello
World
This
Port
Is
Open
root@raspberrypi:~# netcat -l 8080
This Port is also open
root@raspberrypi:~# netcat -l 1234
^C

TinCanTech

I am so looking forward to this ..

*popcorn* and/or a nice cup of tea

TinCanTech

bilowik wrote When i run the second server, it runs fine, and the logs don't have any errors. And it's basically identical to the one I can connect to (not including of course the port and IP changes and whatnot).

When I try to connect to the second VPN, it fails. Client logs say TLS handshake fails check network connectivity. Server says it didn't hear jack.

Chaining a VPN using openvpn ..