I've been banging my head on the wall for the past couple of days over this and after hours of researching and hunting, I've finally decided to ask for the help.
I'm using a DD-WRT router for my OpenVPN server. I'm testing a client connection with the OpenVPN GUI in Windows 7 x64 (firewall disabled) and another client on MacOSX with Viscosity. Both clients were tried with UDP (failed with different errors) and TCP, which saw these errors:
Attempting to establish TCP connection with xxx.dyndns.biz:1194
TCP connection established with xxx.dyndns.biz:1194
TCPv4_CLIENT link local: [undef]
TCPv4_CLIENT link remote: xxx.dyndns.biz:1194
Connection reset, restarting [-1]
SIGUSR1[soft,connection-reset] received, process restarting
My Window$ client config:
remote xxx.dyndns.biz 1194
client
remote-cert-tls server
dev tun0
proto tcp
resolv-retry infinite
nobind
persist-key
persist-tun
float
route-delay 30
ca ca.crt
cert client1.crt
key client1.key
My server config:
push "route 192.168.1.0 255.255.255.0"
server 192.168.66.0 255.255.255.0
dev tun0
proto tcp
keepalive 10 120
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
My router firewall script:
iptables -I INPUT 1 -p tcp --dport 1194 -j ACCEPT
iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT
iptables -I FORWARD 1 --source 192.168.66.0/24 -j ACCEPT
I was able to verify, using dyndns.org 's Port Open Tool that port 1194 accepted traffic when my client was connecting.
When I run
cat /var/log/messages | grep openvpn via SSH, I get the following repeated information:
Jul 14 11:23:25 DD-WRT daemon.notice openvpn[979]: TCP connection established with xxx.xxx.xxx.xxx:55558
Jul 14 11:23:25 DD-WRT daemon.notice openvpn[979]: TCPv4_SERVER link local: [undef]
Jul 14 11:23:25 DD-WRT daemon.notice openvpn[979]: TCPv4_SERVER link remote: xxx.xxx.xxx.xxx:55558
Jul 14 11:23:27 DD-WRT daemon.err openvpn[979]: xxx.xxx.xxx.xxx:55558 VERIFY ERROR: depth=1, error=certificate is not yet valid: /C=US/ST= WA/L=OlympicPeninsula/O=NWTech/OU=office/CN=server/name=DDWRT/emailAddress=xx@xx.com
Jul 14 11:23:27 DD-WRT daemon.err openvpn[979]: xxx.xxx.xxx.xxx:55558 TLS_ERROR: BIO read tls_read_plaintext error: error:140890B2:lib(20) :func(137):reason(178)
Jul 14 11:23:27 DD-WRT daemon.err openvpn[979]: xxx.xxx.xxx.xxx:55558 TLS Error: TLS object -> incoming plaintext read error
Jul 14 11:23:27 DD-WRT daemon.err openvpn[979]: xxx.xxx.xxx.xxx:55558 TLS Error: TLS handshake failed
Jul 14 11:23:27 DD-WRT daemon.err openvpn[979]: xxx.xxx.xxx.xxx:55558 Fatal TLS error (check_tls_errors_co), restarting
Not sure if it matters, but my certs were all created from the terminal on Ubuntu using OpenVPN.
Other various router configurations (not sure if it's helpful or not):
Connection type: Auto Config -DHCP
Local IP: 192.168.1.1
Gateway: 0.0.0.0
Local DNS: 0.0.0.0
DHCP Server: Enabled
Static DNS 1-3: 0.0.0.0
Use DNSMasq for DHCP: enabled
Use DNSMasq for DNS: enabled
DHCP-Authoritative: enabled
NTP client: enabled
NTP server: 0.us.pool.ntp.org
Firewall: Enabled
Block WAN Requests; Filter Multicast; Filter IDENT
VPN Passthrough: IPSec -enabled, PPTP -enabled, & L2TP -enabled
Thank you in advance for any input
