TLS handshake failed

[Bransonb3]

When I try to connect to my openvpn server I get TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) and TLS Error: TLS handshake failed. It looks like the server sees the client try to connect (TLS: Initial packet from...) but doesn't respond.

I'm running openvpn 2.4.4 on Windows Server 2016 1607. I am trying to connect my Mac running OSX 10.13.2, using Tunnelblick 3.7.4b but have also tried connecting using the openvpn connect android app. I have port forwarded 1194 udp to my server, made an inbound and outbound windows firewall rule allowing openvpn.exe, allowed tunnelblick incoming connections on the mac firewall. I have also tried to run the server as admin.

View OriginalServer

1

#################################################

2

3

# Sample OpenVPN 2.0 config file for #

4

5

# multi-client server. #

6

7

# #

8

9

# This file is for the server side #

10

11

# of a many-clients <-> one-server #

12

13

# OpenVPN configuration. #

14

15

# #

16

17

# OpenVPN also supports #

18

19

# single-machine <-> single-machine #

20

21

# configurations (See the Examples page #

22

23

# on the web site for more info). #

24

25

# #

26

27

# This config should work on Windows #

28

29

# or Linux/BSD systems. Remember on #

30

31

# Windows to quote pathnames and use #

32

33

# double backslashes, e.g.: #

34

35

# "C:\\Program Files\\OpenVPN\\config\\foo.key" #

36

37

# #

38

39

# Comments are preceded with '#' or ';' #

40

41

#################################################

42

43

44

45

# Which local IP address should OpenVPN

46

47

# listen on? (optional)

48

49

;local a.b.c.d

50

51

52

53

# Which TCP/UDP port should OpenVPN listen on?

54

55

# If you want to run multiple OpenVPN instances

56

57

# on the same machine, use a different port

58

59

# number for each one. You will need to

60

61

# open up this port on your firewall.

62

63

port 1194

64

65

66

67

# TCP or UDP server?

68

69

;proto tcp

70

71

proto udp

72

73

74

75

# "dev tun" will create a routed IP tunnel,

76

77

# "dev tap" will create an ethernet tunnel.

78

79

# Use "dev tap0" if you are ethernet bridging

80

81

# and have precreated a tap0 virtual interface

82

83

# and bridged it with your ethernet interface.

84

85

# If you want to control access policies

86

87

# over the VPN, you must create firewall

88

89

# rules for the the TUN/TAP interface.

90

91

# On non-Windows systems, you can give

92

93

# an explicit unit number, such as tun0.

94

95

# On Windows, use "dev-node" for this.

96

97

# On most systems, the VPN will not function

98

99

# unless you partially or fully disable

100

101

# the firewall for the TUN/TAP interface.

102

103

;dev tun

104

105

dev tap

106

107

108

109

# Windows needs the TAP-Win32 adapter name

110

111

# from the Network Connections panel if you

112

113

# have more than one. On XP SP2 or higher,

114

115

# you may need to selectively disable the

116

117

# Windows firewall for the TAP adapter.

118

119

# Non-Windows systems usually don't need this.

120

121

dev-node Ethernet_7

122

123

124

125

# SSL/TLS root certificate (ca), certificate

126

127

# (cert), and private key (key). Each client

128

129

# and the server must have their own cert and

130

131

# key file. The server and all clients will

132

133

# use the same ca file.

134

135

#

136

137

# See the "easy-rsa" directory for a series

138

139

# of scripts for generating RSA certificates

140

141

# and private keys. Remember to use

142

143

# a unique Common Name for the server

144

145

# and each of the client certificates.

146

147

#

148

149

# Any X509 key management system can be used.

150

151

# OpenVPN can also use a PKCS #12 formatted key file

152

153

# (see "pkcs12" directive in man page).

154

155

ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"

156

157

cert "C:\\Program Files\\OpenVPN\\config\\server.crt"

158

159

key "C:\\Program Files\\OpenVPN\\config\\server.key" # This file should be kept secret

160

161

162

163

# Diffie hellman parameters.

164

165

# Generate your own with:

166

167

# openssl dhparam -out dh2048.pem 2048

168

169

dh "C:\\Program Files\\OpenVPN\\config\\dh4096.pem"

170

171

172

173

# Network topology

174

175

# Should be subnet (addressing via IP)

176

177

# unless Windows clients v2.0.9 and lower have to

178

179

# be supported (then net30, i.e. a /30 per client)

180

181

# Defaults to net30 (not recommended)

182

183

topology subnet

184

185

186

187

# Configure server mode and supply a VPN subnet

188

189

# for OpenVPN to draw client addresses from.

190

191

# The server will take 10.8.0.1 for itself,

192

193

# the rest will be made available to clients.

194

195

# Each client will be able to reach the server

196

197

# on 10.8.0.1. Comment this line out if you are

198

199

# ethernet bridging. See the man page for more info.

200

201

;server 192.168.1.225 255.255.0.0

202

203

204

205

# Maintain a record of client <-> virtual IP address

206

207

# associations in this file. If OpenVPN goes down or

208

209

# is restarted, reconnecting clients can be assigned

210

211

# the same virtual IP address from the pool that was

212

213

# previously assigned.

214

215

ifconfig-pool-persist ipp.txt

216

217

218

219

# Configure server mode for ethernet bridging.

220

221

# You must first use your OS's bridging capability

222

223

# to bridge the TAP interface with the ethernet

224

225

# NIC interface. Then you must manually set the

226

227

# IP/netmask on the bridge interface, here we

228

229

# assume 192.168.1.227/255.255.0.0. Finally we

230

231

# must set aside an IP range in this subnet

232

233

# (start=192.168.3.1 end=192.168.3.254) to allocate

234

235

# to connecting clients. Leave this line commented

236

237

# out unless you are ethernet bridging.

238

239

server-bridge 192.168.1.227 255.255.0.0 192.168.3.1 192.168.3.254

240

241

242

243

# Configure server mode for ethernet bridging

244

245

# using a DHCP-proxy, where clients talk

246

247

# to the OpenVPN server-side DHCP server

248

249

# to receive their IP address allocation

250

251

# and DNS server addresses. You must first use

252

253

# your OS's bridging capability to bridge the TAP

254

255

# interface with the ethernet NIC interface.

256

257

# Note: this mode only works on clients (such as

258

259

# Windows), where the client-side TAP adapter is

260

261

# bound to a DHCP client.

262

263

;server-bridge

264

265

266

267

# Push routes to the client to allow it

268

269

# to reach other private subnets behind

270

271

# the server. Remember that these

272

273

# private subnets will also need

274

275

# to know to route the OpenVPN client

276

277

# address pool (10.8.0.0/255.255.255.0)

278

279

# back to the OpenVPN server.

280

281

;push "route 192.168.10.0 255.255.255.0"

282

283

;push "route 192.168.20.0 255.255.255.0"

284

285

286

287

# To assign specific IP addresses to specific

288

289

# clients or if a connecting client has a private

290

291

# subnet behind it that should also have VPN access,

292

293

# use the subdirectory "ccd" for client-specific

294

295

# configuration files (see man page for more info).

296

297

298

299

# EXAMPLE: Suppose the client

300

301

# having the certificate common name "Thelonious"

302

303

# also has a small subnet behind his connecting

304

305

# machine, such as 192.168.40.128/255.255.255.248.

306

307

# First, uncomment out these lines:

308

309

;client-config-dir ccd

310

311

;route 192.168.40.128 255.255.255.248

312

313

# Then create a file ccd/Thelonious with this line:

314

315

# iroute 192.168.40.128 255.255.255.248

316

317

# This will allow Thelonious' private subnet to

318

319

# access the VPN. This example will only work

320

321

# if you are routing, not bridging, i.e. you are

322

323

# using "dev tun" and "server" directives.

324

325

326

327

# EXAMPLE: Suppose you want to give

328

329

# Thelonious a fixed VPN IP address of 10.9.0.1.

330

331

# First uncomment out these lines:

332

333

;client-config-dir ccd

334

335

;route 10.9.0.0 255.255.255.252

336

337

# Then add this line to ccd/Thelonious:

338

339

# ifconfig-push 10.9.0.1 10.9.0.2

340

341

342

343

# Suppose that you want to enable different

344

345

# firewall access policies for different groups

346

347

# of clients. There are two methods:

348

349

# (1) Run multiple OpenVPN daemons, one for each

350

351

# group, and firewall the TUN/TAP interface

352

353

# for each group/daemon appropriately.

354

355

# (2) (Advanced) Create a script to dynamically

356

357

# modify the firewall in response to access

358

359

# from different clients. See man

360

361

# page for more info on learn-address script.

362

363

;learn-address ./script

364

365

366

367

# If enabled, this directive will configure

368

369

# all clients to redirect their default

370

371

# network gateway through the VPN, causing

372

373

# all IP traffic such as web browsing and

374

375

# and DNS lookups to go through the VPN

376

377

# (The OpenVPN server machine may need to NAT

378

379

# or bridge the TUN/TAP interface to the internet

380

381

# in order for this to work properly).

382

383

;push "redirect-gateway def1 bypass-dhcp"

384

385

386

387

# Certain Windows-specific network settings

388

389

# can be pushed to clients, such as DNS

390

391

# or WINS server addresses. CAVEAT:

392

393

# http://openvpn.net/faq.html#dhcpcaveats

394

395

# The addresses below refer to the public

396

397

# DNS servers provided by opendns.com.

398

399

;push "dhcp-option DNS 208.67.222.222"

400

401

;push "dhcp-option DNS 208.67.220.220"

402

403

404

405

# Uncomment this directive to allow different

406

407

# clients to be able to "see" each other.

408

409

# By default, clients will only see the server.

410

411

# To force clients to only see the server, you

412

413

# will also need to appropriately firewall the

414

415

# server's TUN/TAP interface.

416

417

client-to-client

418

419

420

421

# Uncomment this directive if multiple clients

422

423

# might connect with the same certificate/key

424

425

# files or common names. This is recommended

426

427

# only for testing purposes. For production use,

428

429

# each client should have its own certificate/key

430

431

# pair.

432

433

#

434

435

# IF YOU HAVE NOT GENERATED INDIVIDUAL

436

437

# CERTIFICATE/KEY PAIRS FOR EACH CLIENT,

438

439

# EACH HAVING ITS OWN UNIQUE "COMMON NAME",

440

441

# UNCOMMENT THIS LINE OUT.

442

443

;duplicate-cn

444

445

446

447

# The keepalive directive causes ping-like

448

449

# messages to be sent back and forth over

450

451

# the link so that each side knows when

452

453

# the other side has gone down.

454

455

# Ping every 10 seconds, assume that remote

456

457

# peer is down if no ping received during

458

459

# a 120 second time period.

460

461

keepalive 10 120

462

463

464

465

# For extra security beyond that provided

466

467

# by SSL/TLS, create an "HMAC firewall"

468

469

# to help block DoS attacks and UDP port flooding.

470

471

#

472

473

# Generate with:

474

475

# openvpn --genkey --secret ta.key

476

477

#

478

479

# The server and each client must have

480

481

# a copy of this key.

482

483

# The second parameter should be '0'

484

485

# on the server and '1' on the clients.

486

487

;tls-auth "C:\\Program Files\\OpenVPN\\config\\ta.key" 0 # This file is secret

488

489

490

491

# Select a cryptographic cipher.

492

493

# This config item must be copied to

494

495

# the client config file as well.

496

497

# Note that v2.4 client/server will automatically

498

499

# negotiate AES-256-GCM in TLS mode.

500

501

# See also the ncp-cipher option in the manpage

502

503

cipher AES-256-CBC

504

505

506

507

# Enable compression on the VPN link and push the

508

509

# option to the client (v2.4+ only, for earlier

510

511

# versions see below)

512

513

;compress lz4-v2

514

515

;push "compress lz4-v2"

516

517

518

519

# For compression compatible with older clients use comp-lzo

520

521

# If you enable it here, you must also

522

523

# enable it in the client config file.

524

525

;comp-lzo

526

527

528

529

# The maximum number of concurrently connected

530

531

# clients we want to allow.

532

533

;max-clients 100

534

535

536

537

# It's a good idea to reduce the OpenVPN

538

539

# daemon's privileges after initialization.

540

541

#

542

543

# You can uncomment this out on

544

545

# non-Windows systems.

546

547

;user nobody

548

549

;group nobody

550

551

552

553

# The persist options will try to avoid

554

555

# accessing certain resources on restart

556

557

# that may no longer be accessible because

558

559

# of the privilege downgrade.

560

561

persist-key

562

563

persist-tun

564

565

566

567

# Output a short status file showing

568

569

# current connections, truncated

570

571

# and rewritten every minute.

572

573

status openvpn-status.log

574

575

576

577

# By default, log messages will go to the syslog (or

578

579

# on Windows, if running as a service, they will go to

580

581

# the "\Program Files\OpenVPN\log" directory).

582

583

# Use log or log-append to override this default.

584

585

# "log" will truncate the log file on OpenVPN startup,

586

587

# while "log-append" will append to it. Use one

588

589

# or the other (but not both).

590

591

;log openvpn.log

592

593

;log-append openvpn.log

594

595

596

597

# Set the appropriate level of log

598

599

# file verbosity.

600

601

#

602

603

# 0 is silent, except for fatal errors

604

605

# 4 is reasonable for general usage

606

607

# 5 and 6 can help to debug connection problems

608

609

# 9 is extremely verbose

610

611

verb 3

612

613

614

615

# Silence repeating messages. At most 20

616

617

# sequential messages of the same message

618

619

# category will be output to the log.

620

621

;mute 20

622

623

624

625

# Notify the client that when the server restarts so it

626

627

# can automatically reconnect.

628

1

port 1194

2

proto udp

3

dev tap

4

dev-node Ethernet_7

5

ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"

6

cert "C:\\Program Files\\OpenVPN\\config\\server.crt"

7

key "C:\\Program Files\\OpenVPN\\config\\server.key"

8

dh "C:\\Program Files\\OpenVPN\\config\\dh4096.pem"

9

topology subnet

10

ifconfig-pool-persist ipp.txt

11

server-bridge 192.168.1.227 255.255.0.0 192.168.3.1 192.168.3.254

12

client-to-client

13

keepalive 10 120

14

cipher AES-256-CBC

15

persist-key

16

persist-tun

17

status openvpn-status.log

18

verb 3

Server Log

Code: Select all

Sat Jan 06 11:04:18 2018 us=101200 Current Parameter Settings:
Sat Jan 06 11:04:18 2018 us=101200   config = 'server.ovpn'
Sat Jan 06 11:04:18 2018 us=101200   mode = 1
Sat Jan 06 11:04:18 2018 us=101200   show_ciphers = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   show_digests = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   show_engines = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   genkey = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   key_pass_file = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   show_tls_ciphers = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   connect_retry_max = 0
Sat Jan 06 11:04:18 2018 us=101200 Connection profiles [0]:
Sat Jan 06 11:04:18 2018 us=101200   proto = udp
Sat Jan 06 11:04:18 2018 us=101200   local = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   local_port = '1194'
Sat Jan 06 11:04:18 2018 us=101200   remote = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   remote_port = '1194'
Sat Jan 06 11:04:18 2018 us=101200   remote_float = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   bind_defined = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   bind_local = ENABLED
Sat Jan 06 11:04:18 2018 us=101200   bind_ipv6_only = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   connect_retry_seconds = 5
Sat Jan 06 11:04:18 2018 us=101200   connect_timeout = 120
Sat Jan 06 11:04:18 2018 us=101200   socks_proxy_server = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   socks_proxy_port = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   tun_mtu = 1500
Sat Jan 06 11:04:18 2018 us=101200   tun_mtu_defined = ENABLED
Sat Jan 06 11:04:18 2018 us=101200   link_mtu = 1500
Sat Jan 06 11:04:18 2018 us=101200   link_mtu_defined = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   tun_mtu_extra = 32
Sat Jan 06 11:04:18 2018 us=101200   tun_mtu_extra_defined = ENABLED
Sat Jan 06 11:04:18 2018 us=101200   mtu_discover_type = -1
Sat Jan 06 11:04:18 2018 us=101200   fragment = 0
Sat Jan 06 11:04:18 2018 us=101200   mssfix = 1450
Sat Jan 06 11:04:18 2018 us=101200   explicit_exit_notification = 1
Sat Jan 06 11:04:18 2018 us=101200 Connection profiles END
Sat Jan 06 11:04:18 2018 us=101200   remote_random = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   ipchange = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   dev = 'tap'
Sat Jan 06 11:04:18 2018 us=101200   dev_type = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   dev_node = 'Ethernet_7'
Sat Jan 06 11:04:18 2018 us=101200   lladdr = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   topology = 3
Sat Jan 06 11:04:18 2018 us=101200   ifconfig_local = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   ifconfig_remote_netmask = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   ifconfig_noexec = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   ifconfig_nowarn = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   ifconfig_ipv6_local = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   ifconfig_ipv6_netbits = 0
Sat Jan 06 11:04:18 2018 us=101200   ifconfig_ipv6_remote = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   shaper = 0
Sat Jan 06 11:04:18 2018 us=101200   mtu_test = 0
Sat Jan 06 11:04:18 2018 us=101200   mlock = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   keepalive_ping = 10
Sat Jan 06 11:04:18 2018 us=101200   keepalive_timeout = 120
Sat Jan 06 11:04:18 2018 us=101200   inactivity_timeout = 0
Sat Jan 06 11:04:18 2018 us=101200   ping_send_timeout = 10
Sat Jan 06 11:04:18 2018 us=101200   ping_rec_timeout = 240
Sat Jan 06 11:04:18 2018 us=101200   ping_rec_timeout_action = 2
Sat Jan 06 11:04:18 2018 us=101200   ping_timer_remote = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   remap_sigusr1 = 0
Sat Jan 06 11:04:18 2018 us=101200   persist_tun = ENABLED
Sat Jan 06 11:04:18 2018 us=101200   persist_local_ip = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   persist_remote_ip = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   persist_key = ENABLED
Sat Jan 06 11:04:18 2018 us=101200   passtos = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   resolve_retry_seconds = 1000000000
Sat Jan 06 11:04:18 2018 us=101200   resolve_in_advance = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   username = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   groupname = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   chroot_dir = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   cd_dir = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   writepid = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   up_script = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   down_script = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   down_pre = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   up_restart = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   up_delay = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   daemon = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   inetd = 0
Sat Jan 06 11:04:18 2018 us=101200   log = ENABLED
Sat Jan 06 11:04:18 2018 us=101200   suppress_timestamps = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   machine_readable_output = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   nice = 0
Sat Jan 06 11:04:18 2018 us=101200   verbosity = 4
Sat Jan 06 11:04:18 2018 us=101200   mute = 0
Sat Jan 06 11:04:18 2018 us=101200   gremlin = 0
Sat Jan 06 11:04:18 2018 us=101200   status_file = 'openvpn-status.log'
Sat Jan 06 11:04:18 2018 us=101200   status_file_version = 1
Sat Jan 06 11:04:18 2018 us=101200   status_file_update_freq = 60
Sat Jan 06 11:04:18 2018 us=101200   occ = ENABLED
Sat Jan 06 11:04:18 2018 us=101200   rcvbuf = 0
Sat Jan 06 11:04:18 2018 us=101200   sndbuf = 0
Sat Jan 06 11:04:18 2018 us=101200   sockflags = 0
Sat Jan 06 11:04:18 2018 us=101200   fast_io = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   comp.alg = 0
Sat Jan 06 11:04:18 2018 us=101200   comp.flags = 0
Sat Jan 06 11:04:18 2018 us=101200   route_script = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   route_default_gateway = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   route_default_metric = 0
Sat Jan 06 11:04:18 2018 us=101200   route_noexec = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   route_delay = 0
Sat Jan 06 11:04:18 2018 us=101200   route_delay_window = 30
Sat Jan 06 11:04:18 2018 us=101200   route_delay_defined = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   route_nopull = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   route_gateway_via_dhcp = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   allow_pull_fqdn = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   management_addr = '127.0.0.1'
Sat Jan 06 11:04:18 2018 us=101200   management_port = '25340'
Sat Jan 06 11:04:18 2018 us=101200   management_user_pass = 'stdin'
Sat Jan 06 11:04:18 2018 us=101200   management_log_history_cache = 250
Sat Jan 06 11:04:18 2018 us=101200   management_echo_buffer_size = 100
Sat Jan 06 11:04:18 2018 us=101200   management_write_peer_info_file = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   management_client_user = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   management_client_group = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   management_flags = 6
Sat Jan 06 11:04:18 2018 us=101200   shared_secret_file = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   key_direction = 0
Sat Jan 06 11:04:18 2018 us=101200   ciphername = 'AES-256-CBC'
Sat Jan 06 11:04:18 2018 us=101200   ncp_enabled = ENABLED
Sat Jan 06 11:04:18 2018 us=101200   ncp_ciphers = 'AES-256-GCM:AES-128-GCM'
Sat Jan 06 11:04:18 2018 us=101200   authname = 'SHA1'
Sat Jan 06 11:04:18 2018 us=101200   prng_hash = 'SHA1'
Sat Jan 06 11:04:18 2018 us=101200   prng_nonce_secret_len = 16
Sat Jan 06 11:04:18 2018 us=101200   keysize = 0
Sat Jan 06 11:04:18 2018 us=101200   engine = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   replay = ENABLED
Sat Jan 06 11:04:18 2018 us=101200   mute_replay_warnings = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   replay_window = 64
Sat Jan 06 11:04:18 2018 us=101200   replay_time = 15
Sat Jan 06 11:04:18 2018 us=101200   packet_id_file = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   use_iv = ENABLED
Sat Jan 06 11:04:18 2018 us=101200   test_crypto = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   tls_server = ENABLED
Sat Jan 06 11:04:18 2018 us=101200   tls_client = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   key_method = 2
Sat Jan 06 11:04:18 2018 us=101200   ca_file = 'C:\Program Files\OpenVPN\config\ca.crt'
Sat Jan 06 11:04:18 2018 us=101200   ca_path = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   dh_file = 'C:\Program Files\OpenVPN\config\dh4096.pem'
Sat Jan 06 11:04:18 2018 us=101200   cert_file = 'C:\Program Files\OpenVPN\config\server.crt'
Sat Jan 06 11:04:18 2018 us=101200   extra_certs_file = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   priv_key_file = 'C:\Program Files\OpenVPN\config\server.key'
Sat Jan 06 11:04:18 2018 us=101200   pkcs12_file = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   cryptoapi_cert = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   cipher_list = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   tls_verify = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   tls_export_cert = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   verify_x509_type = 0
Sat Jan 06 11:04:18 2018 us=101200   verify_x509_name = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   crl_file = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   ns_cert_type = 0
Sat Jan 06 11:04:18 2018 us=101200   remote_cert_ku[i] = 0
Sat Jan 06 11:04:18 2018 us=101200   remote_cert_ku[i] = 0
Sat Jan 06 11:04:18 2018 us=101200   remote_cert_ku[i] = 0
Sat Jan 06 11:04:18 2018 us=101200   remote_cert_ku[i] = 0
Sat Jan 06 11:04:18 2018 us=101200   remote_cert_ku[i] = 0
Sat Jan 06 11:04:18 2018 us=101200   remote_cert_ku[i] = 0
Sat Jan 06 11:04:18 2018 us=101200   remote_cert_ku[i] = 0
Sat Jan 06 11:04:18 2018 us=101200   remote_cert_ku[i] = 0
Sat Jan 06 11:04:18 2018 us=101200   remote_cert_ku[i] = 0
Sat Jan 06 11:04:18 2018 us=101200   remote_cert_ku[i] = 0
Sat Jan 06 11:04:18 2018 us=101200   remote_cert_ku[i] = 0
Sat Jan 06 11:04:18 2018 us=101200   remote_cert_ku[i] = 0
Sat Jan 06 11:04:18 2018 us=101200   remote_cert_ku[i] = 0
Sat Jan 06 11:04:18 2018 us=101200   remote_cert_ku[i] = 0
Sat Jan 06 11:04:18 2018 us=101200   remote_cert_ku[i] = 0
Sat Jan 06 11:04:18 2018 us=101200   remote_cert_ku[i] = 0
Sat Jan 06 11:04:18 2018 us=101200   remote_cert_eku = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   ssl_flags = 0
Sat Jan 06 11:04:18 2018 us=101200   tls_timeout = 2
Sat Jan 06 11:04:18 2018 us=101200   renegotiate_bytes = -1
Sat Jan 06 11:04:18 2018 us=101200   renegotiate_packets = 0
Sat Jan 06 11:04:18 2018 us=101200   renegotiate_seconds = 3600
Sat Jan 06 11:04:18 2018 us=101200   handshake_window = 60
Sat Jan 06 11:04:18 2018 us=101200   transition_window = 3600
Sat Jan 06 11:04:18 2018 us=101200   single_session = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   push_peer_info = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   tls_exit = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   tls_auth_file = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   tls_crypt_file = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_protected_authentication = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_protected_authentication = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_protected_authentication = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_protected_authentication = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_protected_authentication = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_protected_authentication = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_protected_authentication = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_protected_authentication = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_protected_authentication = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_protected_authentication = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_protected_authentication = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_protected_authentication = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_protected_authentication = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_protected_authentication = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_protected_authentication = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_protected_authentication = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_private_mode = 00000000
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_private_mode = 00000000
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_private_mode = 00000000
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_private_mode = 00000000
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_private_mode = 00000000
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_private_mode = 00000000
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_private_mode = 00000000
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_private_mode = 00000000
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_private_mode = 00000000
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_private_mode = 00000000
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_private_mode = 00000000
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_private_mode = 00000000
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_private_mode = 00000000
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_private_mode = 00000000
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_private_mode = 00000000
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_private_mode = 00000000
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_cert_private = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_cert_private = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_cert_private = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_cert_private = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_cert_private = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_cert_private = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_cert_private = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_cert_private = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_cert_private = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_cert_private = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_cert_private = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_cert_private = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_cert_private = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_cert_private = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_cert_private = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_cert_private = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_pin_cache_period = -1
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_id = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_id_management = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   server_network = 0.0.0.0
Sat Jan 06 11:04:18 2018 us=101200   server_netmask = 0.0.0.0
Sat Jan 06 11:04:18 2018 us=101200   server_network_ipv6 = ::
Sat Jan 06 11:04:18 2018 us=101200   server_netbits_ipv6 = 0
Sat Jan 06 11:04:18 2018 us=101200   server_bridge_ip = 192.168.1.227
Sat Jan 06 11:04:18 2018 us=101200   server_bridge_netmask = 255.255.0.0
Sat Jan 06 11:04:18 2018 us=101200   server_bridge_pool_start = 192.168.3.1
Sat Jan 06 11:04:18 2018 us=101200   server_bridge_pool_end = 192.168.3.254
Sat Jan 06 11:04:18 2018 us=101200   push_entry = 'route-gateway 192.168.1.227'
Sat Jan 06 11:04:18 2018 us=101200   push_entry = 'ping 10'
Sat Jan 06 11:04:18 2018 us=101200   push_entry = 'ping-restart 120'
Sat Jan 06 11:04:18 2018 us=101200   ifconfig_pool_defined = ENABLED
Sat Jan 06 11:04:18 2018 us=101200   ifconfig_pool_start = 192.168.3.1
Sat Jan 06 11:04:18 2018 us=101200   ifconfig_pool_end = 192.168.3.254
Sat Jan 06 11:04:18 2018 us=101200   ifconfig_pool_netmask = 255.255.0.0
Sat Jan 06 11:04:18 2018 us=101200   ifconfig_pool_persist_filename = 'ipp.txt'
Sat Jan 06 11:04:18 2018 us=101200   ifconfig_pool_persist_refresh_freq = 600
Sat Jan 06 11:04:18 2018 us=101200   ifconfig_ipv6_pool_defined = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   ifconfig_ipv6_pool_base = ::
Sat Jan 06 11:04:18 2018 us=101200   ifconfig_ipv6_pool_netbits = 0
Sat Jan 06 11:04:18 2018 us=101200   n_bcast_buf = 256
Sat Jan 06 11:04:18 2018 us=101200   tcp_queue_limit = 64
Sat Jan 06 11:04:18 2018 us=101200   real_hash_size = 256
Sat Jan 06 11:04:18 2018 us=101200   virtual_hash_size = 256
Sat Jan 06 11:04:18 2018 us=101200   client_connect_script = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   learn_address_script = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   client_disconnect_script = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   client_config_dir = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   ccd_exclusive = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   tmp_dir = 'C:\Users\BRANTE~1\AppData\Local\Temp\'
Sat Jan 06 11:04:18 2018 us=101200   push_ifconfig_defined = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   push_ifconfig_local = 0.0.0.0
Sat Jan 06 11:04:18 2018 us=101200   push_ifconfig_remote_netmask = 0.0.0.0
Sat Jan 06 11:04:18 2018 us=101200   push_ifconfig_ipv6_defined = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   push_ifconfig_ipv6_local = ::/0
Sat Jan 06 11:04:18 2018 us=101200   push_ifconfig_ipv6_remote = ::
Sat Jan 06 11:04:18 2018 us=101200   enable_c2c = ENABLED
Sat Jan 06 11:04:18 2018 us=101200   duplicate_cn = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   cf_max = 0
Sat Jan 06 11:04:18 2018 us=101200   cf_per = 0
Sat Jan 06 11:04:18 2018 us=101200   max_clients = 1024
Sat Jan 06 11:04:18 2018 us=101200   max_routes_per_client = 256
Sat Jan 06 11:04:18 2018 us=101200   auth_user_pass_verify_script = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   auth_user_pass_verify_script_via_file = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   auth_token_generate = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   auth_token_lifetime = 0
Sat Jan 06 11:04:18 2018 us=101200   client = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pull = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   auth_user_pass_file = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   show_net_up = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   route_method = 3
Sat Jan 06 11:04:18 2018 us=101200   block_outside_dns = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   ip_win32_defined = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   ip_win32_type = 3
Sat Jan 06 11:04:18 2018 us=101200   dhcp_masq_offset = 0
Sat Jan 06 11:04:18 2018 us=101200   dhcp_lease_time = 31536000
Sat Jan 06 11:04:18 2018 us=101200   tap_sleep = 10
Sat Jan 06 11:04:18 2018 us=101200   dhcp_options = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   dhcp_renew = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   dhcp_pre_release = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   domain = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   netbios_scope = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   netbios_node_type = 0
Sat Jan 06 11:04:18 2018 us=101200   disable_nbt = DISABLED
Sat Jan 06 11:04:18 2018 us=101200 OpenVPN 2.4.4 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Sep 26 2017
Sat Jan 06 11:04:18 2018 us=101200 Windows version 6.2 (Windows 8 or greater) 64bit
Sat Jan 06 11:04:18 2018 us=101200 library versions: OpenSSL 1.0.2l  25 May 2017, LZO 2.10
Enter Management Password:
Sat Jan 06 11:04:18 2018 us=101200 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Sat Jan 06 11:04:18 2018 us=101200 Need hold release from management interface, waiting...
Sat Jan 06 11:04:18 2018 us=523173 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Sat Jan 06 11:04:18 2018 us=632544 MANAGEMENT: CMD 'state on'
Sat Jan 06 11:04:18 2018 us=663744 MANAGEMENT: CMD 'log all on'
Sat Jan 06 11:04:21 2018 us=804606 MANAGEMENT: CMD 'echo all on'
Sat Jan 06 11:04:21 2018 us=835859 MANAGEMENT: CMD 'hold off'
Sat Jan 06 11:04:21 2018 us=867111 MANAGEMENT: CMD 'hold release'
Sat Jan 06 11:04:21 2018 us=867111 NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to
Sat Jan 06 11:04:21 2018 us=867111 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Sat Jan 06 11:04:22 2018 us=70303 Diffie-Hellman initialized with 4096 bit key
Sat Jan 06 11:04:22 2018 us=70303 TLS-Auth MTU parms [ L:1653 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Sat Jan 06 11:04:22 2018 us=70303 interactive service msg_channel=708
Sat Jan 06 11:04:22 2018 us=70303 open_tun
Sat Jan 06 11:04:22 2018 us=70303 TAP-WIN32 device [Ethernet_7] opened: \\.\Global\{8F042EC3-C372-4CBE-B6DE-0F7F2CF6C408}.tap
Sat Jan 06 11:04:22 2018 us=70303 TAP-Windows Driver Version 9.21 
Sat Jan 06 11:04:22 2018 us=70303 TAP-Windows MTU=1500
Sat Jan 06 11:04:22 2018 us=70303 Sleeping for 10 seconds...
Sat Jan 06 11:04:32 2018 us=71080 NOTE: FlushIpNetTable failed on interface [20] {8F042EC3-C372-4CBE-B6DE-0F7F2CF6C408} (status=1168) : Element not found.  
Sat Jan 06 11:04:32 2018 us=71080 Data Channel MTU parms [ L:1653 D:1450 EF:121 EB:411 ET:32 EL:3 ]
Sat Jan 06 11:04:32 2018 us=71080 Could not determine IPv4/IPv6 protocol. Using AF_INET6
Sat Jan 06 11:04:32 2018 us=71080 Socket Buffers: R=[65536->65536] S=[65536->65536]
Sat Jan 06 11:04:32 2018 us=71080 setsockopt(IPV6_V6ONLY=0)
Sat Jan 06 11:04:32 2018 us=71080 UDPv6 link local (bound): [AF_INET6][undef]:1194
Sat Jan 06 11:04:32 2018 us=71080 UDPv6 link remote: [AF_UNSPEC]
Sat Jan 06 11:04:32 2018 us=71080 MULTI: multi_init called, r=256 v=256
Sat Jan 06 11:04:32 2018 us=71080 IFCONFIG POOL: base=192.168.3.1 size=254, ipv6=0
Sat Jan 06 11:04:32 2018 us=71080 IFCONFIG POOL LIST
Sat Jan 06 11:04:32 2018 us=71080 Initialization Sequence Completed
Sat Jan 06 11:04:32 2018 us=71080 MANAGEMENT: >STATE:1515254672,CONNECTED,SUCCESS,,,,,
Sat Jan 06 11:05:12 2018 us=902307 MULTI: multi_create_instance called
Sat Jan 06 11:05:12 2018 us=902307 192.168.1.1 Re-using SSL/TLS context
Sat Jan 06 11:05:12 2018 us=902307 192.168.1.1 Control Channel MTU parms [ L:1653 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Sat Jan 06 11:05:12 2018 us=902307 192.168.1.1 Data Channel MTU parms [ L:1653 D:1450 EF:121 EB:411 ET:32 EL:3 ]
Sat Jan 06 11:05:12 2018 us=902307 192.168.1.1 Local Options String (VER=V4): 'V4,dev-type tap,link-mtu 1589,tun-mtu 1532,proto UDPv4,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-server'
Sat Jan 06 11:05:12 2018 us=902307 192.168.1.1 Expected Remote Options String (VER=V4): 'V4,dev-type tap,link-mtu 1589,tun-mtu 1532,proto UDPv4,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-client'
Sat Jan 06 11:05:12 2018 us=902307 192.168.1.1 TLS: Initial packet from [AF_INET6]::ffff:192.168.1.1:65260, sid=6d3b6096 978372b7
Sat Jan 06 11:06:12 2018 us=375576 MULTI: multi_create_instance called
Sat Jan 06 11:06:12 2018 us=375576 192.168.1.1 Re-using SSL/TLS context
Sat Jan 06 11:06:12 2018 us=375576 192.168.1.1 Control Channel MTU parms [ L:1653 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Sat Jan 06 11:06:12 2018 us=375576 192.168.1.1 Data Channel MTU parms [ L:1653 D:1450 EF:121 EB:411 ET:32 EL:3 ]
Sat Jan 06 11:06:12 2018 us=375576 192.168.1.1 Local Options String (VER=V4): 'V4,dev-type tap,link-mtu 1589,tun-mtu 1532,proto UDPv4,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-server'
Sat Jan 06 11:06:12 2018 us=375576 192.168.1.1 Expected Remote Options String (VER=V4): 'V4,dev-type tap,link-mtu 1589,tun-mtu 1532,proto UDPv4,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-client'
Sat Jan 06 11:06:12 2018 us=375576 192.168.1.1 TLS: Initial packet from [AF_INET6]::ffff:192.168.1.1:49292, sid=954f86f6 6aa19d64
Sat Jan 06 11:06:12 2018 us=672475 192.168.1.1 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sat Jan 06 11:06:12 2018 us=672475 192.168.1.1 TLS Error: TLS handshake failed
Sat Jan 06 11:06:12 2018 us=672475 192.168.1.1 SIGUSR1[soft,tls-error] received, client-instance restarting
Sat Jan 06 11:07:12 2018 us=536467 MULTI: multi_create_instance called
Sat Jan 06 11:07:12 2018 us=536467 192.168.1.1 Re-using SSL/TLS context
Sat Jan 06 11:07:12 2018 us=536467 192.168.1.1 Control Channel MTU parms [ L:1653 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Sat Jan 06 11:07:12 2018 us=536467 192.168.1.1 Data Channel MTU parms [ L:1653 D:1450 EF:121 EB:411 ET:32 EL:3 ]
Sat Jan 06 11:07:12 2018 us=536467 192.168.1.1 Local Options String (VER=V4): 'V4,dev-type tap,link-mtu 1589,tun-mtu 1532,proto UDPv4,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-server'
Sat Jan 06 11:07:12 2018 us=536467 192.168.1.1 Expected Remote Options String (VER=V4): 'V4,dev-type tap,link-mtu 1589,tun-mtu 1532,proto UDPv4,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-client'
Sat Jan 06 11:07:12 2018 us=536467 192.168.1.1 TLS: Initial packet from [AF_INET6]::ffff:192.168.1.1:57462, sid=53b26929 1c6575c7
Sat Jan 06 11:07:12 2018 us=583332 192.168.1.1 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sat Jan 06 11:07:12 2018 us=583332 192.168.1.1 TLS Error: TLS handshake failed
Sat Jan 06 11:07:12 2018 us=583332 192.168.1.1 SIGUSR1[soft,tls-error] received, client-instance restarting
Sat Jan 06 11:07:29 2018 us=365918 SENT CONTROL [UNDEF]: 'RESTART' (status=1)
Sat Jan 06 11:07:29 2018 us=365918 TCP/UDP: Closing socket
Sat Jan 06 11:07:29 2018 us=365918 Closing TUN/TAP interface
Sat Jan 06 11:07:29 2018 us=381489 SIGTERM[hard,] received, process exiting
Sat Jan 06 11:07:29 2018 us=381489 MANAGEMENT: >STATE:1515254849,EXITING,SIGTERM,,,,,

View OriginalClient

1

##############################################

2

3

# Sample client-side OpenVPN 2.0 config file #

4

5

# for connecting to multi-client server. #

6

7

# #

8

9

# This configuration can be used by multiple #

10

11

# clients, however each client should have #

12

13

# its own cert and key files. #

14

15

# #

16

17

# On Windows, you might want to rename this #

18

19

# file so it has a .ovpn extension #

20

21

##############################################

22

23

24

25

# Specify that we are a client and that we

26

27

# will be pulling certain config file directives

28

29

# from the server.

30

31

client

32

33

34

35

# Use the same setting as you are using on

36

37

# the server.

38

39

# On most systems, the VPN will not function

40

41

# unless you partially or fully disable

42

43

# the firewall for the TUN/TAP interface.

44

45

;dev tap

46

47

dev tun

48

49

50

51

# Windows needs the TAP-Win32 adapter name

52

53

# from the Network Connections panel

54

55

# if you have more than one. On XP SP2,

56

57

# you may need to disable the firewall

58

59

# for the TAP adapter.

60

61

;dev-node MyTap

62

63

64

65

# Are we connecting to a TCP or

66

67

# UDP server? Use the same setting as

68

69

# on the server.

70

71

;proto tcp

72

73

proto udp

74

75

76

77

# The hostname/IP and port of the server.

78

79

# You can have multiple remote entries

80

81

# to load balance between the servers.

82

83

remote [Public IP] 1194

84

85

86

87

# Choose a random host from the remote

88

89

# list for load-balancing. Otherwise

90

91

# try hosts in the order specified.

92

93

;remote-random

94

95

96

97

# Keep trying indefinitely to resolve the

98

99

# host name of the OpenVPN server. Very useful

100

101

# on machines which are not permanently connected

102

103

# to the internet such as laptops.

104

105

resolv-retry infinite

106

107

108

109

# Most clients don't need to bind to

110

111

# a specific local port number.

112

113

nobind

114

115

116

117

# Downgrade privileges after initialization (non-Windows only)

118

119

;user nobody

120

121

;group nobody

122

123

124

125

# Try to preserve some state across restarts.

126

127

persist-key

128

129

persist-tun

130

131

132

133

# If you are connecting through an

134

135

# HTTP proxy to reach the actual OpenVPN

136

137

# server, put the proxy server/IP and

138

139

# port number here. See the man page

140

141

# if your proxy server requires

142

143

# authentication.

144

145

;http-proxy-retry # retry on connection failures

146

147

;http-proxy [proxy server] [proxy port #]

148

149

150

151

# Wireless networks often produce a lot

152

153

# of duplicate packets. Set this flag

154

155

# to silence duplicate packet warnings.

156

157

;mute-replay-warnings

158

159

160

161

# SSL/TLS parms.

162

163

# See the server config file for more

164

165

# description. It's best to use

166

167

# a separate .crt/.key file pair

168

169

# for each client. A single ca

170

171

# file can be used for all clients.

172

173

<ca>

174

--STRIPPED INLINE CA CERT--

175

</ca>

176

177

<cert>

178

--STRIPPED INLINE CERT--

179

</cert>

180

181

<key>

182

--STRIPPED INLINE KEY--

183

</key>

184

185

186

187

# Verify server certificate by checking that the

188

189

# certicate has the correct key usage set.

190

191

# This is an important precaution to protect against

192

193

# a potential attack discussed here:

194

195

# http://openvpn.net/howto.html#mitm

196

197

#

198

199

# To use this feature, you will need to generate

200

201

# your server certificates with the keyUsage set to

202

203

# digitalSignature, keyEncipherment

204

205

# and the extendedKeyUsage to

206

207

# serverAuth

208

209

# EasyRSA can do this for you.

210

211

;remote-cert-tls BT-MonCon-SRV

212

213

214

215

# If a tls-auth key is used on the server

216

217

# then every client must also have the key.

218

219

;tls-auth ta.key 1

220

221

222

223

# Select a cryptographic cipher.

224

225

# If the cipher option is used on the server

226

227

# then you must also specify it here.

228

229

# Note that v2.4 client/server will automatically

230

231

# negotiate AES-256-GCM in TLS mode.

232

233

# See also the ncp-cipher option in the manpage

234

235

cipher AES-256-CBC

236

237

238

239

# Enable compression on the VPN link.

240

241

# Don't enable this unless it is also

242

243

# enabled in the server config file.

244

245

#comp-lzo

246

247

248

249

# Set log file verbosity.

250

251

verb 4

252

253

254

255

# Silence repeating messages

256

257

;mute 20

258

1

client

2

dev tun

3

proto udp

4

remote [Public IP] 1194

5

resolv-retry infinite

6

nobind

7

persist-key

8

persist-tun

9

<ca>

10

--STRIPPED INLINE CA CERT--

11

</ca>

12

<cert>

13

--STRIPPED INLINE CERT--

14

</cert>

15

<key>

16

--STRIPPED INLINE KEY--

17

</key>

18

cipher AES-256-CBC

19

verb 4

Client Log

Code: Select all

*Tunnelblick: OS X 10.13.2; Tunnelblick 3.7.4b (build 4921)
2018-01-06 11:05:12 *Tunnelblick: Attempting connection with BransonMac using shadow copy; Set nameserver = 769; monitoring connection
2018-01-06 11:05:12 *Tunnelblick: openvpnstart start BransonMac.tblk 1337 769 0 1 0 1065264 -ptADGNWradsgnw 2.4.4-openssl-1.0.2n
2018-01-06 11:05:12 *Tunnelblick: openvpnstart log:
     OpenVPN started successfully. Command used to start OpenVPN (one argument per displayed line):
     
          /Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.4.4-openssl-1.0.2n/openvpn
          --daemon
          --log
          /Library/Application Support/Tunnelblick/Logs/-SUsers-Sbransonbuchanan-SLibrary-SApplication Support-STunnelblick-SConfigurations-SBransonMac.tblk-SContents-SResources-Sconfig.ovpn.769_0_1_0_1065264.1337.openvpn.log
          --cd
          /Library/Application Support/Tunnelblick/Users/bransonbuchanan/BransonMac.tblk/Contents/Resources
          --setenv
          IV_GUI_VER
          "net.tunnelblick.tunnelblick 4921 3.7.4b (build 4921)"
          --verb
          3
          --config
          /Library/Application Support/Tunnelblick/Users/bransonbuchanan/BransonMac.tblk/Contents/Resources/config.ovpn
          --verb
          3
          --cd
          /Library/Application Support/Tunnelblick/Users/bransonbuchanan/BransonMac.tblk/Contents/Resources
          --management
          127.0.0.1
          1337
          --management-query-passwords
          --management-hold
          --script-security
          2
          --up
          /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw
          --down
          /Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw

2018-01-06 11:05:12 *Tunnelblick: Established communication with OpenVPN
2018-01-06 11:05:12 OpenVPN 2.4.4 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [MH/RECVDA] [AEAD] built on Dec  7 2017
2018-01-06 11:05:12 library versions: OpenSSL 1.0.2n  7 Dec 2017, LZO 2.10
2018-01-06 11:05:12 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:1337
2018-01-06 11:05:12 Need hold release from management interface, waiting...
2018-01-06 11:05:12 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:1337
2018-01-06 11:05:12 MANAGEMENT: CMD 'pid'
2018-01-06 11:05:12 MANAGEMENT: CMD 'state on'
2018-01-06 11:05:12 MANAGEMENT: CMD 'state'
2018-01-06 11:05:12 MANAGEMENT: CMD 'bytecount 1'
2018-01-06 11:05:12 MANAGEMENT: CMD 'hold release'
2018-01-06 11:05:12 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
2018-01-06 11:05:12 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2018-01-06 11:05:12 MANAGEMENT: >STATE:1515254712,RESOLVE,,,,,,
2018-01-06 11:05:12 TCP/UDP: Preserving recently used remote address: [AF_INET][Public IP]:1194
2018-01-06 11:05:12 Socket Buffers: R=[196724->196724] S=[9216->9216]
2018-01-06 11:05:12 UDP link local: (not bound)
2018-01-06 11:05:12 UDP link remote: [AF_INET][Public IP]:1194
2018-01-06 11:05:12 MANAGEMENT: >STATE:1515254712,WAIT,,,,,,
2018-01-06 11:05:12 *Tunnelblick: openvpnstart starting OpenVPN
2018-01-06 11:06:12 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
2018-01-06 11:06:12 TLS Error: TLS handshake failed
2018-01-06 11:06:12 SIGUSR1[soft,tls-error] received, process restarting
2018-01-06 11:06:12 MANAGEMENT: >STATE:1515254772,RECONNECTING,tls-error,,,,,
2018-01-06 11:06:12 MANAGEMENT: CMD 'hold release'
2018-01-06 11:06:12 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
2018-01-06 11:06:12 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2018-01-06 11:06:12 MANAGEMENT: >STATE:1515254772,RESOLVE,,,,,,
2018-01-06 11:06:12 TCP/UDP: Preserving recently used remote address: [AF_INET][Public IP]:1194
2018-01-06 11:06:12 Socket Buffers: R=[196724->196724] S=[9216->9216]
2018-01-06 11:06:12 UDP link local: (not bound)
2018-01-06 11:06:12 UDP link remote: [AF_INET][Public IP]:1194
2018-01-06 11:06:12 MANAGEMENT: >STATE:1515254772,WAIT,,,,,,
2018-01-06 11:07:12 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
2018-01-06 11:07:12 TLS Error: TLS handshake failed
2018-01-06 11:07:12 SIGUSR1[soft,tls-error] received, process restarting
2018-01-06 11:07:12 MANAGEMENT: >STATE:1515254832,RECONNECTING,tls-error,,,,,
2018-01-06 11:07:12 MANAGEMENT: CMD 'hold release'
2018-01-06 11:07:12 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
2018-01-06 11:07:12 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2018-01-06 11:07:12 MANAGEMENT: >STATE:1515254832,RESOLVE,,,,,,
2018-01-06 11:07:12 TCP/UDP: Preserving recently used remote address: [AF_INET][Public IP]:1194
2018-01-06 11:07:12 Socket Buffers: R=[196724->196724] S=[9216->9216]
2018-01-06 11:07:12 UDP link local: (not bound)
2018-01-06 11:07:12 UDP link remote: [AF_INET][Public IP]:1194
2018-01-06 11:07:12 MANAGEMENT: >STATE:1515254832,WAIT,,,,,,
2018-01-06 11:07:16 *Tunnelblick: Disconnecting; VPN Details… window disconnect button pressed
2018-01-06 11:07:16 *Tunnelblick: No 'pre-disconnect.sh' script to execute
2018-01-06 11:07:16 *Tunnelblick: Disconnecting using 'kill'
2018-01-06 11:07:16 event_wait : Interrupted system call (code=4)
2018-01-06 11:07:16 SIGTERM[hard,] received, process exiting
2018-01-06 11:07:16 MANAGEMENT: >STATE:1515254836,EXITING,SIGTERM,,,,,
2018-01-06 11:07:17 *Tunnelblick: No 'post-disconnect.sh' script to execute
2018-01-06 11:07:17 *Tunnelblick: Expected disconnection occurred.

[TinCanTech]

You appear to be using IPv6:

Sat Jan 06 11:05:12 2018 us=902307 192.168.1.1 TLS: Initial packet from [AF_INET6]::ffff:192.168.1.1:65260, sid=6d3b6096 978372b7

and bridging an IPv4 network:

server-bridge 192.168.1.227 255.255.0.0 192.168.3.1 192.168.3.254

So .. sort out which protocol you are using.

[Bransonb3]

I am trying to use IPv4. I read this article https://community.openvpn.net/openvpn/wiki/IPv6 and don't have any of the settings to use IPv6 in my configs. I disabled v6 on the bridge in windows and I'm still getting the INET6 in the sever log but the client log says it is using UDPv4.
Thanks for the help.

[TinCanTech]

Your server log shows something strange:

Sat Jan 06 11:04:32 2018 us=71080 Could not determine IPv4/IPv6 protocol. Using AF_INET6

Due to your network setup (probably) openvpn is choosing IPv6.

The simple way to force IPv4 is like so in both your configs:

Code: Select all

proto udp4

Try that ..

[Bransonb3]

I changed the proto to UDPv4 on both the client and sever config, but I am still getting the TLS errors.


Server Log

Code: Select all

Sun Jan 07 09:27:13 2018   pkcs11_private_mode = 00000000
Sun Jan 07 09:27:13 2018   pkcs11_private_mode = 00000000
Sun Jan 07 09:27:13 2018   pkcs11_private_mode = 00000000
Sun Jan 07 09:27:13 2018   pkcs11_private_mode = 00000000
Sun Jan 07 09:27:13 2018   pkcs11_private_mode = 00000000
Sun Jan 07 09:27:13 2018   pkcs11_private_mode = 00000000
Sun Jan 07 09:27:13 2018   pkcs11_private_mode = 00000000
Sun Jan 07 09:27:13 2018   pkcs11_private_mode = 00000000
Sun Jan 07 09:27:13 2018   pkcs11_private_mode = 00000000
Sun Jan 07 09:27:13 2018   pkcs11_private_mode = 00000000
Sun Jan 07 09:27:13 2018   pkcs11_private_mode = 00000000
Sun Jan 07 09:27:13 2018   pkcs11_private_mode = 00000000
Sun Jan 07 09:27:13 2018   pkcs11_private_mode = 00000000
Sun Jan 07 09:27:13 2018   pkcs11_private_mode = 00000000
Sun Jan 07 09:27:13 2018   pkcs11_cert_private = DISABLED
Sun Jan 07 09:27:13 2018   pkcs11_cert_private = DISABLED
Sun Jan 07 09:27:13 2018   pkcs11_cert_private = DISABLED
Sun Jan 07 09:27:13 2018   pkcs11_cert_private = DISABLED
Sun Jan 07 09:27:13 2018   pkcs11_cert_private = DISABLED
Sun Jan 07 09:27:13 2018   pkcs11_cert_private = DISABLED
Sun Jan 07 09:27:13 2018   pkcs11_cert_private = DISABLED
Sun Jan 07 09:27:13 2018   pkcs11_cert_private = DISABLED
Sun Jan 07 09:27:13 2018   pkcs11_cert_private = DISABLED
Sun Jan 07 09:27:13 2018   pkcs11_cert_private = DISABLED
Sun Jan 07 09:27:13 2018   pkcs11_cert_private = DISABLED
Sun Jan 07 09:27:13 2018   pkcs11_cert_private = DISABLED
Sun Jan 07 09:27:13 2018   pkcs11_cert_private = DISABLED
Sun Jan 07 09:27:13 2018   pkcs11_cert_private = DISABLED
Sun Jan 07 09:27:13 2018   pkcs11_cert_private = DISABLED
Sun Jan 07 09:27:13 2018   pkcs11_cert_private = DISABLED
Sun Jan 07 09:27:13 2018   pkcs11_pin_cache_period = -1
Sun Jan 07 09:27:13 2018   pkcs11_id = '[UNDEF]'
Sun Jan 07 09:27:13 2018   pkcs11_id_management = DISABLED
Sun Jan 07 09:27:13 2018   server_network = 0.0.0.0
Sun Jan 07 09:27:13 2018   server_netmask = 0.0.0.0
Sun Jan 07 09:27:13 2018   server_network_ipv6 = ::
Sun Jan 07 09:27:13 2018   server_netbits_ipv6 = 0
Sun Jan 07 09:27:13 2018   server_bridge_ip = 192.168.1.227
Sun Jan 07 09:27:13 2018   server_bridge_netmask = 255.255.0.0
Sun Jan 07 09:27:13 2018   server_bridge_pool_start = 192.168.3.1
Sun Jan 07 09:27:13 2018   server_bridge_pool_end = 192.168.3.254
Sun Jan 07 09:27:13 2018   push_entry = 'route-gateway 192.168.1.227'
Sun Jan 07 09:27:13 2018   push_entry = 'ping 10'
Sun Jan 07 09:27:13 2018   push_entry = 'ping-restart 120'
Sun Jan 07 09:27:13 2018   ifconfig_pool_defined = ENABLED
Sun Jan 07 09:27:13 2018   ifconfig_pool_start = 192.168.3.1
Sun Jan 07 09:27:13 2018   ifconfig_pool_end = 192.168.3.254
Sun Jan 07 09:27:13 2018   ifconfig_pool_netmask = 255.255.0.0
Sun Jan 07 09:27:13 2018   ifconfig_pool_persist_filename = 'ipp.txt'
Sun Jan 07 09:27:13 2018   ifconfig_pool_persist_refresh_freq = 600
Sun Jan 07 09:27:13 2018   ifconfig_ipv6_pool_defined = DISABLED
Sun Jan 07 09:27:13 2018   ifconfig_ipv6_pool_base = ::
Sun Jan 07 09:27:13 2018   ifconfig_ipv6_pool_netbits = 0
Sun Jan 07 09:27:13 2018   n_bcast_buf = 256
Sun Jan 07 09:27:13 2018   tcp_queue_limit = 64
Sun Jan 07 09:27:13 2018   real_hash_size = 256
Sun Jan 07 09:27:13 2018   virtual_hash_size = 256
Sun Jan 07 09:27:13 2018   client_connect_script = '[UNDEF]'
Sun Jan 07 09:27:13 2018   learn_address_script = '[UNDEF]'
Sun Jan 07 09:27:13 2018   client_disconnect_script = '[UNDEF]'
Sun Jan 07 09:27:13 2018   client_config_dir = '[UNDEF]'
Sun Jan 07 09:27:13 2018   ccd_exclusive = DISABLED
Sun Jan 07 09:27:13 2018   tmp_dir = 'C:\Users\BRANTE~1\AppData\Local\Temp\'
Sun Jan 07 09:27:13 2018   push_ifconfig_defined = DISABLED
Sun Jan 07 09:27:13 2018   push_ifconfig_local = 0.0.0.0
Sun Jan 07 09:27:13 2018   push_ifconfig_remote_netmask = 0.0.0.0
Sun Jan 07 09:27:13 2018   push_ifconfig_ipv6_defined = DISABLED
Sun Jan 07 09:27:13 2018   push_ifconfig_ipv6_local = ::/0
Sun Jan 07 09:27:13 2018   push_ifconfig_ipv6_remote = ::
Sun Jan 07 09:27:13 2018   enable_c2c = ENABLED
Sun Jan 07 09:27:13 2018   duplicate_cn = DISABLED
Sun Jan 07 09:27:13 2018   cf_max = 0
Sun Jan 07 09:27:13 2018   cf_per = 0
Sun Jan 07 09:27:13 2018   max_clients = 1024
Sun Jan 07 09:27:13 2018   max_routes_per_client = 256
Sun Jan 07 09:27:13 2018   auth_user_pass_verify_script = '[UNDEF]'
Sun Jan 07 09:27:13 2018   auth_user_pass_verify_script_via_file = DISABLED
Sun Jan 07 09:27:13 2018   auth_token_generate = DISABLED
Sun Jan 07 09:27:13 2018   auth_token_lifetime = 0
Sun Jan 07 09:27:13 2018   client = DISABLED
Sun Jan 07 09:27:13 2018   pull = DISABLED
Sun Jan 07 09:27:13 2018   auth_user_pass_file = '[UNDEF]'
Sun Jan 07 09:27:13 2018   show_net_up = DISABLED
Sun Jan 07 09:27:13 2018   route_method = 3
Sun Jan 07 09:27:13 2018   block_outside_dns = DISABLED
Sun Jan 07 09:27:13 2018   ip_win32_defined = DISABLED
Sun Jan 07 09:27:13 2018   ip_win32_type = 3
Sun Jan 07 09:27:13 2018   dhcp_masq_offset = 0
Sun Jan 07 09:27:13 2018   dhcp_lease_time = 31536000
Sun Jan 07 09:27:13 2018   tap_sleep = 10
Sun Jan 07 09:27:13 2018   dhcp_options = DISABLED
Sun Jan 07 09:27:13 2018   dhcp_renew = DISABLED
Sun Jan 07 09:27:13 2018   dhcp_pre_release = DISABLED
Sun Jan 07 09:27:13 2018   domain = '[UNDEF]'
Sun Jan 07 09:27:13 2018   netbios_scope = '[UNDEF]'
Sun Jan 07 09:27:13 2018   netbios_node_type = 0
Sun Jan 07 09:27:13 2018   disable_nbt = DISABLED
Sun Jan 07 09:27:13 2018 OpenVPN 2.4.4 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Sep 26 2017
Sun Jan 07 09:27:13 2018 Windows version 6.2 (Windows 8 or greater) 64bit
Sun Jan 07 09:27:13 2018 library versions: OpenSSL 1.0.2l  25 May 2017, LZO 2.10
Sun Jan 07 09:27:13 2018 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Sun Jan 07 09:27:13 2018 Need hold release from management interface, waiting...
Sun Jan 07 09:27:14 2018 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Sun Jan 07 09:27:14 2018 MANAGEMENT: CMD 'state on'
Sun Jan 07 09:27:14 2018 MANAGEMENT: CMD 'log all on'
Sun Jan 07 09:27:17 2018 MANAGEMENT: CMD 'echo all on'
Sun Jan 07 09:27:17 2018 MANAGEMENT: CMD 'hold off'
Sun Jan 07 09:27:17 2018 MANAGEMENT: CMD 'hold release'
Sun Jan 07 09:27:17 2018 NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to
Sun Jan 07 09:27:17 2018 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Sun Jan 07 09:27:17 2018 Diffie-Hellman initialized with 4096 bit key
Sun Jan 07 09:27:17 2018 TLS-Auth MTU parms [ L:1653 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Sun Jan 07 09:27:17 2018 interactive service msg_channel=512
Sun Jan 07 09:27:17 2018 open_tun
Sun Jan 07 09:27:17 2018 TAP-WIN32 device [Ethernet_7] opened: \\.\Global\{8F042EC3-C372-4CBE-B6DE-0F7F2CF6C408}.tap
Sun Jan 07 09:27:17 2018 TAP-Windows Driver Version 9.21 
Sun Jan 07 09:27:17 2018 TAP-Windows MTU=1500
Sun Jan 07 09:27:17 2018 Sleeping for 10 seconds...
Sun Jan 07 09:27:27 2018 NOTE: FlushIpNetTable failed on interface [21] {8F042EC3-C372-4CBE-B6DE-0F7F2CF6C408} (status=1168) : Element not found.  
Sun Jan 07 09:27:27 2018 Data Channel MTU parms [ L:1653 D:1450 EF:121 EB:411 ET:32 EL:3 ]
Sun Jan 07 09:27:27 2018 Socket Buffers: R=[65536->65536] S=[65536->65536]
Sun Jan 07 09:27:27 2018 UDPv4 link local (bound): [AF_INET][undef]:1194
Sun Jan 07 09:27:27 2018 UDPv4 link remote: [AF_UNSPEC]
Sun Jan 07 09:27:27 2018 MULTI: multi_init called, r=256 v=256
Sun Jan 07 09:27:27 2018 IFCONFIG POOL: base=192.168.3.1 size=254, ipv6=0
Sun Jan 07 09:27:27 2018 IFCONFIG POOL LIST
Sun Jan 07 09:27:27 2018 Initialization Sequence Completed
Sun Jan 07 09:27:27 2018 MANAGEMENT: >STATE:1515335247,CONNECTED,SUCCESS,,,,,
Sun Jan 07 09:27:47 2018 MULTI: multi_create_instance called
Sun Jan 07 09:27:47 2018 174.194.43.119:3726 Re-using SSL/TLS context
Sun Jan 07 09:27:47 2018 174.194.43.119:3726 Control Channel MTU parms [ L:1653 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Sun Jan 07 09:27:47 2018 174.194.43.119:3726 Data Channel MTU parms [ L:1653 D:1450 EF:121 EB:411 ET:32 EL:3 ]
Sun Jan 07 09:27:47 2018 174.194.43.119:3726 Local Options String (VER=V4): 'V4,dev-type tap,link-mtu 1589,tun-mtu 1532,proto UDPv4,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-server'
Sun Jan 07 09:27:47 2018 174.194.43.119:3726 Expected Remote Options String (VER=V4): 'V4,dev-type tap,link-mtu 1589,tun-mtu 1532,proto UDPv4,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-client'
Sun Jan 07 09:27:47 2018 174.194.43.119:3726 TLS: Initial packet from [AF_INET]174.194.43.119:3726, sid=09c10ce7 e60996f9
Sun Jan 07 09:28:47 2018 174.194.43.119:3726 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sun Jan 07 09:28:47 2018 174.194.43.119:3726 TLS Error: TLS handshake failed
Sun Jan 07 09:28:47 2018 174.194.43.119:3726 SIGUSR1[soft,tls-error] received, client-instance restarting
Sun Jan 07 09:28:47 2018 MULTI: multi_create_instance called
Sun Jan 07 09:28:47 2018 174.194.43.119:3733 Re-using SSL/TLS context
Sun Jan 07 09:28:47 2018 174.194.43.119:3733 Control Channel MTU parms [ L:1653 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Sun Jan 07 09:28:47 2018 174.194.43.119:3733 Data Channel MTU parms [ L:1653 D:1450 EF:121 EB:411 ET:32 EL:3 ]
Sun Jan 07 09:28:47 2018 174.194.43.119:3733 Local Options String (VER=V4): 'V4,dev-type tap,link-mtu 1589,tun-mtu 1532,proto UDPv4,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-server'
Sun Jan 07 09:28:47 2018 174.194.43.119:3733 Expected Remote Options String (VER=V4): 'V4,dev-type tap,link-mtu 1589,tun-mtu 1532,proto UDPv4,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-client'
Sun Jan 07 09:28:47 2018 174.194.43.119:3733 TLS: Initial packet from [AF_INET]174.194.43.119:3733, sid=0d4678da 93408c42

Client Log

Code: Select all

*Tunnelblick: OS X 10.13.2; Tunnelblick 3.7.4b (build 4921)
2018-01-07 09:27:46 *Tunnelblick: Attempting connection with BransonMac using shadow copy; Set nameserver = 769; monitoring connection
2018-01-07 09:27:46 *Tunnelblick: openvpnstart start BransonMac.tblk 1337 769 0 1 0 1065264 -ptADGNWradsgnw 2.4.4-openssl-1.0.2n
2018-01-07 09:27:46 *Tunnelblick: openvpnstart log:
     OpenVPN started successfully. Command used to start OpenVPN (one argument per displayed line):
     
          /Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.4.4-openssl-1.0.2n/openvpn
          --daemon
          --log
          /Library/Application Support/Tunnelblick/Logs/-SUsers-Sbransonbuchanan-SLibrary-SApplication Support-STunnelblick-SConfigurations-SBransonMac.tblk-SContents-SResources-Sconfig.ovpn.769_0_1_0_1065264.1337.openvpn.log
          --cd
          /Library/Application Support/Tunnelblick/Users/bransonbuchanan/BransonMac.tblk/Contents/Resources
          --setenv
          IV_GUI_VER
          "net.tunnelblick.tunnelblick 4921 3.7.4b (build 4921)"
          --verb
          3
          --config
          /Library/Application Support/Tunnelblick/Users/bransonbuchanan/BransonMac.tblk/Contents/Resources/config.ovpn
          --verb
          3
          --cd
          /Library/Application Support/Tunnelblick/Users/bransonbuchanan/BransonMac.tblk/Contents/Resources
          --management
          127.0.0.1
          1337
          --management-query-passwords
          --management-hold
          --script-security
          2
          --up
          /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw
          --down
          /Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw

2018-01-07 09:27:46 OpenVPN 2.4.4 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [MH/RECVDA] [AEAD] built on Dec  7 2017
2018-01-07 09:27:46 library versions: OpenSSL 1.0.2n  7 Dec 2017, LZO 2.10
2018-01-07 09:27:46 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:1337
2018-01-07 09:27:46 Need hold release from management interface, waiting...
2018-01-07 09:27:46 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:1337
2018-01-07 09:27:46 *Tunnelblick: openvpnstart starting OpenVPN
2018-01-07 09:27:47 *Tunnelblick: Established communication with OpenVPN
2018-01-07 09:27:47 MANAGEMENT: CMD 'pid'
2018-01-07 09:27:47 MANAGEMENT: CMD 'state on'
2018-01-07 09:27:47 MANAGEMENT: CMD 'state'
2018-01-07 09:27:47 MANAGEMENT: CMD 'bytecount 1'
2018-01-07 09:27:47 MANAGEMENT: CMD 'hold release'
2018-01-07 09:27:47 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
2018-01-07 09:27:47 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2018-01-07 09:27:47 MANAGEMENT: >STATE:1515335267,RESOLVE,,,,,,
2018-01-07 09:27:47 TCP/UDP: Preserving recently used remote address: [AF_INET][ServerIP]:1194
2018-01-07 09:27:47 Socket Buffers: R=[196724->196724] S=[9216->9216]
2018-01-07 09:27:47 UDPv4 link local: (not bound)
2018-01-07 09:27:47 UDPv4 link remote: [AF_INET][ServerIP]:1194
2018-01-07 09:27:47 MANAGEMENT: >STATE:1515335267,WAIT,,,,,,
2018-01-07 09:28:47 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
2018-01-07 09:28:47 TLS Error: TLS handshake failed
2018-01-07 09:28:47 SIGUSR1[soft,tls-error] received, process restarting
2018-01-07 09:28:47 MANAGEMENT: >STATE:1515335327,RECONNECTING,tls-error,,,,,
2018-01-07 09:28:47 MANAGEMENT: CMD 'hold release'
2018-01-07 09:28:47 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
2018-01-07 09:28:47 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2018-01-07 09:28:47 MANAGEMENT: >STATE:1515335327,RESOLVE,,,,,,
2018-01-07 09:28:47 TCP/UDP: Preserving recently used remote address: [AF_INET][ServerIP]:1194
2018-01-07 09:28:47 Socket Buffers: R=[196724->196724] S=[9216->9216]
2018-01-07 09:28:47 UDPv4 link local: (not bound)
2018-01-07 09:28:47 UDPv4 link remote: [AF_INET][ServerIP]:1194
2018-01-07 09:28:47 MANAGEMENT: >STATE:1515335327,WAIT,,,,,,
2018-01-07 09:28:50 *Tunnelblick: Disconnecting; VPN Details… window disconnect button pressed
2018-01-07 09:28:51 *Tunnelblick: No 'pre-disconnect.sh' script to execute
2018-01-07 09:28:51 *Tunnelblick: Disconnecting using 'kill'
2018-01-07 09:28:51 event_wait : Interrupted system call (code=4)
2018-01-07 09:28:51 SIGTERM[hard,] received, process exiting
2018-01-07 09:28:51 MANAGEMENT: >STATE:1515335331,EXITING,SIGTERM,,,,,
2018-01-07 09:28:51 *Tunnelblick: No 'post-disconnect.sh' script to execute
2018-01-07 09:28:51 *Tunnelblick: Expected disconnection occurred.

[TinCanTech]

The IPv6 issue appears to be gone ..

Perhaps your bridge is at fault ?

[Bransonb3]

I changed the server-bridge ip setup and remade the bridge and it is working now.
Thanks for your help.