Re: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)

[vasary]

Hi guys,

we have a Synology server at home and set up OpenVPN as it is written in this tutorial - https://www.synology.com/da-dk/knowledg ... /vpn_setup

My father set it up for me, as I live abroad. He then exported settings and sent me the files - ca certificate, read me and openvpn.ovpn

1) I installed certificate

2) ReadMe says:

Code: Select all

To set up an OpenVPN client on Windows:

1. Install OpenVPN client on Windows
   *An OpenVPN client on Windows is called OpenVPN GUI. 
   *Download it from http://openvpn.net/index.php/open-source/downloads.html and install the client. 
   *The default installation directory is C:\ProgramFiles\OpenVPN.

2. Run OpenVPN GUI as administrator. 

3. Edit VPNConfig.ovpn and replace YOUR_SERVER_IP with public IP of your DiskStation.
   *If your DiskStation is behind a router, replace YOUR_SERVER_IP with the router's IP.
   *Remove # before "redirect-gateway def1" to route all client traffic (including web-traffic) through this VPN Server.

4. Put VPNConfig.ovpn into the config subdirectory under OpenVPN directory
   (ie. C:\Program Files\OpenVPN\config\).

3) As our server is behind router, my father went to whatsmyip.com and sent me the Public IP (I tested it through tracert and I can see our router there)

4) My OpenVPN.ovpn looks like this:

Code: Select all

dev tun
tls-client

remote ROUTER PUBLIC IP 1194

# The "float" tells OpenVPN to accept authenticated packets from any address,
# not only the address which was specified in the --remote option.
# This is useful when you are connecting to a peer which holds a dynamic address
# such as a dial-in user or DHCP client.
# (Please refer to the manual of OpenVPN for more information.)

#float

# If redirect-gateway is enabled, the client will redirect it's
# default network gateway through the VPN.
# It means the VPN connection will firstly connect to the VPN Server
# and then to the internet.
# (Please refer to the manual of OpenVPN for more information.)

redirect-gateway def1

# dhcp-option DNS: To set primary domain name server address.
# Repeat this option to set secondary DNS server addresses.

#dhcp-option DNS DNS_IP_ADDRESS

pull

# If you want to connect by Server's IPv6 address, you should use
# "proto udp6" in UDP mode or "proto tcp6-client" in TCP mode
proto udp

script-security 2

comp-lzo

reneg-sec 0

cipher BF-CBC

auth SHA1

auth-user-pass
<ca>
-----BEGIN CERTIFICATE-----
CERTIFICATE
-----END CERTIFICATE-----
</ca>

5) He enabled port forwarding 1194 from router to the server

So I tried to connect through OpenVPN. The first problem is, that it asks me for name and password even though my father didn't set any. Is there any problem with it if I put only random username there?

I put admin as username and tried to connect...

This is what I got:

Code: Select all

Tue Feb 20 20:22:31 2018 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Tue Feb 20 20:22:31 2018 TCP/UDP: Preserving recently used remote address: [AF_INET]ROUTER IP:1194
Tue Feb 20 20:22:31 2018 UDP link local (bound): [AF_INET][undef]:1194
Tue Feb 20 20:22:31 2018 UDP link remote: [AF_INET]ROUTER IP:1194
Tue Feb 20 20:23:31 2018 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Tue Feb 20 20:23:31 2018 TLS Error: TLS handshake failed

Guys, could you please help me to solve this?

Thanks,
Vasary

PS: If you need server and client settings, I can send them as well, but he didn't do any changes there.

[vasary]

We even changed router today and it still doesn't work...

Please help me, I need to be using VPN to browse the internet (certain pages)...

[TinCanTech]

You need to see the server log file for errors. (at verb 4)

[vasary]

There is nothing in the server log... only that the server runs...

[TinCanTech]

Then port forwarding or firewalling is not done correctly .. and packets do not arrive at the server.

Also, this in your client config

remote ROUTER PUBLIC IP 1194

Perhaps the PUBLIC IP has changed .. you may need a Dynamic DNS name.

[vasary]

The IP still works, I tried it tracert through command line.

When I tried to do it through OpenVPN not OpenVPN GUI, I got this error:

[TinCanTech]

Add

Code: Select all

nobind

to the client config.

[vasary]

Now there's no Fatal Error... I am just getting good old TLS error....

Fck it, I have no idea what to do...

My father even did everything from this video, lol - https://www.youtube.com/watch?v=OYXv9tNeE10

And it still doesn't work...

[vasary]

And if I turn off firewall, it shows this...

[TinCanTech]

With the firewall on you get "TLS error etc"
-- Which could mean the firewall drops the incoming packet.

With the firewall off you get "unknown error (code=10054)"
-- Which does means the machine has responded with "Connection Reset" .. sounds promising ..

You just have to persevere with it until you work it out.

If you think this is bad, wait until you get a connection and have to work out what to do next !

[vasary]

So a quick question. Is it problem on my side (client) or on servers side?

Well, I hope that once I get connection, it will be okay... I just need to "be browsing" internet from my home IP...

Or do you know about easier solution for this?

[TinCanTech]

Is it problem on my side (client) or on servers side?

Most likely the server side. Firewall / Port Forwarding.

do you know about easier solution for this?

Not really .. basically everybody goes through this stage, some are better informed than others.

You are not in the right location and, by the sound of it, don't know anything about networks.
So, it is going to be very difficult.

If the worse comes to the worse you can contact me privately: tincanteksup <at> gmail

[vasary]

Great, thank you

Port forwarding should be set up from router to server, there shouldn't be a problem. Maybe something with firewall then... :/

You are right, I don't know much about networks.

[vasary]

Okay, I have one more question.

Do we need to have a static IP from ISP or is dynamic one enough?

[TinCanTech]

Google dynamic DNS ..

[vasary]

I am asking about router IP. Because right now we have dynamic Ip which changes once a month or whatever. Do we need to have a static IP which doesn't change at all?

[TinCanTech]

See my previous reply ..