Authenticate/Decrypt pack: Missing Authentication Info

tonysathre

I have my OpenVPN server running on my Windows Server 2003 box. I have gone through two different tutorials to get this up and running but both times I've ran into the same problem. Below are my configs:

Server

;remote myremote
; port 1194
; proto [tcp-server | tcp-client | udp]
dev tun
;ifconfig 10.3.0.1 255.255.255.0
tun-mtu 1500
ifconfig 192.168.0.1 192.168.0.2
;fragment 1300
;mssfix
;dev-tap
secret c:\\keys\\key.txt
#ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
#cert "C:\\Program Files\\OpenVPN\\config\\server.crt"
#key "C:\\Program Files\\OpenVPN\\config\\server.key"
#dh "C:\\Program Files\\OpenVPN\\config\\dh1024.pem"
; ping-restart 60
; ping-timer-rem
; persist-tun
; persist-key
; resolv-retry 86400
ping 10
comp-lzo
verb 4
mute 10

Client:

client
;dev tap
dev tun
;dev-tap
;proto tcp
proto udp
remote 192.168.1.250 1194
;remote my-server-2 1194
;remote-random
resolv-retry infinite
nobind
;user nobody
;group nobody
persist-key
persist-tun
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]
;mute-replay-warnings
ca ca.crt
cert client.crt
key client.key
ns-cert-type server
;tls-auth ta.key 1
;cipher x
comp-lzo
pull
verb 3
;mute 20

I'm trying to connect from a Ubuntu based box. I've turned off the firewall on my server and forwarded the correct ports both TCP and UDP. On the client side I get this error message:


n Oct 24 00:44:26 2011 OpenVPN 2.2.1 i686-pc-linux-gnu [SSL] [LZO2] [EPOLL] [eurephia] built on Oct 19 2011
Mon Oct 24 00:44:26 2011 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon Oct 24 00:44:26 2011 WARNING: file 'client.key' is group or others accessible
Mon Oct 24 00:44:26 2011 LZO compression initialized
Mon Oct 24 00:44:26 2011 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Oct 24 00:44:26 2011 Socket Buffers: R=[114688->131072] S=[114688->131072]
Mon Oct 24 00:44:26 2011 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Oct 24 00:44:26 2011 Local Options hash (VER=V4): '41690919'
Mon Oct 24 00:44:26 2011 Expected Remote Options hash (VER=V4): '530fdded'
Mon Oct 24 00:44:26 2011 UDPv4 link local: [undef]
Mon Oct 24 00:44:26 2011 UDPv4 link remote: 192.168.1.250:1194
Mon Oct 24 00:45:26 2011 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Mon Oct 24 00:45:26 2011 TLS Error: TLS handshake failed
Mon Oct 24 00:45:26 2011 TCP/UDP: Closing socket

What have I done wrong or what do I need to do?

Thanks,

Tony

Mimiko

and forwarded the correct ports both TCP and UDP.

You forwarded from internet? 192.168.1.250 from internet?

janjust

your server configuration is based on static keys, yet your client configuration is a server-multiple client setup. This will never work.
Start with a fresh set of configuration files, preferably from the HOWTO section.

tonysathre

Mimiko wrote
and forwarded the correct ports both TCP and UDP.
You forwarded from internet? 192.168.1.250 from internet?

No I just changed it to that to rule out a port forwarding issue.

tonysathre

Alright, so I recreated all my certs from scratch. I can still connect like before but now I'm getting a different error:

On the server I get this:

Tue Oct 25 01:40:00 2011 192.168.1.104:49474 TLS: Initial packet from 192.168.1.
104:49474, sid=0e1c4ddb 50a4509e
Tue Oct 25 01:40:02 2011 MULTI: multi_create_instance called
Tue Oct 25 01:40:02 2011 192.168.1.104:37926 Re-using SSL/TLS context
Tue Oct 25 01:40:02 2011 192.168.1.104:37926 LZO compression initialized
Tue Oct 25 01:40:02 2011 192.168.1.104:37926 Control Channel MTU parms [ L:1542
D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue Oct 25 01:40:02 2011 192.168.1.104:37926 Data Channel MTU parms [ L:1542 D:1
450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Oct 25 01:40:02 2011 192.168.1.104:37926 Local Options hash (VER=V4): '530fd
ded'
Tue Oct 25 01:40:02 2011 192.168.1.104:37926 Expected Remote Options hash (VER=V
4): '41690919'
Tue Oct 25 01:40:02 2011 192.168.1.104:37926 TLS: Initial packet from 192.168.1.
104:37926, sid=0a79507c 25247722
Tue Oct 25 01:40:04 2011 MULTI: multi_create_instance called
Tue Oct 25 01:40:04 2011 192.168.1.104:36865 Re-using SSL/TLS context
Tue Oct 25 01:40:04 2011 192.168.1.104:36865 LZO compression initialized
Tue Oct 25 01:40:04 2011 192.168.1.104:36865 Control Channel MTU parms [ L:1542
D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue Oct 25 01:40:04 2011 192.168.1.104:36865 Data Channel MTU parms [ L:1542 D:1
450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Oct 25 01:40:04 2011 192.168.1.104:36865 Local Options hash (VER=V4): '530fd
ded'
Tue Oct 25 01:40:04 2011 192.168.1.104:36865 Expected Remote Options hash (VER=V
4): '41690919'
Tue Oct 25 01:40:04 2011 192.168.1.104:36865 TLS: Initial packet from 192.168.1.
104:36865, sid=bb3769ce 6f6f8920
Tue Oct 25 01:40:06 2011 MULTI: multi_create_instance called
Tue Oct 25 01:40:06 2011 192.168.1.104:48207 Re-using SSL/TLS context
Tue Oct 25 01:40:06 2011 192.168.1.104:48207 LZO compression initialized
Tue Oct 25 01:40:06 2011 192.168.1.104:48207 Control Channel MTU parms [ L:1542
D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue Oct 25 01:40:06 2011 192.168.1.104:48207 Data Channel MTU parms [ L:1542 D:1
450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Oct 25 01:40:06 2011 192.168.1.104:48207 Local Options hash (VER=V4): '530fd
ded'
Tue Oct 25 01:40:06 2011 192.168.1.104:48207 Expected Remote Options hash (VER=V
4): '41690919'
Tue Oct 25 01:40:06 2011 192.168.1.104:48207 TLS: Initial packet from 192.168.1.
104:48207, sid=b81233c7 115cbc1b
Tue Oct 25 01:40:43 2011 192.168.1.104:48175 TLS Error: TLS key negotiation fail
ed to occur within 60 seconds (check your network connectivity)
Tue Oct 25 01:40:43 2011 192.168.1.104:48175 TLS Error: TLS handshake failed
Tue Oct 25 01:40:43 2011 192.168.1.104:48175 SIGUSR1[soft,tls-error] received, c
lient-instance restarting
Tue Oct 25 01:40:44 2011 192.168.1.104:33854 TLS Error: TLS key negotiation fail
ed to occur within 60 seconds (check your network connectivity)
Tue Oct 25 01:40:44 2011 192.168.1.104:33854 TLS Error: TLS handshake failed
Tue Oct 25 01:40:44 2011 192.168.1.104:33854 SIGUSR1[soft,tls-error] received, c
lient-instance restarting

On the client I get this:

Tue Oct 25 02:40:09 2011 SIGUSR1[soft,tls-error] received, process restarting
Tue Oct 25 02:40:09 2011 Restart pause, 2 second(s)
Tue Oct 25 02:40:11 2011 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Tue Oct 25 02:40:11 2011 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Tue Oct 25 02:40:11 2011 Re-using SSL/TLS context
Tue Oct 25 02:40:11 2011 LZO compression initialized
Tue Oct 25 02:40:11 2011 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue Oct 25 02:40:11 2011 Socket Buffers: R=[114688->131072] S=[114688->131072]
Tue Oct 25 02:40:11 2011 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Oct 25 02:40:11 2011 Local Options hash (VER=V4): '41690919'
Tue Oct 25 02:40:11 2011 Expected Remote Options hash (VER=V4): '530fdded'
Tue Oct 25 02:40:11 2011 UDPv4 link local: [undef]
Tue Oct 25 02:40:11 2011 UDPv4 link remote: 192.168.1.250:1194
Tue Oct 25 02:40:11 2011 TLS: Initial packet from 192.168.1.250:1194, sid=16dd2d7d e0146f24
Tue Oct 25 02:40:11 2011 VERIFY ERROR: depth=0, error=unsupported certificate purpose: /C=US/ST=MN/L=Rochester/O=OpenVPN/OU=changeme/CN=server/name=changeme/emailAddress=mail@host.domain
Tue Oct 25 02:40:11 2011 TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
Tue Oct 25 02:40:11 2011 TLS Error: TLS object -> incoming plaintext read error
Tue Oct 25 02:40:11 2011 TLS Error: TLS handshake failed
Tue Oct 25 02:40:11 2011 TCP/UDP: Closing socket
Tue Oct 25 02:40:11 2011 SIGUSR1[soft,tls-error] received, process restarting
Tue Oct 25 02:40:11 2011 Restart pause, 2 second(s)
^CTue Oct 25 02:40:13 2011 SIGINT[hard,init_instance] received, process exiting

Server config:

port 1194
proto udp
dev tun
dev-node dev-tap
ca "c:\\program files\\openvpn\\easy-rsa\\keys\\ca.crt"
cert "c:\\program files\\openvpn\\easy-rsa\\keys\\server.crt"
key "c:\\program files\\openvpn\\easy-rsa\\keys\\server.key"
dh "c:\\program files\\openvpn\\easy-rsa\\keys\\dh1024.pem"
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway"
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

Client config:

client
dev tun
proto udp
remote 192.168.1.250 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
comp-lzo
pull
verb 3

Thanks,

Tony

Mimiko

Or you have done something wrong when generating certificates, or the internet link is poor so the packets a damaged.

tonysathre

Well I followed your HOWTO exactly so I don't see how it's possible. I guess that's why I'm asking because I'm not the expert.

janjust

you're now being hit by

Tue Oct 25 02:40:11 2011 VERIFY ERROR: depth=0, error=unsupported certificate purpose: /C=US/ST=MN/L=Rochester/O=OpenVPN/OU=changeme/CN=server/name=changeme/emailAddress=mail@host.domain

either regenerate the server certificate using

./build-key-server <servername>

or remove the line

ns-cert-type server

from the client config file.