Hi Guys, I've just installed OpenVPN 2.5.1 server on a Debian Linux box on my local LAN using a script I got from [url here]https://git.io/vpn[/url] I ran the script on the server and copied the auto generated *.ovpn file to the Win 10 client [quote] C:\Program Files\OpenVPN\config\ [/quote] But when I try to connect from the Win 10 box ( also on my LAN ) using OpenVPN GUI I see this [quote] TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) TLS Error: TLS handshake failed [/quote] I've tried disabling the firewall but with no success, any ideas ? Edit I've also tried running this on the server box but I still get the same error [quote] openvpn --config myclient.ovpn [/quote]

TLS handshake problem

pkfox

Hi Guys, I've just installed OpenVPN 2.5.1 server on a Debian Linux box on my local LAN using a script I got from https://git.io/vpn
I ran the script on the server and copied the auto generated *.ovpn file to the Win 10 client

C:\Program Files\OpenVPN\config\

But when I try to connect from the Win 10 box ( also on my LAN ) using OpenVPN GUI I see this

TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
TLS Error: TLS handshake failed

I've tried disabling the firewall but with no success, any ideas ?

Edit
I've also tried running this on the server box but I still get the same error

openvpn --config myclient.ovpn

TinCanTech

Please start here: https://forums.openvpn.net/viewtopic.php?f=30&t=22603

pkfox

C:\Program Files\OpenVPN\config\

But when I try to connect from the Win 10 box ( also on my LAN ) using OpenVPN GUI I see this

TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
TLS Error: TLS handshake failed

I've tried disabling the firewall but with no success, any ideas ?

Edit
I've also tried running this on the server box but I still get the same error

openvpn --config myclient.ovpn
server.conf

local 10.10.1.4
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-crypt tc.key
topology subnet
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
verb 3
crl-verify crl.pem
explicit-exit-notify

client.ovpn

client
proto udp
explicit-exit-notify
remote xx.xx.xx.xx 1194
dev tun
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
verify-x509-name server_gU3cqcKWtSoTssNb name
auth SHA256
auth-nocache
cipher AES-128-GCM
tls-client
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
ignore-unknown-option block-outside-dns
setenv opt block-outside-dns # Prevent Windows 10 DNS leak
verb 3
<ca>
-----BEGIN CERTIFICATE-----
><
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
><-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
><-----END PRIVATE KEY-----
</key>
<tls-crypt>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
><----END OpenVPN Static key V1-----
</tls-crypt>

Log from OpenVPNGUI

Thu Aug 19 08:52:32 2021 OpenVPN 2.5.3 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Jun 17 2021
Thu Aug 19 08:52:32 2021 Windows version 10.0 (Windows 10 or greater) 64bit
Thu Aug 19 08:52:32 2021 library versions: OpenSSL 1.1.1k 25 Mar 2021, LZO 2.10
Thu Aug 19 08:52:32 2021 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Thu Aug 19 08:52:32 2021 Need hold release from management interface, waiting...
Thu Aug 19 08:52:33 2021 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Thu Aug 19 08:52:33 2021 MANAGEMENT: CMD 'state on'
Thu Aug 19 08:52:33 2021 MANAGEMENT: CMD 'log all on'
Thu Aug 19 08:52:33 2021 MANAGEMENT: CMD 'echo all on'
Thu Aug 19 08:52:33 2021 MANAGEMENT: CMD 'bytecount 5'
Thu Aug 19 08:52:33 2021 MANAGEMENT: CMD 'hold off'
Thu Aug 19 08:52:33 2021 MANAGEMENT: CMD 'hold release'
Thu Aug 19 08:52:33 2021 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Thu Aug 19 08:52:33 2021 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Thu Aug 19 08:52:33 2021 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Thu Aug 19 08:52:33 2021 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Thu Aug 19 08:52:33 2021 TCP/UDP: Preserving recently used remote address: [AF_INET]xx.xx.xx.xxx:1194
Thu Aug 19 08:52:33 2021 Socket Buffers: R=[65536->65536] S=[65536->65536]
Thu Aug 19 08:52:33 2021 UDP link local: (not bound)
Thu Aug 19 08:52:33 2021 UDP link remote: [AF_INET]xx.xx.xx.xxx:1194
Thu Aug 19 08:52:33 2021 MANAGEMENT: >STATE:1629359553,WAIT,,,,,,
Thu Aug 19 08:53:33 2021 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Thu Aug 19 08:53:33 2021 TLS Error: TLS handshake failed

TinCanTech

You have not read Nyr's help section yet.

pkfox

If you send me a link of where and what to post it would be a lot easier for all concerned

TinCanTech

https://community.openvpn.net/openvpn/wiki/GettingHelp#Introduction

pkfox

I've read that and still can't see what I've missed - thanks anyway

300000

You need post server log to see if your server is running or not. At the moment client can't connect so not sure why . First check firewall then checking openvpn and port forwarding too. Many things can stop it connects.

pkfox

300000 wrote You need post server log to see if your server is running or not. At the moment client can't connect so not sure why . First check firewall then checking openvpn and port forwarding too. Many things can stop it connects.

Hi there I get the same error when running

openvpn --config myclient.ovpn

on the server

Here's the server log - I think you're right it doesn't look like it's running

2021-08-18 12:14:28 WARNING: --topology net30 support for server configs with IPv4 pools will be removed in a future release. Please migrate to --topology subnet as soon as possible.
2021-08-18 12:14:28 DEPRECATED OPTION: --cipher set to 'AES-256-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM). Future OpenVPN version will ignore --cipher for cipher negotiations. Add 'AES-256-CBC' to --data-ciphers or change --cipher 'AES-256-CBC' to --data-ciphers-fallback 'AES-256-CBC' to silence this warning.
2021-08-18 12:14:28 OpenVPN 2.5.1 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on May 14 2021
2021-08-18 12:14:28 library versions: OpenSSL 1.1.1k 25 Mar 2021, LZO 2.10
2021-08-18 12:14:28 net_route_v4_best_gw query: dst 0.0.0.0
2021-08-18 12:14:28 net_route_v4_best_gw result: via 10.10.1.1 dev wlan0
2021-08-18 12:14:28 Diffie-Hellman initialized with 2048 bit key
2021-08-18 12:14:28 net_route_v4_best_gw query: dst 0.0.0.0
2021-08-18 12:14:28 net_route_v4_best_gw result: via 10.10.1.1 dev wlan0
2021-08-18 12:14:28 ROUTE_GATEWAY 10.10.1.1/255.255.255.0 IFACE=eth0 HWADDR=b8:ae:ed:75:a6:3a
2021-08-18 12:14:28 TUN/TAP device tun0 opened
2021-08-18 12:14:28 net_iface_mtu_set: mtu 1500 for tun0
2021-08-18 12:14:28 net_iface_up: set tun0 up
2021-08-18 12:14:28 net_addr_ptp_v4_add: 10.8.0.1 peer 10.8.0.2 dev tun0
2021-08-18 12:14:28 net_route_v4_add: 10.8.0.0/24 via 10.8.0.2 dev [NULL] table 0 metric -1
2021-08-18 12:14:28 Could not determine IPv4/IPv6 protocol. Using AF_INET
2021-08-18 12:14:28 Socket Buffers: R=[212992->212992] S=[212992->212992]
2021-08-18 12:14:28 UDPv4 link local (bound): [AF_INET][undef]:1194
2021-08-18 12:14:28 UDPv4 link remote: [AF_UNSPEC]
2021-08-18 12:14:28 GID set to nogroup
2021-08-18 12:14:28 UID set to nobody
2021-08-18 12:14:28 MULTI: multi_init called, r=256 v=256
2021-08-18 12:14:28 IFCONFIG POOL IPv4: base=10.8.0.4 size=62
2021-08-18 12:14:28 Initialization Sequence Completed
2021-08-18 15:07:12 event_wait : Interrupted system call (code=4)
2021-08-18 15:07:12 net_route_v4_del: 10.8.0.0/24 via 10.8.0.2 dev [NULL] table 0 metric -1
2021-08-18 15:07:12 sitnl_send: rtnl: generic error (-1): Operation not permitted
2021-08-18 15:07:12 ERROR: Linux route delete command failed
2021-08-18 15:07:12 Closing TUN/TAP interface
2021-08-18 15:07:12 net_addr_ptp_v4_del: 10.8.0.1 dev tun0
2021-08-18 15:07:12 sitnl_send: rtnl: generic error (-1): Operation not permitted
2021-08-18 15:07:12 Linux can't del IP from iface tun0
2021-08-18 15:07:12 SIGTERM[hard,] received, process exiting

300000

2021-08-18 15:07:12 sitnl_send: rtnl: generic error (-1): Operation not permitted

Something is wrong and it need permissions so please check it and try to do it again. how do you install openvpn and what user are you running . it this root user or normal user?

TinCanTech

pkfox wrote 2021-08-18 12:14:28 GID set to nogroup
2021-08-18 12:14:28 UID set to nobody
2021-08-18 12:14:28 MULTI: multi_init called, r=256 v=256
2021-08-18 12:14:28 IFCONFIG POOL IPv4: base=10.8.0.4 size=62
2021-08-18 12:14:28 Initialization Sequence Completed
2021-08-18 15:07:12 event_wait : Interrupted system call (code=4)
2021-08-18 15:07:12 net_route_v4_del: 10.8.0.0/24 via 10.8.0.2 dev [NULL] table 0 metric -1
2021-08-18 15:07:12 sitnl_send: rtnl: generic error (-1): Operation not permitted
2021-08-18 15:07:12 ERROR: Linux route delete command failed
2021-08-18 15:07:12 Closing TUN/TAP interface
2021-08-18 15:07:12 net_addr_ptp_v4_del: 10.8.0.1 dev tun0
2021-08-18 15:07:12 sitnl_send: rtnl: generic error (-1): Operation not permitted
2021-08-18 15:07:12 Linux can't del IP from iface tun0
2021-08-18 15:07:12 SIGTERM[hard,] received, process exiting

Normal.

pkfox

300000 wrote 2021-08-18 15:07:12 sitnl_send: rtnl: generic error (-1): Operation not permitted

Something is wrong and it need permissions so please check it and try to do it again. how do you install openvpn and what user are you running . it this root user or normal user?

Hi and thanks for replying, If you see my first post there is a link to the script I used to install , I decided to uninstall OpenVPN today and start from scratch.
When I issue openvpn my.ovpn on the server command line

openvpn path-to-my-ovpn-file

I get this output

2021-08-20 14:32:47 OpenVPN 2.5.1 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on May 14 2021
2021-08-20 14:32:47 library versions: OpenSSL 1.1.1k 25 Mar 2021, LZO 2.10
2021-08-20 14:32:47 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2021-08-20 14:32:47 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2021-08-20 14:32:47 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2021-08-20 14:32:47 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2021-08-20 14:32:47 TCP/UDP: Preserving recently used remote address: [AF_INET]86.20.92.123:1194
2021-08-20 14:32:47 Socket Buffers: R=[212992->212992] S=[212992->212992]
2021-08-20 14:32:47 UDP link local: (not bound)
2021-08-20 14:32:47 UDP link remote: [AF_INET]86.20.92.123:1194
2021-08-20 14:33:47 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
2021-08-20 14:33:47 TLS Error: TLS handshake failed
2021-08-20 14:33:47 SIGUSR1[soft,tls-error] received, process restarting

I an see it's a TLS error but I don't know how to fix it

300000

script is wrong and not working at all . you need to create openvpn config yourself to learn how it work. nobody can help you cause it mess up now . it not worth to repair wrong one .

pkfox

300000 wrote script is wrong and not working at all . you need to create openvpn config yourself to learn how it work. nobody can help you cause it mess up now . it not worth to repair wrong one .

Are you saying the install script is wrong ? Where can I get a basic config file I can try ?

TinCanTech

pkfox wrote client
proto udp
explicit-exit-notify
remote xx.xx.xx.xx 1194

Change your remote to 10.10.1.4

pkfox

TinCanTech wrote
pkfox wrote client
proto udp
explicit-exit-notify
remote xx.xx.xx.xx 1194
Change your remote to 10.10.1.4

I changed the remote to 10.10.1.4 and it made no difference

300000

Your server is not running yes how can it work

TinCanTech

Can you ping your server on 10.10.1.4 ?

pkfox

TinCanTech wrote Can you ping your server on 10.10.1.4 ?

I'm on the server - I haven't tried to setup a client machine as I can't even get

openvpn my.ovpn

to work

TinCanTech

You are trying test the client config by running it from the server to the server ?