client side reset tls-timeout value failure

lsm128

Hi~ I know you probably solved many problems like this. I am a new user of OpenVPN and have tried different methods to change the "tls-timeout" value for the client side. But I still keep getting " TLS Error: TLS key negotiation failed to occur within 60 seconds ". The following is the config files for server and client.

server config file (server version openvpn-1.4.7):

port 1194

proto udp

dev tun

ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key

dh none

server 10.8.0.0 255.255.255.0

ifconfig-pool-persist ipp.txt

keepalive 10 120

tls-auth /etc/openvpn/ta.key 0 # This file is secret
key-direction 0

cipher AES-256-CBC
auth SHA384

user lw
group lw

persist-key
persist-tun

status openvpn-status.log

verb 3

explicit-exit-notify 1

client config file (client version openvpn-2.3.10):

# Specify that we are a client and that we
# will be pulling certain config file directives
# from the server.
client

dev tun
tls-timeout 900 # added new value for tls-client

proto udp

script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

remote 192.168.0.6 1194

resolv-retry infinite

# Most clients don't need to bind to
# a specific local port number.
nobind

# Downgrade privileges after initialization (non-Windows only)
user lw
group lw

# Try to preserve some state across restarts.
persist-key
persist-tun

ca ca.crt
cert client.crt
key client.key

remote-cert-tls server

tls-auth ta.key 1

cipher AES-256-CBC
auth SHA384
key-direction 1

verb 3

# Silence repeating messages
;mute 20

<ca>
-----BEGIN CERTIFICATE-----
MIIBpz......
-----END CERTIFICATE-----
</ca>
<cert>
Certificate:
Data:
Version: 3 (0x2)
..........
-----BEGIN CERTIFICATE-----
MIIBv......
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
MIGE.....
-----END PRIVATE KEY-----
</key>
<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
335.......
-----END OpenVPN Static key V1-----
</tls-auth>

The methods I already tried:
1 When starting openvpn client, add command option like this "openvpn --config client2.ovpn --tls-timeout 900"
2 Add tls-timeout line in the client configuration file "client2.ovpn" ( see the line "tls-timeout 900 # added new value for tls-client" in client configuration file )

But both the above methods do not work to me. The message " TLS Error: TLS key negotiation failed to occur within 60 seconds " is still there.

(Actually, I tried the above server/client configuration files and they work well. When running normally, the client side can successfully set up TLS connection with the server. But I got a requirement that asks analyzing the program execution statistic of the openvpn server. When running with the analysis, the openvpn server execution becomes quite slow. So I need to extend the tls-timeout value for the openvpn client side. So that the analysis can be finished with the TLS handshake process)

Can anyone help me solve this, please? Any suggestion or comment is welcome. Sincerely appreciate your help.

TinCanTech

lsm128 wrote The methods I already tried:
1 When starting openvpn client, add command option like this "openvpn --config client2.ovpn --tls-timeout 900"

See --tls-timeout in the manual.

Then grep for other "timeout"s :roll:

lsm128

Hi, TinCanTech,

Thank you for your quick response. I appreciate your help.

I read the option "--tls-timeout" in the manual. It says "--tls-timeout" applies to "packet retransmit timeout on TLS control channel if no acknowledgment from remote within n seconds (default = 2)" Here, do the packages over "TLS control channel" include the TLS handshake package?

The follow up question is : is there a way to set the time of "TLS key negotiation" in openvpn? (since the error is "TLS Error: TLS key negotiation failed to occur within 60 seconds")

Please forgive me if my question is a little bit naive (I am exactly a first day user of openvpn). Thanks again~

lsm128

Hi, here is an link, someone used "tls-timeout" flag to solve the "TSL Error: TLS key negotiation failed to occur within 60 seconds" (see the link, https://tech.michaelaltfield.net/2009/01/25/resolved-openvpn ) However, I followed the exactly same steps but still no success. Each time I change the "tls-timeout" value (to 900 or 1200) either in command line option or configuration file, I will finally get "TSL Error: TLS key negotiation failed to occur within 60 seconds". Seems like the "tls-timeout" value change does not take effect (I am using a configuration file in command line "openvpn --config client2.ovpn". the file content is attached as client config file).

Just wondering where I do wrong? Is this just a configuration problem or something else?

I have been stuck on this error for three days. Please give some help~ Appreciate your time and help!