Hi!
I already read a lot of forums, serverfault etc to find out what is the problem with my OpenVPN installation. At the moment I think I have a problem with MTU size, but I'm not sure.
I can connect to my server with UDP from LAN, and with TCP from WAN/LAN so my OpenVPN config looks valid. If I try to connect from WAN side with UDP, I get this error in the server log:
TLS: Initial packet from [AF_INET]x.x.x.55:46123, sid=f20aae82 3a80eac6
TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
TLS Error: TLS handshake failed
SIGUSR1[soft,tls-error] received, client-instance restarting
On my router (tp-link archer c7 ac1700) the default MTU value for WAN (PPOE connection): 1480, and maximum 1492. Can this cause this error? The default MTU for OpenVPN 1500?
here is my server.conf:
cert /etc/openvpn/easy-rsa/pki/issued/XXXXX
key /etc/openvpn/easy-rsa/pki/private/XXXXX
dh none
topology subnet
server 10.8.0.0 255.255.255.0
# Set your primary domain name server address for clients
push "dhcp-option DNS 1.1.1.1"
push "dhcp-option DNS 1.0.0.1"
# Prevent DNS leaks on Windows
push "block-outside-dns"
# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
client-to-client
keepalive 1800 3600
remote-cert-tls client
tls-version-min 1.2
tls-crypt /etc/openvpn/easy-rsa/pki/ta.key
cipher AES-256-CBC
auth SHA256
user nobody
group nogroup
persist-key
persist-tun
crl-verify /etc/openvpn/crl.pem
status /var/log/openvpn-status.log 20
status-version 3
syslog
verb 3
#DuplicateCNs allow access control on a less-granular, per user basis.
#Remove # if you will manage access by user instead of device.
#duplicate-cn
# Generated for use by PiVPN.io
I already tried in server.conf:
fragment 1400
mssfix 1400
And in the client:
mssfix 1400
But in the log I can see higher MTU values:
x.x.x.x:46123 Control Channel MTU parms [ L:1622 D:1156 EF:94 EB:0 ET:0 EL:3 ]
x.x.x.x:46123 Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ]
x.x.x.x:46123 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1570,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA256,keysize 256,key-method 2,tls-server'
x.x.x.x:46123 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1570,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA256,keysize 256,key-method 2,tls-client'
(Ignore the lzo part, I know it not secure just test it)
I tried to find my maximum MTU, ant the highest value: ping -D -v -s 1452 -c 1 8.8.8.8
Anything over 1452 won't work.
Anyone have this issue before? Or can give me some help on how to make it work with UDP?
