Can't VPN to FreeNAS openVPN

Need help configuring your VPN? Just post here and you'll get that help.
Forum rules
Please use the [oconf] BB tag for openvpn Configurations. See viewtopic.php?f=30&t=21589 for an example.
Post Reply
rawmetal
OpenVpn Newbie
Posts: 4
Joined: Tue Sep 12, 2017 3:04 pm

Can't VPN to FreeNAS openVPN

Post by rawmetal » Wed Sep 13, 2017 5:09 pm

I'm new to this server and VPN thing, so I'm sorry if I overlooked something really stupid. I tried looking through some of the rules, but I don't know anything about networking and I think I cried a little.

My workplace hadn't used a server prior, and we wanted employees who work remotely to be able to VPN to the server to access files. We don't have a network administrator, so I guess that makes me the network administrator. We have a server with FreeNAS 11 STABLE installed. I followed this guide and confirmed that OpenVPN was running inside the FreeNAS jail @ IP 10.1.10.2. I configured my router to forward port 1194 to the FreeNas server @ 10.1.10.225 (Maybe the wrong port?). I went home and installed the OpenVPN GUI and imported my client config file. I tried to use the GUI to VPN to the network, but I got an error about the keys and certificates not being available. I grabbed my keys and certificate and moved them to the proper location. I tried to VPN again, but I get this:

Code: Select all

Wed Sep 13 09:45:08 2017 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Sep 13 09:45:08 2017 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Sep 13 09:45:08 2017 MANAGEMENT: >STATE:1505321108,RESOLVE,,,,,,
Wed Sep 13 09:45:08 2017 TCP/UDP: Preserving recently used remote address: [AF_INET]73.xx.xx.xxx:443
Wed Sep 13 09:45:08 2017 Socket Buffers: R=[65536->65536] S=[65536->65536]
Wed Sep 13 09:45:08 2017 UDP link local: (not bound)
Wed Sep 13 09:45:08 2017 UDP link remote: [AF_INET]73.xx.xx.xxx:443
Wed Sep 13 09:45:08 2017 MANAGEMENT: >STATE:1505321108,WAIT,,,,,,
Wed Sep 13 09:46:08 2017 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Wed Sep 13 09:46:08 2017 TLS Error: TLS handshake failed
Wed Sep 13 09:46:08 2017 SIGUSR1[soft,tls-error] received, process restarting
Wed Sep 13 09:46:08 2017 MANAGEMENT: >STATE:1505321168,RECONNECTING,tls-error,,,,,
If I try to use the Windows VPN service, it gives me error 807

Code: Select all

The remote connection was not made because the attempted VPN tunnels failed. The VPN server might be unreachable. If this connection is attempting to use an L2TP/IPsec tunnel, the security parameters required for IPsec negotiation might not be configured properly.
This sounds like I may not have a configuration file set up properly? I have my openvpn client configuration file set up like so:
Client config
client
dev tun
proto udp
remote 73.xx.xx.xxx 443
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert nickh.crt
key nickh.key
remote-cert-tls server
cipher AES-256-CBC
tls-auth ta.key 1
#dhcp-option DNS 0.0.0.0
#redirect-gateway def1
comp-lzo
verb 3
float
My OpenVPN server config file is set up like this:
Server config
port 10011
proto udp
dev tun
ca ca.crt
cert openvpn-server.crt #Server public key
key openvpn-server.key #Server private key
dh dh.pem #Diffie-Hellman parameters
server 172.16.8.0 255.255.255.0 #Purple network
ifconfig-pool-persist ipp.txt
push "route 73.xx.xx.xxx 255.255.255.0" #Yellow network
tls-auth ta.key 0
#crl-verify crl.pem
keepalive 10 120
cipher AES-256-CBC
auth SHA256
group nobody
user nobody
comp-lzo
persist-key
persist-tun
verb 3
I feel like I'm very close here, but maybe I really screwed up somewhere. If I'm not in the right spot, please let me know. I'm going crazy here.

rawmetal
OpenVpn Newbie
Posts: 4
Joined: Tue Sep 12, 2017 3:04 pm

Re: Can't VPN to FreeNAS openVPN

Post by rawmetal » Mon Sep 25, 2017 7:40 pm

Bump. I tried changing ports on my router and had worse luck than port 1194 gave me. I've changed firewall settings and still not having any luck.

User avatar
TinCanTech
OpenVPN Protagonist
Posts: 3245
Joined: Fri Jun 03, 2016 1:17 pm

Re: Can't VPN to FreeNAS openVPN

Post by TinCanTech » Mon Sep 25, 2017 11:00 pm

rawmetal wrote:
Wed Sep 13, 2017 5:09 pm
I don't know anything about networking <snip>

My workplace hadn't used a server prior, and we wanted employees who work remotely to be able to VPN to the server to access files. We don't have a network administrator, so I guess that makes me the network administrator
You need someone who understands networking or you will have to learn it yourself.

I urge you to read all of this (many times, i refer back to it all the time):
HOWTO: For OpenVPN Community Edition

This error:
rawmetal wrote:
Wed Sep 13, 2017 5:09 pm
TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
usually means something is blocking you from your server like a firewall etc.

You will also need to inspect your server log thoroughly.

This:
rawmetal wrote:
Wed Sep 13, 2017 5:09 pm
If I try to use the Windows VPN service, it gives me error 807
will never work .. openvpn is only compatible with openvpn.

rawmetal
OpenVpn Newbie
Posts: 4
Joined: Tue Sep 12, 2017 3:04 pm

Re: Can't VPN to FreeNAS openVPN

Post by rawmetal » Tue Sep 26, 2017 11:10 pm

Thanks. I'll read over that. I was able to VPN to another computer on the network using Windows VPN. I may end up just using OpenVPN that way instead of directly to the FreeNAS machine.

PiotrG
OpenVpn Newbie
Posts: 3
Joined: Mon Sep 25, 2017 8:06 pm

Re: Can't VPN to FreeNAS openVPN

Post by PiotrG » Wed Sep 27, 2017 10:12 am

rawmetal wrote:
Wed Sep 13, 2017 5:09 pm
... confirmed that OpenVPN was running inside the FreeNAS jail @ IP 10.1.10.2. I configured my router to forward port 1194 to the FreeNas server @ 10.1.10.225
FreeNAS jail has never the same IP as FreeNAS sever itself. Jail is acting similar to a virtual server (separate networking stack).
Therefore in my opinion you should forward the port on the router to the internal IP of your jail.
Before doing this, you could verify from any other host whether the server is listening on the internal address on the port defined in config (eg. using nmap).

rawmetal
OpenVpn Newbie
Posts: 4
Joined: Tue Sep 12, 2017 3:04 pm

Re: Can't VPN to FreeNAS openVPN

Post by rawmetal » Thu Oct 05, 2017 8:38 pm

PiotrG wrote:
Wed Sep 27, 2017 10:12 am

FreeNAS jail has never the same IP as FreeNAS sever itself. Jail is acting similar to a virtual server (separate networking stack).
Therefore in my opinion you should forward the port on the router to the internal IP of your jail.
Before doing this, you could verify from any other host whether the server is listening on the internal address on the port defined in config (eg. using nmap).
I'll give that a try then and change the IP address in my router settings.

Post Reply