Hi,
I've a big problem,
I've an openvpn server on the cloud with this configuration:
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist /var/log/openvpn/ipp.txt
push "route 172.18.0.0 255.255.0.0"
client-config-dir ccd
route 172.18.0.0 255.255.0.0
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 10 120
cipher AES-256-CBC
auth SHA256
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log openvpn.log
verb 4
explicit-exit-notify 1
management localhost 7505
and a client about 800km away from me, with this configuration:
option nobind '1'
option dev 'tun0'
option comp_lzo 'yes'
option persist_tun '1'
option persist_key '1'
option client '1'
option pull '1'
option Username 'xxxx'
option Password 'yyy'
option remote_random '0'
option proto 'udp'
option resolv_retry 'infinite'
option verb '4'
option reneg_sec '0'
option float '1'
option enable '1'
option remote 'aaa.bbb.ccc.ddd'
option ca '/lib/uci/upload/cbid.openvpn.ClientRoutedPTPVPN.ca'
option cert '/lib/uci/upload/cbid.openvpn.ClientRoutedPTPVPN.cert'
option key '/lib/uci/upload/cbid.openvpn.ClientRoutedPTPVPN.key'
option auth 'SHA256'
option cipher 'AES-256-CBC'
option auth_nocache '1'
option tun_mtu '1500'
I had some problem with the connection (many link down automatically recovered after some hour) so I choosed to remove the last parameter on the client, removed "option tun_mtu '1500'".
After this I completely loose connection to the client, and I've no chance to recover it,
I can only change everything on server side but I don't know what to change, the log on the server is the following:
Thu Mar 17 22:13:11 2022 us=114640 MULTI: multi_create_instance called
Thu Mar 17 22:13:11 2022 us=115046 151.19.213.156:1506 Re-using SSL/TLS context
Thu Mar 17 22:13:11 2022 us=115279 151.19.213.156:1506 LZO compression initializing
Thu Mar 17 22:13:11 2022 us=115534 151.19.213.156:1506 Control Channel MTU parms [ L:1622 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Thu Mar 17 22:13:11 2022 us=115676 151.19.213.156:1506 Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ]
Thu Mar 17 22:13:11 2022 us=115825 151.19.213.156:1506 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1570,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA256,keysize 256,key-method 2,tls-server'
Thu Mar 17 22:13:11 2022 us=115961 151.19.213.156:1506 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1570,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA256,keysize 256,key-method 2,tls-client'
Thu Mar 17 22:13:11 2022 us=116111 151.19.213.156:1506 TLS: Initial packet from [AF_INET]151.19.213.156:1506, sid=3f5d4841 53c2065c
Thu Mar 17 22:13:30 2022 us=295892 151.19.213.156:1503 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Thu Mar 17 22:13:30 2022 us=296334 151.19.213.156:1503 TLS Error: TLS handshake failed
Thu Mar 17 22:13:30 2022 us=296597 151.19.213.156:1503 SIGUSR1[soft,tls-error] received, client-instance restarting
is there a way to recover this problem changing something on server side? Or any suggestion is welcome.
Thanks,
Antonio
