Fedora client does not connect

prprgndr

Hello good people of the Open VPN community.

I have a bit of an oddity which I have tried to google an answer for but as yet have not found one:

Problem:
My Fedora 33 laptop client does not connect to my OpenVPN Server.

Oddities:
My dual booted windows client on the same laptop connects without issue.
My Android phone client connects without issue.
My Raspberry Pi 4 LibreElec box connects without issue.
In all cases above the same ovpn file was used to create the VPN connection.
All systems except for the the Raspberry Pi 4 use the downloaded Open VPN client or the one from the Google Play store.
I have even tried on a fresh Fedora 33 install.

Setup:
Server Ubuntu 20.04
Laptop Dual boot, Windows 10 and Fedora 33 KDE.
Android 9 phone Huawei P20 lite.
Raspberry Pi 4B running LibreElec.

Any assistance or advice would be most appreciated, thanks in advance!

Server config:

local x.x.x.x
port 443
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-crypt tc.key
topology subnet
server 10.8.0.0 255.255.255.0
server-ipv6 fddd:1194:1194:1194::/64
push "redirect-gateway def1 ipv6 bypass-dhcp"
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 1.1.1.1"
push "dhcp-option DNS 1.0.0.1"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 0
crl-verify crl.pem
explicit-exit-notify

Client Config:

client
dev tun
proto udp
remote x.x.x.x 443
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
auth SHA512
cipher AES-256-CBC
ignore-unknown-option block-outside-dns
block-outside-dns
verb 3
<ca>
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
-----END PRIVATE KEY-----
</key>
<tls-crypt>
-----BEGIN OpenVPN Static key V1-----
-----END OpenVPN Static key V1-----
</tls-crypt>

Fedora Client Log:

Nov  9 15:58:46 lenovo330s nm-openvpn[5650]: WARNING: file '/home/user/.local/share/networkmanagement/certificates/ideapad/private.key' is group or others accessible
Nov  9 15:58:46 lenovo330s nm-openvpn[5650]: OpenVPN 2.4.9 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Jul 28 2020
Nov  9 15:58:46 lenovo330s nm-openvpn[5650]: library versions: OpenSSL 1.1.1g FIPS  21 Apr 2020, LZO 2.10
Nov  9 15:58:46 lenovo330s nm-openvpn[5650]: WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Nov  9 15:58:46 lenovo330s nm-openvpn[5650]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Nov  9 15:58:46 lenovo330s nm-openvpn[5650]: TCP/UDP: Preserving recently used remote address: [AF_INET]x.x.x.x:443
Nov  9 15:58:46 lenovo330s nm-openvpn[5650]: UDP link local: (not bound)
Nov  9 15:58:46 lenovo330s nm-openvpn[5650]: UDP link remote: [AF_INET]x.x.x.x:443
Nov  9 15:58:46 lenovo330s nm-openvpn[5650]: NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Nov  9 15:59:46 lenovo330s nm-openvpn[5650]: TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Nov  9 15:59:46 lenovo330s nm-openvpn[5650]: TLS Error: TLS handshake failed
Nov  9 15:59:46 lenovo330s nm-openvpn[5650]: SIGUSR1[soft,tls-error] received, process restarting
Nov  9 15:59:46 lenovo330s nm-openvpn[5650]: SIGTERM[hard,init_instance] received, process exiting

Server logs:

Nov 10 16:18:07 server systemd[1]: openvpn-server@server.service: Succeeded.
Nov 10 16:18:07 server openvpn[7858]: OpenVPN 2.4.7 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Sep  5 2019
Nov 10 16:18:07 server openvpn[7858]: library versions: OpenSSL 1.1.1f  31 Mar 2020, LZO 2.10
Nov 10 16:18:07 server openvpn[7858]: Diffie-Hellman initialized with 2048 bit key
Nov 10 16:18:07 server openvpn[7858]: Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Nov 10 16:18:07 server  openvpn[7858]: Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Nov 10 16:18:07 server openvpn[7858]: Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Nov 10 16:18:07 server openvpn[7858]: Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Nov 10 16:18:07 server openvpn[7858]: TUN/TAP device tun0 opened
Nov 10 16:18:07 server openvpn[7858]: TUN/TAP TX queue length set to 100
Nov 10 16:18:07 server openvpn[7858]: /sbin/ip link set dev tun0 up mtu 1500
Nov 10 16:18:07 server openvpn[7858]: /sbin/ip addr add dev tun0 10.8.0.1/24 broadcast 10.8.0.255
Nov 10 16:18:07 server openvpn[7858]: /sbin/ip -6 addr add fddd:1194:1194:1194::1/64 dev tun0
Nov 10 16:18:07 server openvpn[7858]: Could not determine IPv4/IPv6 protocol. Using AF_INET
Nov 10 16:18:07 server openvpn[7858]: Socket Buffers: R=[212992->212992] S=[212992->212992]
Nov 10 16:18:07 server openvpn[7858]: UDPv4 link local (bound): [AF_INET]x.x.x.x:443
Nov 10 16:18:07 server openvpn[7858]: UDPv4 link remote: [AF_UNSPEC]
Nov 10 16:18:07 server openvpn[7858]: GID set to nogroup
Nov 10 16:18:07 server openvpn[7858]: UID set to nobody
Nov 10 16:18:07 server  openvpn[7858]: MULTI: multi_init called, r=256 v=256
Nov 10 16:18:07 server openvpn[7858]: IFCONFIG POOL IPv6: (IPv4) size=252, size_ipv6=65536, netbits=64, base_ipv6=fddd:1194:1194:1194::1000
Nov 10 16:18:07 server openvpn[7858]: IFCONFIG POOL: base=10.8.0.2 size=252, ipv6=1
Nov 10 16:18:07 server  openvpn[7858]: ifconfig_pool_read(), in='ideapad,10.8.0.2,fddd:1194:1194:1194::1000', TODO: IPv6
Nov 10 16:18:07 server openvpn[7858]: succeeded -> ifconfig_pool_set()
Nov 10 16:18:07 server openvpn[7858]: ifconfig_pool_read(), in='ideapad,10.8.0.3,fddd:1194:1194:1194::1001', TODO: IPv6
Nov 10 16:18:07 server openvpn[7858]: succeeded -> ifconfig_pool_set()
Nov 10 16:18:07 server openvpn[7858]: IFCONFIG POOL LIST
Nov 10 16:18:07 server openvpn[7858]: ideapad,10.8.0.2,fddd:1194:1194:1194::1000
Nov 10 16:18:07 server openvpn[7858]: ideapad,10.8.0.3,fddd:1194:1194:1194::1001
Nov 10 16:18:07 server openvpn[7858]: Initialization Sequence Completed
Nov 10 16:19:01 server openvpn[7858]: tls-crypt unwrap error: packet too short
Nov 10 16:19:01 server openvpn[7858]: TLS Error: tls-crypt unwrapping failed from [AF_INET]<home ip address>:51105
Nov 10 16:19:02 server openvpn[7858]: tls-crypt unwrap error: packet too short
Nov 10 16:19:02 server openvpn[7858]: TLS Error: tls-crypt unwrapping failed from [AF_INET]<home ip address>:51105
Nov 10 16:19:07 server openvpn[7858]: tls-crypt unwrap error: packet too short
Nov 10 16:19:07 server openvpn[7858]: TLS Error: tls-crypt unwrapping failed from [AF_INET]<home ip address>:51105
Nov 10 16:19:16 server openvpn[7858]: tls-crypt unwrap error: packet too short
Nov 10 16:19:16 server openvpn[7858]: TLS Error: tls-crypt unwrapping failed from [AF_INET]<home ip address>:51105
Nov 10 16:19:32 server openvpn[7858]: tls-crypt unwrap error: packet too short
Nov 10 16:19:32 server openvpn[7858]: TLS Error: tls-crypt unwrapping failed from [AF_INET]<home ip address>:51105

300000

tls-crypt unwrap error: packet too short
server openvpn[7858]: TLS Error: tls-crypt unwrapping failed from [AF_INET]<home ip address>:51105

Your fedora openvpn version may be not support tls-crypt so it show errors in that . What version running on that?

TinCanTech

Openvpn 2.4 all support --tls-crypt

prprgndr

Thanks for the replies.
Yes one of my concerns was with Fedora being bleeding edge, maybe there is an issue with the client being a higher version than server.

I may spin up an Fedora OpenVPN server and see if the same issue persists with the same configs.

TinCanTech

Make sure you used the correct tls-crypt key.

prprgndr

TinCanTech wrote Make sure you used the correct tls-crypt key.

All are (and will be) using the same ovpn file with included key sir.

TinCanTech

prprgndr wrote Client Config:

remote-cert-tls server

prprgndr wrote Fedora Client Log:

Nov  9 15:58:46 lenovo330s nm-openvpn[5650]: WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.

If you get this message in your log then you do not have --remote-cert-tls in your config.

prprgndr wrote

Nov  9 15:58:46 lenovo330s nm-openvpn[5650]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts

Your config does not define --script-security so why do you get this message.

Perhaps you are looking at the wrong file or reading the wrong log ?

prprgndr

Hello again TinCanTech

I can assure you that the log was taken directly from the laptop using konsole (Fedora KDE):

sudo tail -n1000 /var/log/messages | grep openvpn

I did this directly after the OpenVPN connection fails.

prprgndr

TinCanTech wrote Your config does not define --script-security so why do you get this message.

That I don't have an answer for unfortunately, bearing in mind that this was from a vanilla Fedora 33 install.

TinCanTech

prprgndr wrote I can assure you that the log was taken directly from the laptop using konsole (Fedora KDE):

sudo tail -n1000 /var/log/messages | grep openvpn

I did this directly after the OpenVPN connection fails.

That looks very fragile ...

Have you tried using the openvpn --log file ?

prprgndr

TinCanTech wrote That looks very fragile ...

Can you elaborate a bit more there, I don't understand?

TinCanTech wrote Have you tried using the openvpn --log file ?

Not as yet, would there be any difference from a OpenVPN logged file to the info being sent to the above system log?

prprgndr

Update :
Using the live USB of Fedora 33 works out the box with the ovpn file, so something must be missing on the local disk install.
I am going to play around and find it and will update here.
Thanks for the replies thus far.

prprgndr

Looks like has something to do with the KDE environment.
Boot from Fedora KDE live USB and I get the problem described above.