Problem w/New Server Installation on Ubuntu 18.04

number6

I had one working on Ubuntu 14.04 since 2017. Then it was decided to move to Ubuntu 18.04, so I re-installed everything, created a new CA and client keys, and used the old server.conf. The daemon starts without error, the process for it appears in the 'ps' process list, everything looks fine. After replacing the CA, CERT and KEY sections of the Windows client .ovpn configuration file and attempting to connect, absolutely nothing happens--no errors, just a timeout. The firewall on both client and server are turned off for testing purposes just to make sure a blocked port isn't the problem. syslog on the server shows no activity--no connections from outside. Telnet to localhost:1194 on the server says connection refused, which doesn't really surprise me because that was the same behavior on Ubuntu 14.04. So I'm out of ideas of what to test, what to look for.
syslog shows this:

Nov 7 03:50:59 theglobalvoice systemd[1]: Starting OpenVPN service...
Nov 7 03:50:59 theglobalvoice systemd[1]: Started OpenVPN service.
Nov 7 03:50:59 theglobalvoice systemd[1]: Stopped OpenVPN connection to server.
Nov 7 03:50:59 theglobalvoice systemd[1]: Starting OpenVPN connection to server...
Nov 7 03:50:59 theglobalvoice systemd[1]: Started OpenVPN connection to server.

Client log shows this:

Thu Nov 07 09:43:48 2019 WARNING: --ns-cert-type is DEPRECATED. Use --remote-cert-tls instead.
Thu Nov 07 09:43:48 2019 TCP/UDP: Preserving recently used remote address: [AF_INET]92.243.28.146:1194
Thu Nov 07 09:43:48 2019 Socket Buffers: R=[65536->65536] S=[65536->65536]
Thu Nov 07 09:43:48 2019 UDP link local: (not bound)
Thu Nov 07 09:43:48 2019 UDP link remote: [AF_INET]92.243.28.146:1194
Thu Nov 07 09:43:48 2019 MANAGEMENT: >STATE:1573137828,WAIT,,,,,,
Thu Nov 07 09:44:48 2019 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Thu Nov 07 09:44:48 2019 TLS Error: TLS handshake failed
Thu Nov 07 09:44:48 2019 SIGUSR1[soft,tls-error] received, process restarting
Thu Nov 07 09:44:48 2019 MANAGEMENT: >STATE:1573137888,RECONNECTING,tls-error,,,,,
Thu Nov 07 09:44:48 2019 Restart pause, 300 second(s)

What's interesting about this is that I am NOT trying to connect to 92.243.28.146 any more. I have changed the address in my .ovpn file to 95.142.174.193, but that address never appears in the log. I have read articles that say the client will attempt to connect to the old cached address first, then if that fails, it's supposed to switch the the one in the .ovpn configuration file. But that never seems to happen. This tells me that my problem is likely on the client side, but I don't know what to look for.

Any asistance greatly appreaciated.

TinCanTech

Openvpn only connects to what ever you have configured ..

number6

Here's hoping I do this right. Notice there is no reference to 92.243.28.146 which was in the original log.

[oconf=management localhost 7505
##############################################
# Sample client-side OpenVPN 2.0 config file #
# for connecting to multi-client server. #
# #
# This configuration can be used by multiple #
# clients, however each client should have #
# its own cert and key files. #
# #
# On Windows, you might want to rename this #
# file so it has a .ovpn extension #
##############################################

# Specify that we are a client and that we
# will be pulling certain config file directives
# from the server.
client

# Use the same setting as you are using on
# the server.
# On most systems, the VPN will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
;dev tap
dev tun

# Windows needs the TAP-Win32 adapter name
# from the Network Connections panel
# if you have more than one. On XP SP2,
# you may need to disable the firewall
# for the TAP adapter.
;dev-node MyTap

# Are we connecting to a TCP or
# UDP server? Use the same setting as
# on the server.
;proto tcp
proto udp

# The hostname/IP and port of the server.
# You can have multiple remote entries
# to load balance between the servers.
remote 95.142.174.193 1194

# Choose a random host from the remote
# list for load-balancing. Otherwise
# try hosts in the order specified.
;remote-random

# Keep trying indefinitely to resolve the
# host name of the OpenVPN server. Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
resolv-retry infinite

# Most clients don't need to bind to
# a specific local port number.
nobind

# Downgrade privileges after initialization (non-Windows only)
;user nobody
;group nogroup

# Try to preserve some state across restarts.
persist-key
persist-tun

# If you are connecting through an
# HTTP proxy to reach the actual OpenVPN
# server, put the proxy server/IP and
# port number here. See the man page
# if your proxy server requires
# authentication.
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]

# Wireless networks often produce a lot
# of duplicate packets. Set this flag
# to silence duplicate packet warnings.
mute-replay-warnings

# SSL/TLS parms.
# See the server config file for more
# description. It's best to use
# a separate .crt/.key file pair
# for each client. A single ca
# file can be used for all clients.
;ca ca.crt
;cert cert.crt
;key key.key

# Verify server certificate by checking
# that the certicate has the nsCertType
# field set to "server". This is an
# important precaution to protect against
# a potential attack discussed here:
# http://openvpn.net/howto.html#mitm
#
# To use this feature, you will need to generate
# your server certificates with the nsCertType
# field set to "server". The build-key-server
# script in the easy-rsa folder will do this.
ns-cert-type server

# If a tls-auth key is used on the server
# then every client must also have the key.
;tls-auth ta.key 1

# Select a cryptographic cipher.
# If the cipher option is used on the server
# then you must also specify it here.
;cipher x

# Enable compression on the VPN link.
# Don't enable this unless it is also
# enabled in the server config file.
comp-lzo

# Set log file verbosity.
verb 3

# Silence repeating messages
mute 20

<ca>
-----BEGIN CERTIFICATE-----
MIIFOjCCBCKgAwIBAgIUNVnlq1FfyYsIpNsbjE6I9XA8Gi0wDQYJKoZIhvcNAQEL
BQAwgbwxCzAJBgNVBAYTAkdCMQswCQYDVQQIEwJDQTEPMA0GA1UEBxMGTG9uZG9u
MRkwFwYDVQQKExBUaGUgR2xvYmFsIFZvaWNlMRswGQYDVQQLExJCcm9hZGNhc3Qg
U2VydmljZXMxFzAVBgNVBAMTDnRoZWdsb2JhbHZvaWNlMRAwDgYDVQQpEwdFYXN5
UlNBMSwwKgYJKoZIhvcNAQkBFh10Z3ZwYWRtaW5AdGhlZ2xvYmFsdm9pY2UuaW5m
bzAeFw0xOTExMDYxODU5MzRaFw0yOTExMDMxODU5MzRaMIG8MQswCQYDVQQGEwJH
QjELMAkGA1UECBMCQ0ExDzANBgNVBAcTBkxvbmRvbjEZMBcGA1UEChMQVGhlIEds
b2JhbCBWb2ljZTEbMBkGA1UECxMSQnJvYWRjYXN0IFNlcnZpY2VzMRcwFQYDVQQD
Ew50aGVnbG9iYWx2b2ljZTEQMA4GA1UEKRMHRWFzeVJTQTEsMCoGCSqGSIb3DQEJ
ARYddGd2cGFkbWluQHRoZWdsb2JhbHZvaWNlLmluZm8wggEiMA0GCSqGSIb3DQEB
AQUAA4IBDwAwggEKAoIBAQD0CyRc9PBfLgmYiYusBgZ648kkmYSvqB60pJggQ3A6
JdOYR8xBTdO5Jj5aNRMlMMcjx3PnRxMW/6dGKV5mOfe8NWXRXZ4o4iBhSUkaPa7s
NwaKAhAhpAYX2tzuVgZ31SrXEMU+MUp5/aR4F8MEWJRVOQjKXOQOz1dGZjKiXWPP
pOTXW7Axy4kxULkoKjloCTyKlSBRxWjebR6CmpIUpP5ugjudSc0LtwY4Q7Mqe6Dy
mLo0H2XtoTbboZ7LgALLgzeFWJOXMdQ6vJxYSAoXwYcm58NggOrJtIQT1Pw4il75
1WG4QmD986OwcdiB/YNU571XPeaN5XXnWHrAvATp3pddAgMBAAGjggEwMIIBLDAd
BgNVHQ4EFgQU4jO6hgDGNiu5ytxi221aDUHErm8wgfwGA1UdIwSB9DCB8YAU4jO6
hgDGNiu5ytxi221aDUHErm+hgcKkgb8wgbwxCzAJBgNVBAYTAkdCMQswCQYDVQQI
EwJDQTEPMA0GA1UEBxMGTG9uZG9uMRkwFwYDVQQKExBUaGUgR2xvYmFsIFZvaWNl
MRswGQYDVQQLExJCcm9hZGNhc3QgU2VydmljZXMxFzAVBgNVBAMTDnRoZWdsb2Jh
bHZvaWNlMRAwDgYDVQQpEwdFYXN5UlNBMSwwKgYJKoZIhvcNAQkBFh10Z3ZwYWRt
aW5AdGhlZ2xvYmFsdm9pY2UuaW5mb4IUNVnlq1FfyYsIpNsbjE6I9XA8Gi0wDAYD
VR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEA42oUr4d625dJXc8yvCgIDb7+
UFAdrTpBtWkjqn9Q4jQ8v8MLlPKWXRHfJLt2Wcya9RiaUrnY7gBEIzidWzgjfoxH
K3hsVmIdXG+2vduXbNzpQLzkCy6jKiBheVRBEvihngGZb4kXoH4XDlACNfxiKWeI
AaCG05d/nW2V2eznZCnlYZMhUeCGrAwxAnKSXZWDSSFkjMxQEvPYUFZ862NgQn0m
ZEZZDdu/m1l7uINp8vDZQlhMbINhmpd0Lx+mbVJrYmqqBOw7ofslsD8jM8kWemjl
NwIumxE1lpIREAP13am3vldJ0xPHf+S5apcs/QJ4vzyPeczdwsE7u9JS5/tKJQ==
-----END CERTIFICATE-----
</ca>

<cert>
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 2 (0x2)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=GB, ST=CA, L=London, O=The Global Voice, OU=Broadcast Services, CN=theglobalvoice/name=EasyRSA/emailAddress=tgvpadmin@theglobalvoice.info
Validity
Not Before: Nov 6 19:05:18 2019 GMT
Not After : Nov 3 19:05:18 2029 GMT
Subject: C=US, ST=NY, L=New York, O=The GLobal Voice, OU=Broadcast Services, CN=Steve/name=EasyRSA/emailAddress=steve@theglobalvoice.info
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public-Key: (2048 bit)
Modulus:
00:a6:c0:df:a5:a3:7d:7d:a0:9b:ae:83:44:7d:0f:
2c:c2:13:66:d7:e9:59:55:c8:1a:47:4f:7b:2e:9f:
9b:9a:c0:a4:86:c5:c1:40:be:64:06:a1:81:92:f6:
31:e8:fb:21:7d:ee:fd:bf:6f:3e:3e:69:fc:9b:5c:
89:bb:9e:6d:69:de:b8:21:58:3b:9f:63:c6:c2:c7:
5d:b1:e9:c0:50:f9:68:ae:b1:a0:b3:ad:12:68:d8:
0b:fc:5f:01:e6:06:5a:d4:b9:ad:42:7b:54:18:84:
06:83:d0:14:3f:82:33:52:f8:20:7f:aa:c4:2d:14:
93:c5:59:b5:30:2e:74:38:88:0c:78:d3:50:48:de:
f0:f4:f0:03:ca:86:7d:44:ca:1d:4a:19:1b:78:70:
c1:62:aa:bc:b6:fb:de:4a:78:51:fe:e3:65:92:30:
89:1a:be:0a:a3:d6:21:69:ed:d0:cc:fc:9d:28:5c:
80:71:64:b3:31:08:d7:1e:74:e8:48:36:6d:42:48:
77:70:82:1a:24:89:40:87:35:b7:bd:ab:05:d8:88:
23:73:ac:b3:d7:47:72:44:f5:7d:41:50:3b:12:3d:
e9:1e:42:84:2b:29:ea:93:37:71:75:6f:7a:0d:97:
2f:b3:31:dc:72:b4:db:7a:84:d9:b6:8c:64:d6:00:
ec:4d
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
Easy-RSA Generated Certificate
X509v3 Subject Key Identifier:
99:29:07:09:C5:1F:42:42:A8:D9:C6:E6:75:F1:96:F6:13:C3:BD:03
X509v3 Authority Key Identifier:
keyid:E2:33:BA:86:00:C6:36:2B:B9:CA:DC:62:DB:6D:5A:0D:41:C4:AE:6F
DirName:/C=GB/ST=CA/L=London/O=The Global Voice/OU=Broadcast Services/CN=theglobalvoice/name=EasyRSA/emailAddress=tgvpadmin@theglobalvoice.info
serial:35:59:E5:AB:51:5F:C9:8B:08:A4:DB:1B:8C:4E:88:F5:70:3C:1A:2D

X509v3 Extended Key Usage:
TLS Web Client Authentication
X509v3 Key Usage:
Digital Signature
X509v3 Subject Alternative Name:
DNS:steve
Signature Algorithm: sha256WithRSAEncryption
96:d7:5d:34:09:33:be:f3:47:41:a8:75:be:8c:78:74:0c:76:
f7:62:e6:2b:97:0c:9a:04:01:8f:b1:aa:fe:e3:81:27:62:0b:
69:5f:68:49:e2:ac:39:a0:59:39:72:fa:f8:1a:5f:80:69:7f:
29:90:c1:d0:bf:ef:f7:95:c3:a2:8f:fb:04:86:6b:f9:ca:63:
f8:94:9a:b1:9b:06:51:9c:94:14:da:56:29:f3:72:1e:c1:60:
55:1d:2c:16:c9:79:3b:2f:9a:7f:18:cd:a5:17:17:df:c1:4f:
8f:9f:5e:dd:70:87:13:dd:52:db:0c:f7:d0:28:41:9b:dc:d3:
5e:a0:d0:a4:29:8b:01:16:fc:54:28:3b:9d:6c:2f:ca:d8:71:
14:3e:6c:69:19:1b:85:93:33:85:58:87:78:43:1d:e4:20:84:
fe:03:e7:29:b6:f7:73:72:42:18:a1:d2:d9:79:45:24:b7:e7:
8d:ba:65:da:ae:16:ff:6f:38:32:38:a1:19:60:7d:3f:d1:a2:
b1:f8:9e:c9:67:02:43:21:6c:04:b1:01:ce:1f:35:3c:3d:e7:
f9:89:eb:c8:4f:3f:05:a7:33:4a:08:0e:40:0c:4c:e8:29:4e:
ed:d7:88:ce:89:27:1d:3d:b7:3e:9b:c0:76:14:2f:d2:82:5b:
82:3e:71:f5
-----BEGIN CERTIFICATE-----
MIIFfDCCBGSgAwIBAgIBAjANBgkqhkiG9w0BAQsFADCBvDELMAkGA1UEBhMCR0Ix
CzAJBgNVBAgTAkNBMQ8wDQYDVQQHEwZMb25kb24xGTAXBgNVBAoTEFRoZSBHbG9i
YWwgVm9pY2UxGzAZBgNVBAsTEkJyb2FkY2FzdCBTZXJ2aWNlczEXMBUGA1UEAxMO
dGhlZ2xvYmFsdm9pY2UxEDAOBgNVBCkTB0Vhc3lSU0ExLDAqBgkqhkiG9w0BCQEW
HXRndnBhZG1pbkB0aGVnbG9iYWx2b2ljZS5pbmZvMB4XDTE5MTEwNjE5MDUxOFoX
DTI5MTEwMzE5MDUxOFowgbExCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJOWTERMA8G
A1UEBxMITmV3IFlvcmsxGTAXBgNVBAoTEFRoZSBHTG9iYWwgVm9pY2UxGzAZBgNV
BAsTEkJyb2FkY2FzdCBTZXJ2aWNlczEOMAwGA1UEAxMFU3RldmUxEDAOBgNVBCkT
B0Vhc3lSU0ExKDAmBgkqhkiG9w0BCQEWGXN0ZXZlQHRoZWdsb2JhbHZvaWNlLmlu
Zm8wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCmwN+lo319oJuug0R9
DyzCE2bX6VlVyBpHT3sun5uawKSGxcFAvmQGoYGS9jHo+yF97v2/bz4+afybXIm7
nm1p3rghWDufY8bCx12x6cBQ+WiusaCzrRJo2Av8XwHmBlrUua1Ce1QYhAaD0BQ/
gjNS+CB/qsQtFJPFWbUwLnQ4iAx401BI3vD08APKhn1Eyh1KGRt4cMFiqry2+95K
eFH+42WSMIkavgqj1iFp7dDM/J0oXIBxZLMxCNcedOhINm1CSHdwghokiUCHNbe9
qwXYiCNzrLPXR3JE9X1BUDsSPekeQoQrKeqTN3F1b3oNly+zMdxytNt6hNm2jGTW
AOxNAgMBAAGjggGQMIIBjDAJBgNVHRMEAjAAMC0GCWCGSAGG+EIBDQQgFh5FYXN5
LVJTQSBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYEFJkpBwnFH0JCqNnG
5nXxlvYTw70DMIH8BgNVHSMEgfQwgfGAFOIzuoYAxjYrucrcYtttWg1BxK5voYHC
pIG/MIG8MQswCQYDVQQGEwJHQjELMAkGA1UECBMCQ0ExDzANBgNVBAcTBkxvbmRv
bjEZMBcGA1UEChMQVGhlIEdsb2JhbCBWb2ljZTEbMBkGA1UECxMSQnJvYWRjYXN0
IFNlcnZpY2VzMRcwFQYDVQQDEw50aGVnbG9iYWx2b2ljZTEQMA4GA1UEKRMHRWFz
eVJTQTEsMCoGCSqGSIb3DQEJARYddGd2cGFkbWluQHRoZWdsb2JhbHZvaWNlLmlu
Zm+CFDVZ5atRX8mLCKTbG4xOiPVwPBotMBMGA1UdJQQMMAoGCCsGAQUFBwMCMAsG
A1UdDwQEAwIHgDAQBgNVHREECTAHggVzdGV2ZTANBgkqhkiG9w0BAQsFAAOCAQEA
ltddNAkzvvNHQah1vox4dAx292LmK5cMmgQBj7Gq/uOBJ2ILaV9oSeKsOaBZOXL6
+BpfgGl/KZDB0L/v95XDoo/7BIZr+cpj+JSasZsGUZyUFNpWKfNyHsFgVR0sFsl5
Oy+afxjNpRcX38FPj59e3XCHE91S2wz30ChBm9zTXqDQpCmLARb8VCg7nWwvythx
FD5saRkbhZMzhViHeEMd5CCE/gPnKbb3c3JCGKHS2XlFJLfnjbpl2q4W/284Mjih
GWB9P9GisfieyWcCQyFsBLEBzh81PD3n+YnryE8/BaczSggOQAxM6ClO7deIzokn
HT23PpvAdhQv0oJbgj5x9Q==
-----END CERTIFICATE-----
</cert>

<key>
-----BEGIN PRIVATE KEY-----
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCmwN+lo319oJuu
g0R9DyzCE2bX6VlVyBpHT3sun5uawKSGxcFAvmQGoYGS9jHo+yF97v2/bz4+afyb
XIm7nm1p3rghWDufY8bCx12x6cBQ+WiusaCzrRJo2Av8XwHmBlrUua1Ce1QYhAaD
0BQ/gjNS+CB/qsQtFJPFWbUwLnQ4iAx401BI3vD08APKhn1Eyh1KGRt4cMFiqry2
+95KeFH+42WSMIkavgqj1iFp7dDM/J0oXIBxZLMxCNcedOhINm1CSHdwghokiUCH
Nbe9qwXYiCNzrLPXR3JE9X1BUDsSPekeQoQrKeqTN3F1b3oNly+zMdxytNt6hNm2
jGTWAOxNAgMBAAECggEAONRco/eu6eSVigkEi1Zjm5S/JPBK2NhEVG86/O26OyhS
Kfg1X1pDfpsGLM6ovczwYhnT8qz32o+GXnBQJFfe1AjqWbrXPv/jGjiVru+J8k69
pWO17+YY8xBGLXE3lWwvAnZxHMopI93C1qNQc0BtO2aCtN++0dpEbiqffFcolqcB
+MGNWU9ihmxXV0vGkltX10AwCzTLVPF6JOvYdbGRkJH9k+8+8UrapSEUbdLI4rx5
o5ZkHg/hqHQpBEAVkvuX0tEedVo6ks5GM5gvGATF6sO3BvYwH/Qqz/nKevyhfrXr
PGeT7ry9PFX6YnUyv7bs+c/siAuzMgXtuw7xCqPMIQKBgQDbs8Sd2vE/MBe+qXpw
7/ElNDU8xMoStHz/ay4SCPVa4LcsjSDxuhi9cxGEzyWpMA05FmgJAOmSaoqkWNzI
6WAdd7WNYekvWPZkzHaTmZPRZpUl9sip3lF8iMsqYJ3QxoeaDAaLx3m2eBdZ74tP
5Qy3voVez130j0nyoZjgQ0WfGQKBgQDCTadMcZCgUJPYeZ9tCIwO1Jd8Iw/chO4C
ujFipuEzlsGdUreCMJyLn4+ssrkhsVgxjp/8GtmCCV/05WwuDWMw9zrWoqFmV4Y9
H0Yhd9Ii+JtjydTiqxMEsOoTL9bwROkYy7Y08zqDhi0pXTTgZBmtHmVgrKHh76cm
qSgOyOQBVQKBgFrzyfK7n+HTzBCvYrP8cS1AtsVohmtF8vVebp0ivkgX/VzhNAE+
VF2hlGARzXqEHQVEJF+N1CQ8HRc6fnRiQNsSIsPcA8gJIT/LcU9bZdlriVVFG/9O
vRc8Hjd19f9nIN4CGnelZdrHTot54od5wFEU+2urly7WXvumMH6u+tSJAoGBAKcA
JzLEyRGBMBF3N1d3aSm1/x1q5U8b0ZX2gkvQMu8sO+0EE0WKkoJO+iXs1sHms26k
r0z3psrlU9wg9AIA76g+Vgv0a9SSlYYjQxuw6KO2GZiC+L55WzdE92rWS17nW5E8
Rbbs9vXkdRyAR9o1Lvxki62zss+GM5w+93b9ozqhAoGBAJS6XLhAAc48uX5+BGiq
lVprbsX9UXgqM4+htpe3kzxA2M5OkUQuUMPGgmAf71nDi8manukZkoT5Gza+r6da
bJPrinJ/KbrYXp5KkjHK8mDmT0wQrpr4hmGRapDV0HuY1ovyHkbg3yqRJ3fR1p8o
afwh+qnGE2QTKxwTUTLauRWZ
-----END PRIVATE KEY-----
</key>
[/oconf]

number6

Sorry, if I could have deleted the other one, I would. Here it is, correctly done.

management localhost 7505
##############################################
# Sample client-side OpenVPN 2.0 config file #
# for connecting to multi-client server. #
# #
# This configuration can be used by multiple #
# clients, however each client should have #
# its own cert and key files. #
# #
# On Windows, you might want to rename this #
# file so it has a .ovpn extension #
##############################################

# Specify that we are a client and that we
# will be pulling certain config file directives
# from the server.
client

# Use the same setting as you are using on
# the server.
# On most systems, the VPN will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
;dev tap
dev tun

# Windows needs the TAP-Win32 adapter name
# from the Network Connections panel
# if you have more than one. On XP SP2,
# you may need to disable the firewall
# for the TAP adapter.
;dev-node MyTap

# Are we connecting to a TCP or
# UDP server? Use the same setting as
# on the server.
;proto tcp
proto udp

# The hostname/IP and port of the server.
# You can have multiple remote entries
# to load balance between the servers.
remote 95.142.174.193 1194

# Choose a random host from the remote
# list for load-balancing. Otherwise
# try hosts in the order specified.
;remote-random

# Keep trying indefinitely to resolve the
# host name of the OpenVPN server. Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
resolv-retry infinite

# Most clients don't need to bind to
# a specific local port number.
nobind

# Downgrade privileges after initialization (non-Windows only)
;user nobody
;group nogroup

# Try to preserve some state across restarts.
persist-key
persist-tun

# If you are connecting through an
# HTTP proxy to reach the actual OpenVPN
# server, put the proxy server/IP and
# port number here. See the man page
# if your proxy server requires
# authentication.
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]

# Wireless networks often produce a lot
# of duplicate packets. Set this flag
# to silence duplicate packet warnings.
mute-replay-warnings

# SSL/TLS parms.
# See the server config file for more
# description. It's best to use
# a separate .crt/.key file pair
# for each client. A single ca
# file can be used for all clients.
;ca ca.crt
;cert cert.crt
;key key.key

# Verify server certificate by checking
# that the certicate has the nsCertType
# field set to "server". This is an
# important precaution to protect against
# a potential attack discussed here:
# http://openvpn.net/howto.html#mitm
#
# To use this feature, you will need to generate
# your server certificates with the nsCertType
# field set to "server". The build-key-server
# script in the easy-rsa folder will do this.
ns-cert-type server

# If a tls-auth key is used on the server
# then every client must also have the key.
;tls-auth ta.key 1

# Select a cryptographic cipher.
# If the cipher option is used on the server
# then you must also specify it here.
;cipher x

# Enable compression on the VPN link.
# Don't enable this unless it is also
# enabled in the server config file.
comp-lzo

# Set log file verbosity.
verb 3

# Silence repeating messages
mute 20

There is no reference in this config to the 92.243.28.146 address. Also apologies for posting the certs. Guess I'll have to regen those now (LOL).

TinCanTech

You are either using the wrong config file or reading the wrong log file.

Your other post has been deleted but making a new PKI is a decent idea:
https://github.com/OpenVPN/easy-rsa/releases

number6

Problem solved!

When I installed originally, I told the installer to put configs and logs in "C:\Program files\Openvpn\Config" and "...\Log" respectively. At one time, I was having OpenVPN autoconnect at startup by modifying the Registry entry to add my client configuration filename when running the executable. But I decided along the way that I didn't want to autoconnect at startup any more, so I removed that exstra string from the end of the OpenVPN command and connected manually whenever I needed it.

The file always lived in "C:\Program files\OpenVPN\Config". Probably through a software update to at least 2.4.7, maybe even 2.4.8, that path got changed to to "C:\Users\{my-name}\Openvpn...", and a copy of the client configuration from that location is what was being used.

I grew suspicious of things generally when I couldn't find the log in "C:\Program files\OpenVPN\Log". Opening the OpenVPN settings dialog and looking on the Advanced tab told me everything I needed to know. I didn't change anything there, just copied the correct config to the location where OpenVPN was really looking for it, tried the connect, and it came right up!

TinCanTech

Thanks for letting us know what you found. I must admit I forgot about that change ..

The change of location is the result of the new InteractiveService, which allows non-admin Windows users to use openvpn. This is also very closely tied to the new GUI.

Some info:
https://community.openvpn.net/openvpn/wiki/OpenVPN-GUI-New