TLS handshake failed

Need help configuring your VPN? Just post here and you'll get that help.

Moderators: TinCanTech, TinCanTech, TinCanTech, TinCanTech, TinCanTech, TinCanTech

Forum rules
Please use the [oconf] BB tag for openvpn Configurations. See viewtopic.php?f=30&t=21589 for an example.
Post Reply
Bransonb3
OpenVpn Newbie
Posts: 4
Joined: Sat Jan 06, 2018 3:38 pm

TLS handshake failed

Post by Bransonb3 » Sat Jan 06, 2018 4:57 pm

When I try to connect to my openvpn server I get TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) and TLS Error: TLS handshake failed. It looks like the server sees the client try to connect (TLS: Initial packet from...) but doesn't respond.

I'm running openvpn 2.4.4 on Windows Server 2016 1607. I am trying to connect my Mac running OSX 10.13.2, using Tunnelblick 3.7.4b but have also tried connecting using the openvpn connect android app. I have port forwarded 1194 udp to my server, made an inbound and outbound windows firewall rule allowing openvpn.exe, allowed tunnelblick incoming connections on the mac firewall. I have also tried to run the server as admin.

Server
#################################################
# Sample OpenVPN 2.0 config file for #
# multi-client server. #
# #
# This file is for the server side #
# of a many-clients <-> one-server #
# OpenVPN configuration. #
# #
# OpenVPN also supports #
# single-machine <-> single-machine #
# configurations (See the Examples page #
# on the web site for more info). #
# #
# This config should work on Windows #
# or Linux/BSD systems. Remember on #
# Windows to quote pathnames and use #
# double backslashes, e.g.: #
# "C:\\Program Files\\OpenVPN\\config\\foo.key" #
# #
# Comments are preceded with '#' or ';' #
#################################################

# Which local IP address should OpenVPN
# listen on? (optional)
;local a.b.c.d

# Which TCP/UDP port should OpenVPN listen on?
# If you want to run multiple OpenVPN instances
# on the same machine, use a different port
# number for each one. You will need to
# open up this port on your firewall.
port 1194

# TCP or UDP server?
;proto tcp
proto udp

# "dev tun" will create a routed IP tunnel,
# "dev tap" will create an ethernet tunnel.
# Use "dev tap0" if you are ethernet bridging
# and have precreated a tap0 virtual interface
# and bridged it with your ethernet interface.
# If you want to control access policies
# over the VPN, you must create firewall
# rules for the the TUN/TAP interface.
# On non-Windows systems, you can give
# an explicit unit number, such as tun0.
# On Windows, use "dev-node" for this.
# On most systems, the VPN will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
;dev tun
dev tap

# Windows needs the TAP-Win32 adapter name
# from the Network Connections panel if you
# have more than one. On XP SP2 or higher,
# you may need to selectively disable the
# Windows firewall for the TAP adapter.
# Non-Windows systems usually don't need this.
dev-node Ethernet_7

# SSL/TLS root certificate (ca), certificate
# (cert), and private key (key). Each client
# and the server must have their own cert and
# key file. The server and all clients will
# use the same ca file.
#
# See the "easy-rsa" directory for a series
# of scripts for generating RSA certificates
# and private keys. Remember to use
# a unique Common Name for the server
# and each of the client certificates.
#
# Any X509 key management system can be used.
# OpenVPN can also use a PKCS #12 formatted key file
# (see "pkcs12" directive in man page).
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\server.crt"
key "C:\\Program Files\\OpenVPN\\config\\server.key" # This file should be kept secret

# Diffie hellman parameters.
# Generate your own with:
# openssl dhparam -out dh2048.pem 2048
dh "C:\\Program Files\\OpenVPN\\config\\dh4096.pem"

# Network topology
# Should be subnet (addressing via IP)
# unless Windows clients v2.0.9 and lower have to
# be supported (then net30, i.e. a /30 per client)
# Defaults to net30 (not recommended)
topology subnet

# Configure server mode and supply a VPN subnet
# for OpenVPN to draw client addresses from.
# The server will take 10.8.0.1 for itself,
# the rest will be made available to clients.
# Each client will be able to reach the server
# on 10.8.0.1. Comment this line out if you are
# ethernet bridging. See the man page for more info.
;server 192.168.1.225 255.255.0.0

# Maintain a record of client <-> virtual IP address
# associations in this file. If OpenVPN goes down or
# is restarted, reconnecting clients can be assigned
# the same virtual IP address from the pool that was
# previously assigned.
ifconfig-pool-persist ipp.txt

# Configure server mode for ethernet bridging.
# You must first use your OS's bridging capability
# to bridge the TAP interface with the ethernet
# NIC interface. Then you must manually set the
# IP/netmask on the bridge interface, here we
# assume 192.168.1.227/255.255.0.0. Finally we
# must set aside an IP range in this subnet
# (start=192.168.3.1 end=192.168.3.254) to allocate
# to connecting clients. Leave this line commented
# out unless you are ethernet bridging.
server-bridge 192.168.1.227 255.255.0.0 192.168.3.1 192.168.3.254

# Configure server mode for ethernet bridging
# using a DHCP-proxy, where clients talk
# to the OpenVPN server-side DHCP server
# to receive their IP address allocation
# and DNS server addresses. You must first use
# your OS's bridging capability to bridge the TAP
# interface with the ethernet NIC interface.
# Note: this mode only works on clients (such as
# Windows), where the client-side TAP adapter is
# bound to a DHCP client.
;server-bridge

# Push routes to the client to allow it
# to reach other private subnets behind
# the server. Remember that these
# private subnets will also need
# to know to route the OpenVPN client
# address pool (10.8.0.0/255.255.255.0)
# back to the OpenVPN server.
;push "route 192.168.10.0 255.255.255.0"
;push "route 192.168.20.0 255.255.255.0"

# To assign specific IP addresses to specific
# clients or if a connecting client has a private
# subnet behind it that should also have VPN access,
# use the subdirectory "ccd" for client-specific
# configuration files (see man page for more info).

# EXAMPLE: Suppose the client
# having the certificate common name "Thelonious"
# also has a small subnet behind his connecting
# machine, such as 192.168.40.128/255.255.255.248.
# First, uncomment out these lines:
;client-config-dir ccd
;route 192.168.40.128 255.255.255.248
# Then create a file ccd/Thelonious with this line:
# iroute 192.168.40.128 255.255.255.248
# This will allow Thelonious' private subnet to
# access the VPN. This example will only work
# if you are routing, not bridging, i.e. you are
# using "dev tun" and "server" directives.

# EXAMPLE: Suppose you want to give
# Thelonious a fixed VPN IP address of 10.9.0.1.
# First uncomment out these lines:
;client-config-dir ccd
;route 10.9.0.0 255.255.255.252
# Then add this line to ccd/Thelonious:
# ifconfig-push 10.9.0.1 10.9.0.2

# Suppose that you want to enable different
# firewall access policies for different groups
# of clients. There are two methods:
# (1) Run multiple OpenVPN daemons, one for each
# group, and firewall the TUN/TAP interface
# for each group/daemon appropriately.
# (2) (Advanced) Create a script to dynamically
# modify the firewall in response to access
# from different clients. See man
# page for more info on learn-address script.
;learn-address ./script

# If enabled, this directive will configure
# all clients to redirect their default
# network gateway through the VPN, causing
# all IP traffic such as web browsing and
# and DNS lookups to go through the VPN
# (The OpenVPN server machine may need to NAT
# or bridge the TUN/TAP interface to the internet
# in order for this to work properly).
;push "redirect-gateway def1 bypass-dhcp"

# Certain Windows-specific network settings
# can be pushed to clients, such as DNS
# or WINS server addresses. CAVEAT:
# http://openvpn.net/faq.html#dhcpcaveats
# The addresses below refer to the public
# DNS servers provided by opendns.com.
;push "dhcp-option DNS 208.67.222.222"
;push "dhcp-option DNS 208.67.220.220"

# Uncomment this directive to allow different
# clients to be able to "see" each other.
# By default, clients will only see the server.
# To force clients to only see the server, you
# will also need to appropriately firewall the
# server's TUN/TAP interface.
client-to-client

# Uncomment this directive if multiple clients
# might connect with the same certificate/key
# files or common names. This is recommended
# only for testing purposes. For production use,
# each client should have its own certificate/key
# pair.
#
# IF YOU HAVE NOT GENERATED INDIVIDUAL
# CERTIFICATE/KEY PAIRS FOR EACH CLIENT,
# EACH HAVING ITS OWN UNIQUE "COMMON NAME",
# UNCOMMENT THIS LINE OUT.
;duplicate-cn

# The keepalive directive causes ping-like
# messages to be sent back and forth over
# the link so that each side knows when
# the other side has gone down.
# Ping every 10 seconds, assume that remote
# peer is down if no ping received during
# a 120 second time period.
keepalive 10 120

# For extra security beyond that provided
# by SSL/TLS, create an "HMAC firewall"
# to help block DoS attacks and UDP port flooding.
#
# Generate with:
# openvpn --genkey --secret ta.key
#
# The server and each client must have
# a copy of this key.
# The second parameter should be '0'
# on the server and '1' on the clients.
;tls-auth "C:\\Program Files\\OpenVPN\\config\\ta.key" 0 # This file is secret

# Select a cryptographic cipher.
# This config item must be copied to
# the client config file as well.
# Note that v2.4 client/server will automatically
# negotiate AES-256-GCM in TLS mode.
# See also the ncp-cipher option in the manpage
cipher AES-256-CBC

# Enable compression on the VPN link and push the
# option to the client (v2.4+ only, for earlier
# versions see below)
;compress lz4-v2
;push "compress lz4-v2"

# For compression compatible with older clients use comp-lzo
# If you enable it here, you must also
# enable it in the client config file.
;comp-lzo

# The maximum number of concurrently connected
# clients we want to allow.
;max-clients 100

# It's a good idea to reduce the OpenVPN
# daemon's privileges after initialization.
#
# You can uncomment this out on
# non-Windows systems.
;user nobody
;group nobody

# The persist options will try to avoid
# accessing certain resources on restart
# that may no longer be accessible because
# of the privilege downgrade.
persist-key
persist-tun

# Output a short status file showing
# current connections, truncated
# and rewritten every minute.
status openvpn-status.log

# By default, log messages will go to the syslog (or
# on Windows, if running as a service, they will go to
# the "\Program Files\OpenVPN\log" directory).
# Use log or log-append to override this default.
# "log" will truncate the log file on OpenVPN startup,
# while "log-append" will append to it. Use one
# or the other (but not both).
;log openvpn.log
;log-append openvpn.log

# Set the appropriate level of log
# file verbosity.
#
# 0 is silent, except for fatal errors
# 4 is reasonable for general usage
# 5 and 6 can help to debug connection problems
# 9 is extremely verbose
verb 3

# Silence repeating messages. At most 20
# sequential messages of the same message
# category will be output to the log.
;mute 20

# Notify the client that when the server restarts so it
# can automatically reconnect.
explicit-exit-notify 1

Server Log

Code: Select all

Sat Jan 06 11:04:18 2018 us=101200 Current Parameter Settings:
Sat Jan 06 11:04:18 2018 us=101200   config = 'server.ovpn'
Sat Jan 06 11:04:18 2018 us=101200   mode = 1
Sat Jan 06 11:04:18 2018 us=101200   show_ciphers = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   show_digests = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   show_engines = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   genkey = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   key_pass_file = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   show_tls_ciphers = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   connect_retry_max = 0
Sat Jan 06 11:04:18 2018 us=101200 Connection profiles [0]:
Sat Jan 06 11:04:18 2018 us=101200   proto = udp
Sat Jan 06 11:04:18 2018 us=101200   local = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   local_port = '1194'
Sat Jan 06 11:04:18 2018 us=101200   remote = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   remote_port = '1194'
Sat Jan 06 11:04:18 2018 us=101200   remote_float = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   bind_defined = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   bind_local = ENABLED
Sat Jan 06 11:04:18 2018 us=101200   bind_ipv6_only = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   connect_retry_seconds = 5
Sat Jan 06 11:04:18 2018 us=101200   connect_timeout = 120
Sat Jan 06 11:04:18 2018 us=101200   socks_proxy_server = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   socks_proxy_port = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   tun_mtu = 1500
Sat Jan 06 11:04:18 2018 us=101200   tun_mtu_defined = ENABLED
Sat Jan 06 11:04:18 2018 us=101200   link_mtu = 1500
Sat Jan 06 11:04:18 2018 us=101200   link_mtu_defined = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   tun_mtu_extra = 32
Sat Jan 06 11:04:18 2018 us=101200   tun_mtu_extra_defined = ENABLED
Sat Jan 06 11:04:18 2018 us=101200   mtu_discover_type = -1
Sat Jan 06 11:04:18 2018 us=101200   fragment = 0
Sat Jan 06 11:04:18 2018 us=101200   mssfix = 1450
Sat Jan 06 11:04:18 2018 us=101200   explicit_exit_notification = 1
Sat Jan 06 11:04:18 2018 us=101200 Connection profiles END
Sat Jan 06 11:04:18 2018 us=101200   remote_random = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   ipchange = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   dev = 'tap'
Sat Jan 06 11:04:18 2018 us=101200   dev_type = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   dev_node = 'Ethernet_7'
Sat Jan 06 11:04:18 2018 us=101200   lladdr = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   topology = 3
Sat Jan 06 11:04:18 2018 us=101200   ifconfig_local = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   ifconfig_remote_netmask = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   ifconfig_noexec = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   ifconfig_nowarn = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   ifconfig_ipv6_local = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   ifconfig_ipv6_netbits = 0
Sat Jan 06 11:04:18 2018 us=101200   ifconfig_ipv6_remote = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   shaper = 0
Sat Jan 06 11:04:18 2018 us=101200   mtu_test = 0
Sat Jan 06 11:04:18 2018 us=101200   mlock = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   keepalive_ping = 10
Sat Jan 06 11:04:18 2018 us=101200   keepalive_timeout = 120
Sat Jan 06 11:04:18 2018 us=101200   inactivity_timeout = 0
Sat Jan 06 11:04:18 2018 us=101200   ping_send_timeout = 10
Sat Jan 06 11:04:18 2018 us=101200   ping_rec_timeout = 240
Sat Jan 06 11:04:18 2018 us=101200   ping_rec_timeout_action = 2
Sat Jan 06 11:04:18 2018 us=101200   ping_timer_remote = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   remap_sigusr1 = 0
Sat Jan 06 11:04:18 2018 us=101200   persist_tun = ENABLED
Sat Jan 06 11:04:18 2018 us=101200   persist_local_ip = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   persist_remote_ip = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   persist_key = ENABLED
Sat Jan 06 11:04:18 2018 us=101200   passtos = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   resolve_retry_seconds = 1000000000
Sat Jan 06 11:04:18 2018 us=101200   resolve_in_advance = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   username = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   groupname = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   chroot_dir = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   cd_dir = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   writepid = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   up_script = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   down_script = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   down_pre = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   up_restart = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   up_delay = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   daemon = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   inetd = 0
Sat Jan 06 11:04:18 2018 us=101200   log = ENABLED
Sat Jan 06 11:04:18 2018 us=101200   suppress_timestamps = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   machine_readable_output = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   nice = 0
Sat Jan 06 11:04:18 2018 us=101200   verbosity = 4
Sat Jan 06 11:04:18 2018 us=101200   mute = 0
Sat Jan 06 11:04:18 2018 us=101200   gremlin = 0
Sat Jan 06 11:04:18 2018 us=101200   status_file = 'openvpn-status.log'
Sat Jan 06 11:04:18 2018 us=101200   status_file_version = 1
Sat Jan 06 11:04:18 2018 us=101200   status_file_update_freq = 60
Sat Jan 06 11:04:18 2018 us=101200   occ = ENABLED
Sat Jan 06 11:04:18 2018 us=101200   rcvbuf = 0
Sat Jan 06 11:04:18 2018 us=101200   sndbuf = 0
Sat Jan 06 11:04:18 2018 us=101200   sockflags = 0
Sat Jan 06 11:04:18 2018 us=101200   fast_io = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   comp.alg = 0
Sat Jan 06 11:04:18 2018 us=101200   comp.flags = 0
Sat Jan 06 11:04:18 2018 us=101200   route_script = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   route_default_gateway = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   route_default_metric = 0
Sat Jan 06 11:04:18 2018 us=101200   route_noexec = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   route_delay = 0
Sat Jan 06 11:04:18 2018 us=101200   route_delay_window = 30
Sat Jan 06 11:04:18 2018 us=101200   route_delay_defined = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   route_nopull = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   route_gateway_via_dhcp = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   allow_pull_fqdn = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   management_addr = '127.0.0.1'
Sat Jan 06 11:04:18 2018 us=101200   management_port = '25340'
Sat Jan 06 11:04:18 2018 us=101200   management_user_pass = 'stdin'
Sat Jan 06 11:04:18 2018 us=101200   management_log_history_cache = 250
Sat Jan 06 11:04:18 2018 us=101200   management_echo_buffer_size = 100
Sat Jan 06 11:04:18 2018 us=101200   management_write_peer_info_file = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   management_client_user = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   management_client_group = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   management_flags = 6
Sat Jan 06 11:04:18 2018 us=101200   shared_secret_file = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   key_direction = 0
Sat Jan 06 11:04:18 2018 us=101200   ciphername = 'AES-256-CBC'
Sat Jan 06 11:04:18 2018 us=101200   ncp_enabled = ENABLED
Sat Jan 06 11:04:18 2018 us=101200   ncp_ciphers = 'AES-256-GCM:AES-128-GCM'
Sat Jan 06 11:04:18 2018 us=101200   authname = 'SHA1'
Sat Jan 06 11:04:18 2018 us=101200   prng_hash = 'SHA1'
Sat Jan 06 11:04:18 2018 us=101200   prng_nonce_secret_len = 16
Sat Jan 06 11:04:18 2018 us=101200   keysize = 0
Sat Jan 06 11:04:18 2018 us=101200   engine = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   replay = ENABLED
Sat Jan 06 11:04:18 2018 us=101200   mute_replay_warnings = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   replay_window = 64
Sat Jan 06 11:04:18 2018 us=101200   replay_time = 15
Sat Jan 06 11:04:18 2018 us=101200   packet_id_file = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   use_iv = ENABLED
Sat Jan 06 11:04:18 2018 us=101200   test_crypto = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   tls_server = ENABLED
Sat Jan 06 11:04:18 2018 us=101200   tls_client = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   key_method = 2
Sat Jan 06 11:04:18 2018 us=101200   ca_file = 'C:\Program Files\OpenVPN\config\ca.crt'
Sat Jan 06 11:04:18 2018 us=101200   ca_path = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   dh_file = 'C:\Program Files\OpenVPN\config\dh4096.pem'
Sat Jan 06 11:04:18 2018 us=101200   cert_file = 'C:\Program Files\OpenVPN\config\server.crt'
Sat Jan 06 11:04:18 2018 us=101200   extra_certs_file = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   priv_key_file = 'C:\Program Files\OpenVPN\config\server.key'
Sat Jan 06 11:04:18 2018 us=101200   pkcs12_file = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   cryptoapi_cert = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   cipher_list = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   tls_verify = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   tls_export_cert = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   verify_x509_type = 0
Sat Jan 06 11:04:18 2018 us=101200   verify_x509_name = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   crl_file = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   ns_cert_type = 0
Sat Jan 06 11:04:18 2018 us=101200   remote_cert_ku[i] = 0
Sat Jan 06 11:04:18 2018 us=101200   remote_cert_ku[i] = 0
Sat Jan 06 11:04:18 2018 us=101200   remote_cert_ku[i] = 0
Sat Jan 06 11:04:18 2018 us=101200   remote_cert_ku[i] = 0
Sat Jan 06 11:04:18 2018 us=101200   remote_cert_ku[i] = 0
Sat Jan 06 11:04:18 2018 us=101200   remote_cert_ku[i] = 0
Sat Jan 06 11:04:18 2018 us=101200   remote_cert_ku[i] = 0
Sat Jan 06 11:04:18 2018 us=101200   remote_cert_ku[i] = 0
Sat Jan 06 11:04:18 2018 us=101200   remote_cert_ku[i] = 0
Sat Jan 06 11:04:18 2018 us=101200   remote_cert_ku[i] = 0
Sat Jan 06 11:04:18 2018 us=101200   remote_cert_ku[i] = 0
Sat Jan 06 11:04:18 2018 us=101200   remote_cert_ku[i] = 0
Sat Jan 06 11:04:18 2018 us=101200   remote_cert_ku[i] = 0
Sat Jan 06 11:04:18 2018 us=101200   remote_cert_ku[i] = 0
Sat Jan 06 11:04:18 2018 us=101200   remote_cert_ku[i] = 0
Sat Jan 06 11:04:18 2018 us=101200   remote_cert_ku[i] = 0
Sat Jan 06 11:04:18 2018 us=101200   remote_cert_eku = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   ssl_flags = 0
Sat Jan 06 11:04:18 2018 us=101200   tls_timeout = 2
Sat Jan 06 11:04:18 2018 us=101200   renegotiate_bytes = -1
Sat Jan 06 11:04:18 2018 us=101200   renegotiate_packets = 0
Sat Jan 06 11:04:18 2018 us=101200   renegotiate_seconds = 3600
Sat Jan 06 11:04:18 2018 us=101200   handshake_window = 60
Sat Jan 06 11:04:18 2018 us=101200   transition_window = 3600
Sat Jan 06 11:04:18 2018 us=101200   single_session = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   push_peer_info = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   tls_exit = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   tls_auth_file = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   tls_crypt_file = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_protected_authentication = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_protected_authentication = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_protected_authentication = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_protected_authentication = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_protected_authentication = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_protected_authentication = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_protected_authentication = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_protected_authentication = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_protected_authentication = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_protected_authentication = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_protected_authentication = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_protected_authentication = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_protected_authentication = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_protected_authentication = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_protected_authentication = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_protected_authentication = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_private_mode = 00000000
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_private_mode = 00000000
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_private_mode = 00000000
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_private_mode = 00000000
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_private_mode = 00000000
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_private_mode = 00000000
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_private_mode = 00000000
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_private_mode = 00000000
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_private_mode = 00000000
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_private_mode = 00000000
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_private_mode = 00000000
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_private_mode = 00000000
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_private_mode = 00000000
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_private_mode = 00000000
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_private_mode = 00000000
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_private_mode = 00000000
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_cert_private = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_cert_private = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_cert_private = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_cert_private = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_cert_private = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_cert_private = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_cert_private = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_cert_private = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_cert_private = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_cert_private = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_cert_private = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_cert_private = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_cert_private = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_cert_private = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_cert_private = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_cert_private = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_pin_cache_period = -1
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_id = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   pkcs11_id_management = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   server_network = 0.0.0.0
Sat Jan 06 11:04:18 2018 us=101200   server_netmask = 0.0.0.0
Sat Jan 06 11:04:18 2018 us=101200   server_network_ipv6 = ::
Sat Jan 06 11:04:18 2018 us=101200   server_netbits_ipv6 = 0
Sat Jan 06 11:04:18 2018 us=101200   server_bridge_ip = 192.168.1.227
Sat Jan 06 11:04:18 2018 us=101200   server_bridge_netmask = 255.255.0.0
Sat Jan 06 11:04:18 2018 us=101200   server_bridge_pool_start = 192.168.3.1
Sat Jan 06 11:04:18 2018 us=101200   server_bridge_pool_end = 192.168.3.254
Sat Jan 06 11:04:18 2018 us=101200   push_entry = 'route-gateway 192.168.1.227'
Sat Jan 06 11:04:18 2018 us=101200   push_entry = 'ping 10'
Sat Jan 06 11:04:18 2018 us=101200   push_entry = 'ping-restart 120'
Sat Jan 06 11:04:18 2018 us=101200   ifconfig_pool_defined = ENABLED
Sat Jan 06 11:04:18 2018 us=101200   ifconfig_pool_start = 192.168.3.1
Sat Jan 06 11:04:18 2018 us=101200   ifconfig_pool_end = 192.168.3.254
Sat Jan 06 11:04:18 2018 us=101200   ifconfig_pool_netmask = 255.255.0.0
Sat Jan 06 11:04:18 2018 us=101200   ifconfig_pool_persist_filename = 'ipp.txt'
Sat Jan 06 11:04:18 2018 us=101200   ifconfig_pool_persist_refresh_freq = 600
Sat Jan 06 11:04:18 2018 us=101200   ifconfig_ipv6_pool_defined = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   ifconfig_ipv6_pool_base = ::
Sat Jan 06 11:04:18 2018 us=101200   ifconfig_ipv6_pool_netbits = 0
Sat Jan 06 11:04:18 2018 us=101200   n_bcast_buf = 256
Sat Jan 06 11:04:18 2018 us=101200   tcp_queue_limit = 64
Sat Jan 06 11:04:18 2018 us=101200   real_hash_size = 256
Sat Jan 06 11:04:18 2018 us=101200   virtual_hash_size = 256
Sat Jan 06 11:04:18 2018 us=101200   client_connect_script = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   learn_address_script = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   client_disconnect_script = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   client_config_dir = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   ccd_exclusive = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   tmp_dir = 'C:\Users\BRANTE~1\AppData\Local\Temp\'
Sat Jan 06 11:04:18 2018 us=101200   push_ifconfig_defined = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   push_ifconfig_local = 0.0.0.0
Sat Jan 06 11:04:18 2018 us=101200   push_ifconfig_remote_netmask = 0.0.0.0
Sat Jan 06 11:04:18 2018 us=101200   push_ifconfig_ipv6_defined = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   push_ifconfig_ipv6_local = ::/0
Sat Jan 06 11:04:18 2018 us=101200   push_ifconfig_ipv6_remote = ::
Sat Jan 06 11:04:18 2018 us=101200   enable_c2c = ENABLED
Sat Jan 06 11:04:18 2018 us=101200   duplicate_cn = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   cf_max = 0
Sat Jan 06 11:04:18 2018 us=101200   cf_per = 0
Sat Jan 06 11:04:18 2018 us=101200   max_clients = 1024
Sat Jan 06 11:04:18 2018 us=101200   max_routes_per_client = 256
Sat Jan 06 11:04:18 2018 us=101200   auth_user_pass_verify_script = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   auth_user_pass_verify_script_via_file = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   auth_token_generate = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   auth_token_lifetime = 0
Sat Jan 06 11:04:18 2018 us=101200   client = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   pull = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   auth_user_pass_file = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   show_net_up = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   route_method = 3
Sat Jan 06 11:04:18 2018 us=101200   block_outside_dns = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   ip_win32_defined = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   ip_win32_type = 3
Sat Jan 06 11:04:18 2018 us=101200   dhcp_masq_offset = 0
Sat Jan 06 11:04:18 2018 us=101200   dhcp_lease_time = 31536000
Sat Jan 06 11:04:18 2018 us=101200   tap_sleep = 10
Sat Jan 06 11:04:18 2018 us=101200   dhcp_options = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   dhcp_renew = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   dhcp_pre_release = DISABLED
Sat Jan 06 11:04:18 2018 us=101200   domain = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   netbios_scope = '[UNDEF]'
Sat Jan 06 11:04:18 2018 us=101200   netbios_node_type = 0
Sat Jan 06 11:04:18 2018 us=101200   disable_nbt = DISABLED
Sat Jan 06 11:04:18 2018 us=101200 OpenVPN 2.4.4 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Sep 26 2017
Sat Jan 06 11:04:18 2018 us=101200 Windows version 6.2 (Windows 8 or greater) 64bit
Sat Jan 06 11:04:18 2018 us=101200 library versions: OpenSSL 1.0.2l  25 May 2017, LZO 2.10
Enter Management Password:
Sat Jan 06 11:04:18 2018 us=101200 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Sat Jan 06 11:04:18 2018 us=101200 Need hold release from management interface, waiting...
Sat Jan 06 11:04:18 2018 us=523173 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Sat Jan 06 11:04:18 2018 us=632544 MANAGEMENT: CMD 'state on'
Sat Jan 06 11:04:18 2018 us=663744 MANAGEMENT: CMD 'log all on'
Sat Jan 06 11:04:21 2018 us=804606 MANAGEMENT: CMD 'echo all on'
Sat Jan 06 11:04:21 2018 us=835859 MANAGEMENT: CMD 'hold off'
Sat Jan 06 11:04:21 2018 us=867111 MANAGEMENT: CMD 'hold release'
Sat Jan 06 11:04:21 2018 us=867111 NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to
Sat Jan 06 11:04:21 2018 us=867111 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Sat Jan 06 11:04:22 2018 us=70303 Diffie-Hellman initialized with 4096 bit key
Sat Jan 06 11:04:22 2018 us=70303 TLS-Auth MTU parms [ L:1653 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Sat Jan 06 11:04:22 2018 us=70303 interactive service msg_channel=708
Sat Jan 06 11:04:22 2018 us=70303 open_tun
Sat Jan 06 11:04:22 2018 us=70303 TAP-WIN32 device [Ethernet_7] opened: \\.\Global\{8F042EC3-C372-4CBE-B6DE-0F7F2CF6C408}.tap
Sat Jan 06 11:04:22 2018 us=70303 TAP-Windows Driver Version 9.21 
Sat Jan 06 11:04:22 2018 us=70303 TAP-Windows MTU=1500
Sat Jan 06 11:04:22 2018 us=70303 Sleeping for 10 seconds...
Sat Jan 06 11:04:32 2018 us=71080 NOTE: FlushIpNetTable failed on interface [20] {8F042EC3-C372-4CBE-B6DE-0F7F2CF6C408} (status=1168) : Element not found.  
Sat Jan 06 11:04:32 2018 us=71080 Data Channel MTU parms [ L:1653 D:1450 EF:121 EB:411 ET:32 EL:3 ]
Sat Jan 06 11:04:32 2018 us=71080 Could not determine IPv4/IPv6 protocol. Using AF_INET6
Sat Jan 06 11:04:32 2018 us=71080 Socket Buffers: R=[65536->65536] S=[65536->65536]
Sat Jan 06 11:04:32 2018 us=71080 setsockopt(IPV6_V6ONLY=0)
Sat Jan 06 11:04:32 2018 us=71080 UDPv6 link local (bound): [AF_INET6][undef]:1194
Sat Jan 06 11:04:32 2018 us=71080 UDPv6 link remote: [AF_UNSPEC]
Sat Jan 06 11:04:32 2018 us=71080 MULTI: multi_init called, r=256 v=256
Sat Jan 06 11:04:32 2018 us=71080 IFCONFIG POOL: base=192.168.3.1 size=254, ipv6=0
Sat Jan 06 11:04:32 2018 us=71080 IFCONFIG POOL LIST
Sat Jan 06 11:04:32 2018 us=71080 Initialization Sequence Completed
Sat Jan 06 11:04:32 2018 us=71080 MANAGEMENT: >STATE:1515254672,CONNECTED,SUCCESS,,,,,
Sat Jan 06 11:05:12 2018 us=902307 MULTI: multi_create_instance called
Sat Jan 06 11:05:12 2018 us=902307 192.168.1.1 Re-using SSL/TLS context
Sat Jan 06 11:05:12 2018 us=902307 192.168.1.1 Control Channel MTU parms [ L:1653 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Sat Jan 06 11:05:12 2018 us=902307 192.168.1.1 Data Channel MTU parms [ L:1653 D:1450 EF:121 EB:411 ET:32 EL:3 ]
Sat Jan 06 11:05:12 2018 us=902307 192.168.1.1 Local Options String (VER=V4): 'V4,dev-type tap,link-mtu 1589,tun-mtu 1532,proto UDPv4,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-server'
Sat Jan 06 11:05:12 2018 us=902307 192.168.1.1 Expected Remote Options String (VER=V4): 'V4,dev-type tap,link-mtu 1589,tun-mtu 1532,proto UDPv4,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-client'
Sat Jan 06 11:05:12 2018 us=902307 192.168.1.1 TLS: Initial packet from [AF_INET6]::ffff:192.168.1.1:65260, sid=6d3b6096 978372b7
Sat Jan 06 11:06:12 2018 us=375576 MULTI: multi_create_instance called
Sat Jan 06 11:06:12 2018 us=375576 192.168.1.1 Re-using SSL/TLS context
Sat Jan 06 11:06:12 2018 us=375576 192.168.1.1 Control Channel MTU parms [ L:1653 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Sat Jan 06 11:06:12 2018 us=375576 192.168.1.1 Data Channel MTU parms [ L:1653 D:1450 EF:121 EB:411 ET:32 EL:3 ]
Sat Jan 06 11:06:12 2018 us=375576 192.168.1.1 Local Options String (VER=V4): 'V4,dev-type tap,link-mtu 1589,tun-mtu 1532,proto UDPv4,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-server'
Sat Jan 06 11:06:12 2018 us=375576 192.168.1.1 Expected Remote Options String (VER=V4): 'V4,dev-type tap,link-mtu 1589,tun-mtu 1532,proto UDPv4,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-client'
Sat Jan 06 11:06:12 2018 us=375576 192.168.1.1 TLS: Initial packet from [AF_INET6]::ffff:192.168.1.1:49292, sid=954f86f6 6aa19d64
Sat Jan 06 11:06:12 2018 us=672475 192.168.1.1 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sat Jan 06 11:06:12 2018 us=672475 192.168.1.1 TLS Error: TLS handshake failed
Sat Jan 06 11:06:12 2018 us=672475 192.168.1.1 SIGUSR1[soft,tls-error] received, client-instance restarting
Sat Jan 06 11:07:12 2018 us=536467 MULTI: multi_create_instance called
Sat Jan 06 11:07:12 2018 us=536467 192.168.1.1 Re-using SSL/TLS context
Sat Jan 06 11:07:12 2018 us=536467 192.168.1.1 Control Channel MTU parms [ L:1653 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Sat Jan 06 11:07:12 2018 us=536467 192.168.1.1 Data Channel MTU parms [ L:1653 D:1450 EF:121 EB:411 ET:32 EL:3 ]
Sat Jan 06 11:07:12 2018 us=536467 192.168.1.1 Local Options String (VER=V4): 'V4,dev-type tap,link-mtu 1589,tun-mtu 1532,proto UDPv4,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-server'
Sat Jan 06 11:07:12 2018 us=536467 192.168.1.1 Expected Remote Options String (VER=V4): 'V4,dev-type tap,link-mtu 1589,tun-mtu 1532,proto UDPv4,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-client'
Sat Jan 06 11:07:12 2018 us=536467 192.168.1.1 TLS: Initial packet from [AF_INET6]::ffff:192.168.1.1:57462, sid=53b26929 1c6575c7
Sat Jan 06 11:07:12 2018 us=583332 192.168.1.1 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sat Jan 06 11:07:12 2018 us=583332 192.168.1.1 TLS Error: TLS handshake failed
Sat Jan 06 11:07:12 2018 us=583332 192.168.1.1 SIGUSR1[soft,tls-error] received, client-instance restarting
Sat Jan 06 11:07:29 2018 us=365918 SENT CONTROL [UNDEF]: 'RESTART' (status=1)
Sat Jan 06 11:07:29 2018 us=365918 TCP/UDP: Closing socket
Sat Jan 06 11:07:29 2018 us=365918 Closing TUN/TAP interface
Sat Jan 06 11:07:29 2018 us=381489 SIGTERM[hard,] received, process exiting
Sat Jan 06 11:07:29 2018 us=381489 MANAGEMENT: >STATE:1515254849,EXITING,SIGTERM,,,,,

Client
##############################################
# Sample client-side OpenVPN 2.0 config file #
# for connecting to multi-client server. #
# #
# This configuration can be used by multiple #
# clients, however each client should have #
# its own cert and key files. #
# #
# On Windows, you might want to rename this #
# file so it has a .ovpn extension #
##############################################

# Specify that we are a client and that we
# will be pulling certain config file directives
# from the server.
client

# Use the same setting as you are using on
# the server.
# On most systems, the VPN will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
;dev tap
dev tun

# Windows needs the TAP-Win32 adapter name
# from the Network Connections panel
# if you have more than one. On XP SP2,
# you may need to disable the firewall
# for the TAP adapter.
;dev-node MyTap

# Are we connecting to a TCP or
# UDP server? Use the same setting as
# on the server.
;proto tcp
proto udp

# The hostname/IP and port of the server.
# You can have multiple remote entries
# to load balance between the servers.
remote [Public IP] 1194

# Choose a random host from the remote
# list for load-balancing. Otherwise
# try hosts in the order specified.
;remote-random

# Keep trying indefinitely to resolve the
# host name of the OpenVPN server. Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
resolv-retry infinite

# Most clients don't need to bind to
# a specific local port number.
nobind

# Downgrade privileges after initialization (non-Windows only)
;user nobody
;group nobody

# Try to preserve some state across restarts.
persist-key
persist-tun

# If you are connecting through an
# HTTP proxy to reach the actual OpenVPN
# server, put the proxy server/IP and
# port number here. See the man page
# if your proxy server requires
# authentication.
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]

# Wireless networks often produce a lot
# of duplicate packets. Set this flag
# to silence duplicate packet warnings.
;mute-replay-warnings

# SSL/TLS parms.
# See the server config file for more
# description. It's best to use
# a separate .crt/.key file pair
# for each client. A single ca
# file can be used for all clients.
<ca>
-----BEGIN CERTIFICATE-----
Redacted
-----END CERTIFICATE-----
</ca>
<cert>
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 5 (0x5)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=US, ST=NC, L=High Point, O=Redacted, OU=Redacted, CN=BT-MonCon-SRV/name=Certificate Authority/emailAddress=Redacted
Validity
Not Before: Jan 5 04:57:55 2018 GMT
Not After : Jan 3 04:57:55 2028 GMT
Subject: C=US, ST=NC, L=High Point, O=Redacted, OU=Redacted, CN=BransonMac/name=BransonMac/emailAddress=Redacted
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (4096 bit)
Modulus:
Redacted
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
Easy-RSA Generated Certificate
X509v3 Subject Key Identifier:
Redacted
X509v3 Authority Key Identifier:
keyid:Redacted
DirName:/C=US/ST=NC/L=High Point/O=Redacted/OU=Redacted/CN=BT-MonCon-SRV/name=Certificate Authority/emailAddress=Redacted
serial:Redacted

X509v3 Extended Key Usage:
TLS Web Client Authentication
X509v3 Key Usage:
Digital Signature
Signature Algorithm: sha256WithRSAEncryption
Redacted

-----BEGIN CERTIFICATE-----
Redacted
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
Redacted
-----END PRIVATE KEY-----
</key>

# Verify server certificate by checking that the
# certicate has the correct key usage set.
# This is an important precaution to protect against
# a potential attack discussed here:
# http://openvpn.net/howto.html#mitm
#
# To use this feature, you will need to generate
# your server certificates with the keyUsage set to
# digitalSignature, keyEncipherment
# and the extendedKeyUsage to
# serverAuth
# EasyRSA can do this for you.
;remote-cert-tls BT-MonCon-SRV

# If a tls-auth key is used on the server
# then every client must also have the key.
;tls-auth ta.key 1

# Select a cryptographic cipher.
# If the cipher option is used on the server
# then you must also specify it here.
# Note that v2.4 client/server will automatically
# negotiate AES-256-GCM in TLS mode.
# See also the ncp-cipher option in the manpage
cipher AES-256-CBC

# Enable compression on the VPN link.
# Don't enable this unless it is also
# enabled in the server config file.
#comp-lzo

# Set log file verbosity.
verb 4

# Silence repeating messages
;mute 20

Client Log

Code: Select all

*Tunnelblick: OS X 10.13.2; Tunnelblick 3.7.4b (build 4921)
2018-01-06 11:05:12 *Tunnelblick: Attempting connection with BransonMac using shadow copy; Set nameserver = 769; monitoring connection
2018-01-06 11:05:12 *Tunnelblick: openvpnstart start BransonMac.tblk 1337 769 0 1 0 1065264 -ptADGNWradsgnw 2.4.4-openssl-1.0.2n
2018-01-06 11:05:12 *Tunnelblick: openvpnstart log:
     OpenVPN started successfully. Command used to start OpenVPN (one argument per displayed line):
     
          /Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.4.4-openssl-1.0.2n/openvpn
          --daemon
          --log
          /Library/Application Support/Tunnelblick/Logs/-SUsers-Sbransonbuchanan-SLibrary-SApplication Support-STunnelblick-SConfigurations-SBransonMac.tblk-SContents-SResources-Sconfig.ovpn.769_0_1_0_1065264.1337.openvpn.log
          --cd
          /Library/Application Support/Tunnelblick/Users/bransonbuchanan/BransonMac.tblk/Contents/Resources
          --setenv
          IV_GUI_VER
          "net.tunnelblick.tunnelblick 4921 3.7.4b (build 4921)"
          --verb
          3
          --config
          /Library/Application Support/Tunnelblick/Users/bransonbuchanan/BransonMac.tblk/Contents/Resources/config.ovpn
          --verb
          3
          --cd
          /Library/Application Support/Tunnelblick/Users/bransonbuchanan/BransonMac.tblk/Contents/Resources
          --management
          127.0.0.1
          1337
          --management-query-passwords
          --management-hold
          --script-security
          2
          --up
          /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw
          --down
          /Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw

2018-01-06 11:05:12 *Tunnelblick: Established communication with OpenVPN
2018-01-06 11:05:12 OpenVPN 2.4.4 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [MH/RECVDA] [AEAD] built on Dec  7 2017
2018-01-06 11:05:12 library versions: OpenSSL 1.0.2n  7 Dec 2017, LZO 2.10
2018-01-06 11:05:12 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:1337
2018-01-06 11:05:12 Need hold release from management interface, waiting...
2018-01-06 11:05:12 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:1337
2018-01-06 11:05:12 MANAGEMENT: CMD 'pid'
2018-01-06 11:05:12 MANAGEMENT: CMD 'state on'
2018-01-06 11:05:12 MANAGEMENT: CMD 'state'
2018-01-06 11:05:12 MANAGEMENT: CMD 'bytecount 1'
2018-01-06 11:05:12 MANAGEMENT: CMD 'hold release'
2018-01-06 11:05:12 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
2018-01-06 11:05:12 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2018-01-06 11:05:12 MANAGEMENT: >STATE:1515254712,RESOLVE,,,,,,
2018-01-06 11:05:12 TCP/UDP: Preserving recently used remote address: [AF_INET][Public IP]:1194
2018-01-06 11:05:12 Socket Buffers: R=[196724->196724] S=[9216->9216]
2018-01-06 11:05:12 UDP link local: (not bound)
2018-01-06 11:05:12 UDP link remote: [AF_INET][Public IP]:1194
2018-01-06 11:05:12 MANAGEMENT: >STATE:1515254712,WAIT,,,,,,
2018-01-06 11:05:12 *Tunnelblick: openvpnstart starting OpenVPN
2018-01-06 11:06:12 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
2018-01-06 11:06:12 TLS Error: TLS handshake failed
2018-01-06 11:06:12 SIGUSR1[soft,tls-error] received, process restarting
2018-01-06 11:06:12 MANAGEMENT: >STATE:1515254772,RECONNECTING,tls-error,,,,,
2018-01-06 11:06:12 MANAGEMENT: CMD 'hold release'
2018-01-06 11:06:12 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
2018-01-06 11:06:12 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2018-01-06 11:06:12 MANAGEMENT: >STATE:1515254772,RESOLVE,,,,,,
2018-01-06 11:06:12 TCP/UDP: Preserving recently used remote address: [AF_INET][Public IP]:1194
2018-01-06 11:06:12 Socket Buffers: R=[196724->196724] S=[9216->9216]
2018-01-06 11:06:12 UDP link local: (not bound)
2018-01-06 11:06:12 UDP link remote: [AF_INET][Public IP]:1194
2018-01-06 11:06:12 MANAGEMENT: >STATE:1515254772,WAIT,,,,,,
2018-01-06 11:07:12 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
2018-01-06 11:07:12 TLS Error: TLS handshake failed
2018-01-06 11:07:12 SIGUSR1[soft,tls-error] received, process restarting
2018-01-06 11:07:12 MANAGEMENT: >STATE:1515254832,RECONNECTING,tls-error,,,,,
2018-01-06 11:07:12 MANAGEMENT: CMD 'hold release'
2018-01-06 11:07:12 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
2018-01-06 11:07:12 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2018-01-06 11:07:12 MANAGEMENT: >STATE:1515254832,RESOLVE,,,,,,
2018-01-06 11:07:12 TCP/UDP: Preserving recently used remote address: [AF_INET][Public IP]:1194
2018-01-06 11:07:12 Socket Buffers: R=[196724->196724] S=[9216->9216]
2018-01-06 11:07:12 UDP link local: (not bound)
2018-01-06 11:07:12 UDP link remote: [AF_INET][Public IP]:1194
2018-01-06 11:07:12 MANAGEMENT: >STATE:1515254832,WAIT,,,,,,
2018-01-06 11:07:16 *Tunnelblick: Disconnecting; VPN Details… window disconnect button pressed
2018-01-06 11:07:16 *Tunnelblick: No 'pre-disconnect.sh' script to execute
2018-01-06 11:07:16 *Tunnelblick: Disconnecting using 'kill'
2018-01-06 11:07:16 event_wait : Interrupted system call (code=4)
2018-01-06 11:07:16 SIGTERM[hard,] received, process exiting
2018-01-06 11:07:16 MANAGEMENT: >STATE:1515254836,EXITING,SIGTERM,,,,,
2018-01-06 11:07:17 *Tunnelblick: No 'post-disconnect.sh' script to execute
2018-01-06 11:07:17 *Tunnelblick: Expected disconnection occurred.
Top
TinCanTech
OpenVPN Protagonist
Posts: 11139
Joined: Fri Jun 03, 2016 1:17 pm

Re: TLS handshake failed

Post by TinCanTech » Sat Jan 06, 2018 5:24 pm

You appear to be using IPv6:
Bransonb3 wrote: ↑
Sat Jan 06, 2018 4:57 pm
 Sat Jan 06 11:05:12 2018 us=902307 192.168.1.1 TLS: Initial packet from [AF_INET6]::ffff:192.168.1.1:65260, sid=6d3b6096 978372b7
and bridging an IPv4 network:
Bransonb3 wrote: ↑
Sat Jan 06, 2018 4:57 pm
 server-bridge 192.168.1.227 255.255.0.0 192.168.3.1 192.168.3.254
So .. sort out which protocol you are using.
Top
Bransonb3
OpenVpn Newbie
Posts: 4
Joined: Sat Jan 06, 2018 3:38 pm

Re: TLS handshake failed

Post by Bransonb3 » Sat Jan 06, 2018 11:51 pm

I am trying to use IPv4. I read this article https://community.openvpn.net/openvpn/wiki/IPv6 and don't have any of the settings to use IPv6 in my configs. I disabled v6 on the bridge in windows and I'm still getting the INET6 in the sever log but the client log says it is using UDPv4.
Thanks for the help.
Top
TinCanTech
OpenVPN Protagonist
Posts: 11139
Joined: Fri Jun 03, 2016 1:17 pm

Re: TLS handshake failed

Post by TinCanTech » Sun Jan 07, 2018 1:28 pm

Your server log shows something strange:
Bransonb3 wrote: ↑
Sat Jan 06, 2018 4:57 pm
 Sat Jan 06 11:04:32 2018 us=71080 Could not determine IPv4/IPv6 protocol. Using AF_INET6
Due to your network setup (probably) openvpn is choosing IPv6.

The simple way to force IPv4 is like so in both your configs:

Code: Select all

proto udp4
Try that ..
Top
Bransonb3
OpenVpn Newbie
Posts: 4
Joined: Sat Jan 06, 2018 3:38 pm

Re: TLS handshake failed

Post by Bransonb3 » Sun Jan 07, 2018 2:34 pm

I changed the proto to UDPv4 on both the client and sever config, but I am still getting the TLS errors.


Server Log

Code: Select all

Sun Jan 07 09:27:13 2018   pkcs11_private_mode = 00000000
Sun Jan 07 09:27:13 2018   pkcs11_private_mode = 00000000
Sun Jan 07 09:27:13 2018   pkcs11_private_mode = 00000000
Sun Jan 07 09:27:13 2018   pkcs11_private_mode = 00000000
Sun Jan 07 09:27:13 2018   pkcs11_private_mode = 00000000
Sun Jan 07 09:27:13 2018   pkcs11_private_mode = 00000000
Sun Jan 07 09:27:13 2018   pkcs11_private_mode = 00000000
Sun Jan 07 09:27:13 2018   pkcs11_private_mode = 00000000
Sun Jan 07 09:27:13 2018   pkcs11_private_mode = 00000000
Sun Jan 07 09:27:13 2018   pkcs11_private_mode = 00000000
Sun Jan 07 09:27:13 2018   pkcs11_private_mode = 00000000
Sun Jan 07 09:27:13 2018   pkcs11_private_mode = 00000000
Sun Jan 07 09:27:13 2018   pkcs11_private_mode = 00000000
Sun Jan 07 09:27:13 2018   pkcs11_private_mode = 00000000
Sun Jan 07 09:27:13 2018   pkcs11_cert_private = DISABLED
Sun Jan 07 09:27:13 2018   pkcs11_cert_private = DISABLED
Sun Jan 07 09:27:13 2018   pkcs11_cert_private = DISABLED
Sun Jan 07 09:27:13 2018   pkcs11_cert_private = DISABLED
Sun Jan 07 09:27:13 2018   pkcs11_cert_private = DISABLED
Sun Jan 07 09:27:13 2018   pkcs11_cert_private = DISABLED
Sun Jan 07 09:27:13 2018   pkcs11_cert_private = DISABLED
Sun Jan 07 09:27:13 2018   pkcs11_cert_private = DISABLED
Sun Jan 07 09:27:13 2018   pkcs11_cert_private = DISABLED
Sun Jan 07 09:27:13 2018   pkcs11_cert_private = DISABLED
Sun Jan 07 09:27:13 2018   pkcs11_cert_private = DISABLED
Sun Jan 07 09:27:13 2018   pkcs11_cert_private = DISABLED
Sun Jan 07 09:27:13 2018   pkcs11_cert_private = DISABLED
Sun Jan 07 09:27:13 2018   pkcs11_cert_private = DISABLED
Sun Jan 07 09:27:13 2018   pkcs11_cert_private = DISABLED
Sun Jan 07 09:27:13 2018   pkcs11_cert_private = DISABLED
Sun Jan 07 09:27:13 2018   pkcs11_pin_cache_period = -1
Sun Jan 07 09:27:13 2018   pkcs11_id = '[UNDEF]'
Sun Jan 07 09:27:13 2018   pkcs11_id_management = DISABLED
Sun Jan 07 09:27:13 2018   server_network = 0.0.0.0
Sun Jan 07 09:27:13 2018   server_netmask = 0.0.0.0
Sun Jan 07 09:27:13 2018   server_network_ipv6 = ::
Sun Jan 07 09:27:13 2018   server_netbits_ipv6 = 0
Sun Jan 07 09:27:13 2018   server_bridge_ip = 192.168.1.227
Sun Jan 07 09:27:13 2018   server_bridge_netmask = 255.255.0.0
Sun Jan 07 09:27:13 2018   server_bridge_pool_start = 192.168.3.1
Sun Jan 07 09:27:13 2018   server_bridge_pool_end = 192.168.3.254
Sun Jan 07 09:27:13 2018   push_entry = 'route-gateway 192.168.1.227'
Sun Jan 07 09:27:13 2018   push_entry = 'ping 10'
Sun Jan 07 09:27:13 2018   push_entry = 'ping-restart 120'
Sun Jan 07 09:27:13 2018   ifconfig_pool_defined = ENABLED
Sun Jan 07 09:27:13 2018   ifconfig_pool_start = 192.168.3.1
Sun Jan 07 09:27:13 2018   ifconfig_pool_end = 192.168.3.254
Sun Jan 07 09:27:13 2018   ifconfig_pool_netmask = 255.255.0.0
Sun Jan 07 09:27:13 2018   ifconfig_pool_persist_filename = 'ipp.txt'
Sun Jan 07 09:27:13 2018   ifconfig_pool_persist_refresh_freq = 600
Sun Jan 07 09:27:13 2018   ifconfig_ipv6_pool_defined = DISABLED
Sun Jan 07 09:27:13 2018   ifconfig_ipv6_pool_base = ::
Sun Jan 07 09:27:13 2018   ifconfig_ipv6_pool_netbits = 0
Sun Jan 07 09:27:13 2018   n_bcast_buf = 256
Sun Jan 07 09:27:13 2018   tcp_queue_limit = 64
Sun Jan 07 09:27:13 2018   real_hash_size = 256
Sun Jan 07 09:27:13 2018   virtual_hash_size = 256
Sun Jan 07 09:27:13 2018   client_connect_script = '[UNDEF]'
Sun Jan 07 09:27:13 2018   learn_address_script = '[UNDEF]'
Sun Jan 07 09:27:13 2018   client_disconnect_script = '[UNDEF]'
Sun Jan 07 09:27:13 2018   client_config_dir = '[UNDEF]'
Sun Jan 07 09:27:13 2018   ccd_exclusive = DISABLED
Sun Jan 07 09:27:13 2018   tmp_dir = 'C:\Users\BRANTE~1\AppData\Local\Temp\'
Sun Jan 07 09:27:13 2018   push_ifconfig_defined = DISABLED
Sun Jan 07 09:27:13 2018   push_ifconfig_local = 0.0.0.0
Sun Jan 07 09:27:13 2018   push_ifconfig_remote_netmask = 0.0.0.0
Sun Jan 07 09:27:13 2018   push_ifconfig_ipv6_defined = DISABLED
Sun Jan 07 09:27:13 2018   push_ifconfig_ipv6_local = ::/0
Sun Jan 07 09:27:13 2018   push_ifconfig_ipv6_remote = ::
Sun Jan 07 09:27:13 2018   enable_c2c = ENABLED
Sun Jan 07 09:27:13 2018   duplicate_cn = DISABLED
Sun Jan 07 09:27:13 2018   cf_max = 0
Sun Jan 07 09:27:13 2018   cf_per = 0
Sun Jan 07 09:27:13 2018   max_clients = 1024
Sun Jan 07 09:27:13 2018   max_routes_per_client = 256
Sun Jan 07 09:27:13 2018   auth_user_pass_verify_script = '[UNDEF]'
Sun Jan 07 09:27:13 2018   auth_user_pass_verify_script_via_file = DISABLED
Sun Jan 07 09:27:13 2018   auth_token_generate = DISABLED
Sun Jan 07 09:27:13 2018   auth_token_lifetime = 0
Sun Jan 07 09:27:13 2018   client = DISABLED
Sun Jan 07 09:27:13 2018   pull = DISABLED
Sun Jan 07 09:27:13 2018   auth_user_pass_file = '[UNDEF]'
Sun Jan 07 09:27:13 2018   show_net_up = DISABLED
Sun Jan 07 09:27:13 2018   route_method = 3
Sun Jan 07 09:27:13 2018   block_outside_dns = DISABLED
Sun Jan 07 09:27:13 2018   ip_win32_defined = DISABLED
Sun Jan 07 09:27:13 2018   ip_win32_type = 3
Sun Jan 07 09:27:13 2018   dhcp_masq_offset = 0
Sun Jan 07 09:27:13 2018   dhcp_lease_time = 31536000
Sun Jan 07 09:27:13 2018   tap_sleep = 10
Sun Jan 07 09:27:13 2018   dhcp_options = DISABLED
Sun Jan 07 09:27:13 2018   dhcp_renew = DISABLED
Sun Jan 07 09:27:13 2018   dhcp_pre_release = DISABLED
Sun Jan 07 09:27:13 2018   domain = '[UNDEF]'
Sun Jan 07 09:27:13 2018   netbios_scope = '[UNDEF]'
Sun Jan 07 09:27:13 2018   netbios_node_type = 0
Sun Jan 07 09:27:13 2018   disable_nbt = DISABLED
Sun Jan 07 09:27:13 2018 OpenVPN 2.4.4 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Sep 26 2017
Sun Jan 07 09:27:13 2018 Windows version 6.2 (Windows 8 or greater) 64bit
Sun Jan 07 09:27:13 2018 library versions: OpenSSL 1.0.2l  25 May 2017, LZO 2.10
Sun Jan 07 09:27:13 2018 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Sun Jan 07 09:27:13 2018 Need hold release from management interface, waiting...
Sun Jan 07 09:27:14 2018 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Sun Jan 07 09:27:14 2018 MANAGEMENT: CMD 'state on'
Sun Jan 07 09:27:14 2018 MANAGEMENT: CMD 'log all on'
Sun Jan 07 09:27:17 2018 MANAGEMENT: CMD 'echo all on'
Sun Jan 07 09:27:17 2018 MANAGEMENT: CMD 'hold off'
Sun Jan 07 09:27:17 2018 MANAGEMENT: CMD 'hold release'
Sun Jan 07 09:27:17 2018 NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to
Sun Jan 07 09:27:17 2018 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Sun Jan 07 09:27:17 2018 Diffie-Hellman initialized with 4096 bit key
Sun Jan 07 09:27:17 2018 TLS-Auth MTU parms [ L:1653 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Sun Jan 07 09:27:17 2018 interactive service msg_channel=512
Sun Jan 07 09:27:17 2018 open_tun
Sun Jan 07 09:27:17 2018 TAP-WIN32 device [Ethernet_7] opened: \\.\Global\{8F042EC3-C372-4CBE-B6DE-0F7F2CF6C408}.tap
Sun Jan 07 09:27:17 2018 TAP-Windows Driver Version 9.21 
Sun Jan 07 09:27:17 2018 TAP-Windows MTU=1500
Sun Jan 07 09:27:17 2018 Sleeping for 10 seconds...
Sun Jan 07 09:27:27 2018 NOTE: FlushIpNetTable failed on interface [21] {8F042EC3-C372-4CBE-B6DE-0F7F2CF6C408} (status=1168) : Element not found.  
Sun Jan 07 09:27:27 2018 Data Channel MTU parms [ L:1653 D:1450 EF:121 EB:411 ET:32 EL:3 ]
Sun Jan 07 09:27:27 2018 Socket Buffers: R=[65536->65536] S=[65536->65536]
Sun Jan 07 09:27:27 2018 UDPv4 link local (bound): [AF_INET][undef]:1194
Sun Jan 07 09:27:27 2018 UDPv4 link remote: [AF_UNSPEC]
Sun Jan 07 09:27:27 2018 MULTI: multi_init called, r=256 v=256
Sun Jan 07 09:27:27 2018 IFCONFIG POOL: base=192.168.3.1 size=254, ipv6=0
Sun Jan 07 09:27:27 2018 IFCONFIG POOL LIST
Sun Jan 07 09:27:27 2018 Initialization Sequence Completed
Sun Jan 07 09:27:27 2018 MANAGEMENT: >STATE:1515335247,CONNECTED,SUCCESS,,,,,
Sun Jan 07 09:27:47 2018 MULTI: multi_create_instance called
Sun Jan 07 09:27:47 2018 174.194.43.119:3726 Re-using SSL/TLS context
Sun Jan 07 09:27:47 2018 174.194.43.119:3726 Control Channel MTU parms [ L:1653 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Sun Jan 07 09:27:47 2018 174.194.43.119:3726 Data Channel MTU parms [ L:1653 D:1450 EF:121 EB:411 ET:32 EL:3 ]
Sun Jan 07 09:27:47 2018 174.194.43.119:3726 Local Options String (VER=V4): 'V4,dev-type tap,link-mtu 1589,tun-mtu 1532,proto UDPv4,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-server'
Sun Jan 07 09:27:47 2018 174.194.43.119:3726 Expected Remote Options String (VER=V4): 'V4,dev-type tap,link-mtu 1589,tun-mtu 1532,proto UDPv4,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-client'
Sun Jan 07 09:27:47 2018 174.194.43.119:3726 TLS: Initial packet from [AF_INET]174.194.43.119:3726, sid=09c10ce7 e60996f9
Sun Jan 07 09:28:47 2018 174.194.43.119:3726 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sun Jan 07 09:28:47 2018 174.194.43.119:3726 TLS Error: TLS handshake failed
Sun Jan 07 09:28:47 2018 174.194.43.119:3726 SIGUSR1[soft,tls-error] received, client-instance restarting
Sun Jan 07 09:28:47 2018 MULTI: multi_create_instance called
Sun Jan 07 09:28:47 2018 174.194.43.119:3733 Re-using SSL/TLS context
Sun Jan 07 09:28:47 2018 174.194.43.119:3733 Control Channel MTU parms [ L:1653 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Sun Jan 07 09:28:47 2018 174.194.43.119:3733 Data Channel MTU parms [ L:1653 D:1450 EF:121 EB:411 ET:32 EL:3 ]
Sun Jan 07 09:28:47 2018 174.194.43.119:3733 Local Options String (VER=V4): 'V4,dev-type tap,link-mtu 1589,tun-mtu 1532,proto UDPv4,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-server'
Sun Jan 07 09:28:47 2018 174.194.43.119:3733 Expected Remote Options String (VER=V4): 'V4,dev-type tap,link-mtu 1589,tun-mtu 1532,proto UDPv4,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-client'
Sun Jan 07 09:28:47 2018 174.194.43.119:3733 TLS: Initial packet from [AF_INET]174.194.43.119:3733, sid=0d4678da 93408c42

Client Log

Code: Select all

*Tunnelblick: OS X 10.13.2; Tunnelblick 3.7.4b (build 4921)
2018-01-07 09:27:46 *Tunnelblick: Attempting connection with BransonMac using shadow copy; Set nameserver = 769; monitoring connection
2018-01-07 09:27:46 *Tunnelblick: openvpnstart start BransonMac.tblk 1337 769 0 1 0 1065264 -ptADGNWradsgnw 2.4.4-openssl-1.0.2n
2018-01-07 09:27:46 *Tunnelblick: openvpnstart log:
     OpenVPN started successfully. Command used to start OpenVPN (one argument per displayed line):
     
          /Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.4.4-openssl-1.0.2n/openvpn
          --daemon
          --log
          /Library/Application Support/Tunnelblick/Logs/-SUsers-Sbransonbuchanan-SLibrary-SApplication Support-STunnelblick-SConfigurations-SBransonMac.tblk-SContents-SResources-Sconfig.ovpn.769_0_1_0_1065264.1337.openvpn.log
          --cd
          /Library/Application Support/Tunnelblick/Users/bransonbuchanan/BransonMac.tblk/Contents/Resources
          --setenv
          IV_GUI_VER
          "net.tunnelblick.tunnelblick 4921 3.7.4b (build 4921)"
          --verb
          3
          --config
          /Library/Application Support/Tunnelblick/Users/bransonbuchanan/BransonMac.tblk/Contents/Resources/config.ovpn
          --verb
          3
          --cd
          /Library/Application Support/Tunnelblick/Users/bransonbuchanan/BransonMac.tblk/Contents/Resources
          --management
          127.0.0.1
          1337
          --management-query-passwords
          --management-hold
          --script-security
          2
          --up
          /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw
          --down
          /Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw

2018-01-07 09:27:46 OpenVPN 2.4.4 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [MH/RECVDA] [AEAD] built on Dec  7 2017
2018-01-07 09:27:46 library versions: OpenSSL 1.0.2n  7 Dec 2017, LZO 2.10
2018-01-07 09:27:46 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:1337
2018-01-07 09:27:46 Need hold release from management interface, waiting...
2018-01-07 09:27:46 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:1337
2018-01-07 09:27:46 *Tunnelblick: openvpnstart starting OpenVPN
2018-01-07 09:27:47 *Tunnelblick: Established communication with OpenVPN
2018-01-07 09:27:47 MANAGEMENT: CMD 'pid'
2018-01-07 09:27:47 MANAGEMENT: CMD 'state on'
2018-01-07 09:27:47 MANAGEMENT: CMD 'state'
2018-01-07 09:27:47 MANAGEMENT: CMD 'bytecount 1'
2018-01-07 09:27:47 MANAGEMENT: CMD 'hold release'
2018-01-07 09:27:47 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
2018-01-07 09:27:47 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2018-01-07 09:27:47 MANAGEMENT: >STATE:1515335267,RESOLVE,,,,,,
2018-01-07 09:27:47 TCP/UDP: Preserving recently used remote address: [AF_INET][ServerIP]:1194
2018-01-07 09:27:47 Socket Buffers: R=[196724->196724] S=[9216->9216]
2018-01-07 09:27:47 UDPv4 link local: (not bound)
2018-01-07 09:27:47 UDPv4 link remote: [AF_INET][ServerIP]:1194
2018-01-07 09:27:47 MANAGEMENT: >STATE:1515335267,WAIT,,,,,,
2018-01-07 09:28:47 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
2018-01-07 09:28:47 TLS Error: TLS handshake failed
2018-01-07 09:28:47 SIGUSR1[soft,tls-error] received, process restarting
2018-01-07 09:28:47 MANAGEMENT: >STATE:1515335327,RECONNECTING,tls-error,,,,,
2018-01-07 09:28:47 MANAGEMENT: CMD 'hold release'
2018-01-07 09:28:47 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
2018-01-07 09:28:47 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2018-01-07 09:28:47 MANAGEMENT: >STATE:1515335327,RESOLVE,,,,,,
2018-01-07 09:28:47 TCP/UDP: Preserving recently used remote address: [AF_INET][ServerIP]:1194
2018-01-07 09:28:47 Socket Buffers: R=[196724->196724] S=[9216->9216]
2018-01-07 09:28:47 UDPv4 link local: (not bound)
2018-01-07 09:28:47 UDPv4 link remote: [AF_INET][ServerIP]:1194
2018-01-07 09:28:47 MANAGEMENT: >STATE:1515335327,WAIT,,,,,,
2018-01-07 09:28:50 *Tunnelblick: Disconnecting; VPN Details… window disconnect button pressed
2018-01-07 09:28:51 *Tunnelblick: No 'pre-disconnect.sh' script to execute
2018-01-07 09:28:51 *Tunnelblick: Disconnecting using 'kill'
2018-01-07 09:28:51 event_wait : Interrupted system call (code=4)
2018-01-07 09:28:51 SIGTERM[hard,] received, process exiting
2018-01-07 09:28:51 MANAGEMENT: >STATE:1515335331,EXITING,SIGTERM,,,,,
2018-01-07 09:28:51 *Tunnelblick: No 'post-disconnect.sh' script to execute
2018-01-07 09:28:51 *Tunnelblick: Expected disconnection occurred.
Top
TinCanTech
OpenVPN Protagonist
Posts: 11139
Joined: Fri Jun 03, 2016 1:17 pm

Re: TLS handshake failed

Post by TinCanTech » Sun Jan 07, 2018 8:45 pm

The IPv6 issue appears to be gone ..

Perhaps your bridge is at fault ?
Top
Bransonb3
OpenVpn Newbie
Posts: 4
Joined: Sat Jan 06, 2018 3:38 pm

Re: TLS handshake failed

Post by Bransonb3 » Mon Jan 08, 2018 3:33 pm

I changed the server-bridge ip setup and remade the bridge and it is working now.
Thanks for your help.
Top
Post Reply

Return to “Configuration”