Hi,
I try to set up my VPN on VPS I did follow instruction from the internet(
https://phoenixnap.com/kb/openvpn-centos) and now I am getting this error when trying to connect:
Sat Jan 09 14:55:12 2021 DEPRECATED OPTION: --cipher set to 'AES-256-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM). Future OpenVPN version will ignore --cipher for cipher negotiations. Add 'AES-256-CBC' to --data-ciphers or change --cipher 'AES-256-CBC' to --data-ciphers-fallback 'AES-256-CBC' to silence this warning.
Sat Jan 09 14:55:12 2021 OpenVPN 2.5.0 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Oct 28 2020
Sat Jan 09 14:55:12 2021 Windows version 6.1 (Windows 7) 64bit
Sat Jan 09 14:55:12 2021 library versions: OpenSSL 1.1.1h 22 Sep 2020, LZO 2.10
Sat Jan 09 14:55:13 2021 TCP/UDP: Preserving recently used remote address: [AF_INET]xxx.xx.xx.xxx:1194
Sat Jan 09 14:55:13 2021 UDP link local (bound): [AF_INET][undef]:1194
Sat Jan 09 14:55:13 2021 UDP link remote: [AF_INET]xxx.xx.xx.xx:1194
Sat Jan 09 14:55:13 2021 OpenSSL: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
Sat Jan 09 14:55:13 2021 TLS_ERROR: BIO read tls_read_plaintext error
Sat Jan 09 14:55:13 2021 TLS Error: TLS object -> incoming plaintext read error
Sat Jan 09 14:55:13 2021 TLS Error: TLS handshake failed
Sat Jan 09 14:55:13 2021 SIGUSR1[soft,tls-error] received, process restarting
Sat Jan 09 14:55:18 2021 TCP/UDP: Preserving recently used remote address: [AF_INET]xx.xx.xx.xx:1194
Sat Jan 09 14:55:18 2021 UDP link local (bound): [AF_INET][undef]:1194
Sat Jan 09 14:55:18 2021 UDP link remote: [AF_INET]xxx.xxx.xxx.xxx:1194
Sat Jan 09 14:55:18 2021 OpenSSL: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
Sat Jan 09 14:55:18 2021 TLS_ERROR: BIO read tls_read_plaintext error
Sat Jan 09 14:55:18 2021 TLS Error: TLS object -> incoming plaintext read error
Sat Jan 09 14:55:18 2021 TLS Error: TLS handshake failed
Sat Jan 09 14:55:18 2021 SIGUSR1[soft,tls-error] received, process restarting
Sat Jan 09 14:55:23 2021 TCP/UDP: Preserving recently used remote address: [AF_INET]xxx.xxx.xxx.xxx:1194
Sat Jan 09 14:55:23 2021 UDP link local (bound): [AF_INET][undef]:1194
Sat Jan 09 14:55:23 2021 UDP link remote: [AF_INET]xxx.xxx.xxx.xxx:1194
Sat Jan 09 14:55:23 2021 TLS Error: Unroutable control packet received from [AF_INET]xxx.xxx.xxx.xxx:1194 (si=3 op=P_ACK_V1)
Sat Jan 09 14:55:24 2021 TLS Error: Unroutable control packet received from [AF_INET]xxx.xxx.xxx.xxx:1194 (si=3 op=P_CONTROL_V1)
Sat Jan 09 14:55:25 2021 TLS Error: Unroutable control packet received from [AF_INET]xxx.xxx.xxx.xxx:1194 (si=3 op=P_CONTROL_V1)
And on the server:
Sat Jan 9 13:59:39 2021 us=78472 yyy.yyy.yyy.yy:1194 Control Channel MTU parms [ L:1621 D:1156 EF:94 EB:0 ET:0 EL:3 ]
Sat Jan 9 13:59:39 2021 us=78511 yyy.yyy.yyy.yy:1194 Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ]
Sat Jan 9 13:59:39 2021 us=78571 yyy.yyy.yyy.yy:1194 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1557,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-server'
Sat Jan 9 13:59:39 2021 us=78618 yyy.yyy.yyy.yy:1194 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1557,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-client'
Sat Jan 9 13:59:39 2021 us=78676 yyy.yyy.yyy.yy:1194 TLS: Initial packet from [AF_INET]yyy.yyy.yy.yy:1194, sid=8d1b1dd5 b390e561
Sat Jan 9 13:59:44 2021 us=140229 yyy.yyy.yyy.yy:1194 TLS: new session incoming connection from [AF_INET]yyy.yyy.yyy.yy:1194
Sat Jan 9 13:59:49 2021 us=186470 yyy.yyy.yyy.yy:1194 TLS: new session incoming connection from [AF_INET]yyy.yyy.yyy.yy:1194
Sat Jan 9 14:00:39 2021 us=911783 yyy.yyy.yyy.yy:1194 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sat Jan 9 14:00:39 2021 us=911957 yyy.yyy.yyy.yy:1194 TLS Error: TLS handshake failed
Sat Jan 9 14:00:39 2021 us=912118 yyy.yyy.yyy.yy:1194 SIGUSR1[soft,tls-error] received, client-instance restarting
client
cipher AES-256-CBC
tls-client
ca ../certs/ca.crt
cert ../certs/test_client.crt
key ../certs/test_client.key
tls-crypt ../certs/myvpn2.tlsauth
remote-cert-eku "TLS Web Client Authentication"
proto udp
remote xxxxx.pl 1194 udp
dev tun
topology subnet
pull
port 1194
proto udp
dev tun
ca ca.crt
cert server2.crt
key server2.key # This file should be kept secret
dh dh.pem
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 10 120
tls-crypt myvpn2.tlsauth
cipher AES-256-CBC
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
log openvpn.log
verb 4
explicit-exit-notify 1
remote-cert-eku "TLS Web Client Authentication"
Update:
I also run this command :
openssl verify -CAfile ca.crt server2.crt
server2.crt: OK
openssl verify -CAfile ca.crt test_client.crt
test_client.crt: OK
