Problem with OpenVPN server

joshcole

Can't get client connected. Here is the error log from the client. Any help is appreciated.

Tue Oct 11 13:07:33 2011 LZO compression initialized
Tue Oct 11 13:07:33 2011 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue Oct 11 13:07:33 2011 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Oct 11 13:07:33 2011 Local Options hash (VER=V4): '41690919'
Tue Oct 11 13:07:33 2011 Expected Remote Options hash (VER=V4): '530fdded'
Tue Oct 11 13:07:33 2011 UDPv4 link local: [undef]
Tue Oct 11 13:07:33 2011 UDPv4 link remote: xxx.xxx.xxx.xxx:1194
Tue Oct 11 13:07:33 2011 TCP/UDP: Closing socket
Tue Oct 11 13:07:33 2011 SIGTERM[hard,] received, process exiting

joshcole

OpenVPN Server Conf:

Server plaftorm=Ubuntu Server 11.04

dev tun
# Server and client IP and Pool
server 172.19.238.0 255.255.254.0
ifconfig-pool-persist ipp.txt

# Certificates for VPN Authentication
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem

#client-config-dir ccd
push "route 172.16.0.0 255.255.0.0"

push "dhcp-option DNS 172.16.1.70"

# Use compression on the VPN link
comp-lzo

# Make the link more resistant to connection failures

keepalive 10 60
ping-timer-rem
persist-tun
persist-key

# Run OpenVPN as a daemon and drop privileges to user/group nobody user nobody
group nobody
daemon

verb 2
duplicate-cn

client-cert-not-required
auth-user-pass-verify /etc/openvpn/openvpn-ad-auth.pl via-env

joshcole

This is what the log is reporting server side.

Oct 11 13:09:58 vpn openvpn[22671]: xxx.xxx.xxx.xxx:58317 TLS Error: TLS handshake failed

Mimiko

Verify internet path from client to server. Find any hidden proxy servers. Also use ver 3 or 5 in client's config.

joshcole

There are no proxy servers in between.

Client config:

client
dev tun
proto udp
remote xxx.xxx.xxx.xxx 1194
resolv-retry infinite
nobind
persist-tun
comp-lzo
verb 3
ca ca.crt
auth-user-pass

joshcole

More errors on the client side.

Tue Oct 11 13:37:40 2011 us=256134 TLS: Initial packet from xxx.xxx.xxx.xxx:1194, sid=33bb890e c6565e35
Tue Oct 11 13:37:40 2011 us=366309 VERIFY ERROR: depth=0, error=unable to get local issuer certificate: /C=US/ST=CA/L=Fresno/O=FPU/CN=server/emailAddress=josh@mydomain.com
Tue Oct 11 13:37:40 2011 us=366386 TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
Tue Oct 11 13:37:40 2011 us=366397 TLS Error: TLS object -> incoming plaintext read error
Tue Oct 11 13:37:40 2011 us=366404 TLS Error: TLS handshake failed
Tue Oct 11 13:37:40 2011 us=366543 TCP/UDP: Closing socket

Mimiko

So, you have problems with certificates. Regenerate them from scratch.