When attempting to connect to most web sites through the OpenVPN tunnel I am trying to set up I just get a timeout after the TLS client hello:
curl -v -m 10 https://google.com
* Trying 142.250.179.238:443...
* Connected to google.com (142.250.179.238) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* CAfile: /etc/ssl/certs/ca-certificates.crt
* CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* Operation timed out after 10001 milliseconds with 0 bytes received
* Closing connection 0
curl: (28) Operation timed out after 10001 milliseconds with 0 bytes received
In case it is relevant to the problem I used
https://github.com/angristan/openvpn-install and just accepted the default options to generate the configurations.
Here is my client configuration:
client
proto udp
explicit-exit-notify
remote MyServerIPV4 1194
dev tun
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
verify-x509-name server_zfu5gYQNrIjTSPry name
auth SHA256
auth-nocache
cipher AES-128-GCM
tls-client
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
ignore-unknown-option block-outside-dns
setenv opt block-outside-dns
verb 4
Server configuration:
port 1194
proto udp6
dev tun
user nobody
group nogroup
persist-key
persist-tun
keepalive 10 120
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 94.140.14.14"
push "dhcp-option DNS 94.140.15.15"
push "redirect-gateway def1 bypass-dhcp"
server-ipv6 fd42:42:42:42::/112
tun-ipv6
push tun-ipv6
push "route-ipv6 2000::/3"
push "redirect-gateway ipv6"
dh none
ecdh-curve prime256v1
tls-crypt tls-crypt.key
crl-verify crl.pem
ca ca.crt
cert server_zfu5gYQNrIjTSPry.crt
key server_zfu5gYQNrIjTSPry.key
auth SHA256
cipher AES-128-GCM
ncp-ciphers AES-128-GCM
tls-server
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
client-config-dir /etc/openvpn/ccd
status /var/log/openvpn/status.log
verb 4
Here are the journalctl -xe log from ovpn-server when I started the openvpn server, connected from my client machine, and executed
curl -v -m 10 https://google.com
then disconnected (I replaced the IP addresses for privacy, I hope that isn't a problem):
https://paste.gg/p/anonymous/5b8e56d26c54419eab61d31ce3a8abd5/files/bb37f8f64070444b8c3b7a099b3ba01e/raw
Client log for that:
https://paste.gg/p/anonymous/5b8e56d26c54419eab61d31ce3a8abd5/files/21269ddf580642e99887d099e5949669/raw
Confusingly, it does work for curl to
https://openvpn.net and to
https://ifconfig.co, although the TLS handshake takes around 5 seconds where it would usually happen in less than half a second, but I have no idea why this is the case. Here is a journalctl -xe log for me connecting to the VPN then connecting to
https://openvpn.net, instead of
https://google.com:
https://paste.gg/p/anonymous/5b8e56d26c54419eab61d31ce3a8abd5/files/05221d93513d402482ac3f5a347abfaf/raw
Client log for that:
https://paste.gg/p/anonymous/5b8e56d26c54419eab61d31ce3a8abd5/files/1d8a0db46cbe4587adcb6406ae5b67a9/raw
Connecting to the websites directly from the VPS where I am hosting the OpenVPN server also works fine so this is really confusing me, I don't understand why it is only not working through the tunnel itself.
Thank you for any help, I wasn't sure exactly what info I needed to provide so if more info is required then I will provide it if asked.
