Server is picking up my Client connection but timing out...

[JBOpenVPNJB]

I am trying to get my server up and running, here is my setup. Windows Server 2008 that is a VM and I am accessing via Remote Desktop. I have installed OpenVPN 2.2.0 and got the server up "Initialization Sequence Completed" then spams "Need IPv6 code in mroute_extract_addr_from_packet" for a bit.

I made 2 sets of client certs and keys and I copied one of the sets named "client2" to my mac, and am trying to connect through Viscosity. When I try to connect, my server receives the request for a connection "TLS: Initial packet from xx.xx.xxx.xx, sid=xxxx" showing the public IP of the client I am trying to connect with (so no firewall/port problems, right?) and then I get:

TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
TLS Error: TLS handshake failed

So I am thinking I must have a problem with either my server config files or my client config file?

I used the sample provided in the installer for both, and the only thing I changed was I added the paths for ALL my keys and certs to the server config, which I am not sure is right. It looks like this:


# Any X509 key management system can be used.
# OpenVPN can also use a PKCS #12 formatted key file
# (see "pkcs12" directive in man page).
ca "C:\\Program Files (x86)\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files (x86)\\OpenVPN\\config\\server.crt"
key "C:\\Program Files (x86)\\OpenVPN\\config\\server.key"
cert "C:\\Program Files (x86)\\OpenVPN\\config\\client2.crt"
key "C:\\Program Files (x86)\\OpenVPN\\config\\client2.key"

Is this right on the server end? Other than that, my server.ovpn is identical to the sample.

Now, my client2.ovpn is almost identical to the sample as well. With the only change being:

# The hostname/IP and port of the server.
# You can have multiple remote entries
# to load balance between the servers.
remote xxx.xx.x.xx:1194
;remote my-server-2 1194

I also, put the paths for the ca, cert and key into the proper place as well (although these can be easily selected in Viscosity).

Any idea what's causing the problem in this specific instance? Thanks for any input!

[janjust]

if the server sees

TLS: Initial packet from xx.xx.xxx.xx, sid=xxxx

and then the TLS handshake stops then the server is unable to send stuff back to the client - usually that's due to a firewall on the client or a cheapo router that is not forwarding UDP router correctly. switching to

Code: Select all

proto tcp

might help in this case.