Connection resets immediately [Fixed apparently]

mark-s

Hi,

I would like to use client certificate authentication with OpenVPN on my Synology NAS.

Without client certificate authentication and the standard settings the VPN works but with manual configuration it does not. I'll post both scenarios for you to understand my problem better. Sorry for so much to read. :oops: To fix this problem, I tried to make only little changes to the original configuration, but unfortunately, I was not able to find the mistake myself. Could you please help me with it? I need it to work with TCP and port 1194. So that's no mistake.

No client certificate authentication and standard settings (works without a problem)

push "route 192.168.0.0 255.255.255.0"
push "route 10.8.0.0 255.255.255.0"
dev tun

management 127.0.0.1 1195

server 10.8.0.0 255.255.255.0

dh /var/packages/VPNCenter/target/etc/openvpn/keys/dh3072.pem
ca /var/packages/VPNCenter/target/etc/openvpn/keys/ca.crt
cert /var/packages/VPNCenter/target/etc/openvpn/keys/server.crt
key /var/packages/VPNCenter/target/etc/openvpn/keys/server.key

max-clients 5

comp-lzo

persist-tun
persist-key

verb 3

#log-append /var/log/openvpn.log

keepalive 10 60
reneg-sec 0

plugin /var/packages/VPNCenter/target/lib/radiusplugin.so /var/packages/VPNCenter/target/etc/openvpn/radiusplugin.cnf
client-cert-not-required
username-as-common-name
duplicate-cn

status /tmp/ovpn_status_2_result 30
status-version 2
proto tcp6-server
port 1194
cipher AES-256-CBC
auth SHA256

dev tun
tls-client

remote My-Domain 1194

pull

proto tcp-client

script-security 2

comp-lzo

reneg-sec 0

cipher AES-256-CBC

auth SHA256

auth-user-pass
<ca>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----

</ca>

#Logfile (Windows)

Sat Jul 25 18:55:16 2020 OpenVPN 2.4.9 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Apr 16 2020
Sat Jul 25 18:55:16 2020 Windows version 6.2 (Windows 8 or greater) 64bit
Sat Jul 25 18:55:16 2020 library versions: OpenSSL 1.1.1f  31 Mar 2020, LZO 2.10
Enter Management Password:
Sat Jul 25 18:55:18 2020 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Sat Jul 25 18:55:18 2020 TCP/UDP: Preserving recently used remote address: [AF_INET]My-Server-IP:1194
Sat Jul 25 18:55:18 2020 Attempting to establish TCP connection with [AF_INET]My-Server-IP:1194 [nonblock]
Sat Jul 25 18:55:19 2020 TCP connection established with [AF_INET]My-Server-IP:1194
Sat Jul 25 18:55:19 2020 TCP_CLIENT link local: (not bound)
Sat Jul 25 18:55:19 2020 TCP_CLIENT link remote: [AF_INET]My-Server-IP:1194
Sat Jul 25 18:55:19 2020 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Sat Jul 25 18:55:21 2020 [My-Domain] Peer Connection Initiated with [AF_INET]My-Server-IP:1194
Sat Jul 25 18:55:23 2020 open_tun
Sat Jul 25 18:55:23 2020 TAP-WIN32 device [LAN-Verbindung] opened: \\.\Global\{342100EE-5722-44EB-9788-DF576AA7CE08}.tap
Sat Jul 25 18:55:23 2020 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {342100EE-5722-44EB-9788-DF576AA7CE08} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Sat Jul 25 18:55:23 2020 Successful ARP Flush on interface [54] {342100EE-5722-44EB-9788-DF576AA7CE08}
Sat Jul 25 18:55:28 2020 Initialization Sequence Completed

My configuration with client certificate authentication which does not work

push "route 192.168.0.0 255.255.255.0"
push "route 10.8.0.0 255.255.255.0"
dev tun

management 127.0.0.1 1195

server 10.8.0.0 255.255.255.0

dh /usr/syno/etc/packages/VPNCenter/VPNcerts/dh2048.pem
ca /usr/syno/etc/packages/VPNCenter/VPNcerts/CA.crt
cert /usr/syno/etc/packages/VPNCenter/VPNcerts/Server.crt
key /usr/syno/etc/packages/VPNCenter/VPNcerts/Server.key # This file should be kept secret

max-clients 5

comp-lzo

persist-tun
persist-key

verb 4

log /var/log/openvpn.log

keepalive 10 60

plugin /var/packages/VPNCenter/target/lib/radiusplugin.so /var/packages/VPNCenter/target/etc/openvpn/radiusplugin.cnf

status /tmp/ovpn_status_2_result 30
status-version 2
proto tcp6-server
port 1194
cipher AES-256-CBC # AES
auth SHA256

tls-auth /usr/syno/etc/packages/VPNCenter/VPNcerts/ta.key 0 # This file is secret

remote-cert-tls client

dev tun
tls-client

remote My-Domain 1194

pull

proto tcp-client

comp-lzo

cipher AES-256-CBC

auth SHA256

auth-user-pass

remote-cert-tls server

key-direction 1

<cert>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
</cert>

<key>
-----BEGIN RSA PRIVATE KEY-----
...
-----END RSA PRIVATE KEY-----
</key>

<ca>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
</ca>

<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
...
-----END OpenVPN Static key V1-----
</tls-auth>

#Logfile (Windows)

Sat Jul 25 18:46:58 2020 OpenVPN 2.4.9 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Apr 16 2020
Sat Jul 25 18:46:58 2020 Windows version 6.2 (Windows 8 or greater) 64bit
Sat Jul 25 18:46:58 2020 library versions: OpenSSL 1.1.1f  31 Mar 2020, LZO 2.10
Sat Jul 25 18:47:00 2020 TCP/UDP: Preserving recently used remote address: [AF_INET]My-Server-IP:1194
Sat Jul 25 18:47:00 2020 Attempting to establish TCP connection with [AF_INET]My-Server-IP:1194 [nonblock]
Sat Jul 25 18:47:01 2020 TCP connection established with [AF_INET]My-Server-IP:1194
Sat Jul 25 18:47:01 2020 TCP_CLIENT link local: (not bound)
Sat Jul 25 18:47:01 2020 TCP_CLIENT link remote: [AF_INET]My-Server-IP:1194
Sat Jul 25 18:47:01 2020 Connection reset, restarting [0]
Sat Jul 25 18:47:01 2020 SIGUSR1[soft,connection-reset] received, process restarting

Thank you very much in advance

Regards,
Mark

TinCanTech

See your server log file.

mark-s

TinCanTech wrote See your server log file.

Unfortunately, there is no error message in the server log file.

TinCanTech

mark-s wrote there is no error message in the server log file.

I find this very difficult to believe ..

However, see your --proto options above :roll:

mark-s

TinCanTech wrote
mark-s wrote there is no error message in the server log file.
I find this very difficult to believe ..

However, see your --proto options above :roll:

I can post the log file if you want.

What's wrong with my proto options? Synology uses the same options as default and they work without an issue.

mark-s

That's weird. I wanted to show you the log file, but now the VPN connects without an issue. Maybe the system restart fixed the issue. Hopefully, that's not just a big coincidence. If the error occurs again I'll tell you. 😃

TinCanTech

mark-s wrote What's wrong with my proto options?

mark-s wrote Server configuration
proto tcp6-server

mark-s wrote Client configuration
remote My-Domain 1194
proto tcp-client

Your My-Domain must be IPv6 then ..

mark-s wrote Synology uses the same options as default and they work without an issue

I'll take your word ..

mark-s wrote That's weird. I wanted to show you the log file, but now the VPN connects without an issue. Maybe the system restart fixed the issue. Hopefully, that's not just a big coincidence.

I give up ..

mark-s

TinCanTech wrote

My server is IPv6 capable so that's no problem. I made sure that OpenVPN was running and listening on port 1194. I really don't know what has changed now but it's fine as long as it works. Now, I can finally change some of the settings I don't like from the default configuration. 🙂