0

I get the following TLS errors when I try to connect to the Pi from the office:

2015-12-11 12:00:19 *Tunnelblick: openvpnstart starting OpenVPN
2015-12-11 12:00:20 OpenVPN 2.3.6 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [PKCS11] [MH] [IPv6] built on Dec  4 2015
2015-12-11 12:00:20 library versions: OpenSSL 1.0.1q 3 Dec 2015, LZO 2.08
2015-12-11 12:00:21 *Tunnelblick: Established communication with OpenVPN
2015-12-11 12:00:21 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2015-12-11 12:00:29 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2015-12-11 12:00:29 Control Channel Authentication: tls-auth using INLINE static key file
2015-12-11 12:00:29 UDPv4 link local: [undef]
2015-12-11 12:00:29 UDPv4 link remote: [AF_INET]<public IP address>:1194
2015-12-11 12:01:30 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
2015-12-11 12:01:30 TLS Error: TLS handshake failed

A static IP has been established along with the port forwarding from any source to 1194 on both UDP and TCP. But when I do a port scan, I find that 1194 is closed. Any ideas on how to resolve this?

Improve this question
2
  • 1
    You might want to explain how "a static IP has been established" and "port forwarding from any source to 1194". If this didn't involve your router, it will not work, and most home service ISPs do not allow for external static IP without a hefty fee, so leaving these details out is significant.
    – goldilocks ♦
    Dec 11 '15 at 18:47
  • @goldilocks, Thanks for clearing that up - I have no idea why it was posting like that after the paste. LOL! The static IP was established by editing the /etc/dhcpcd.conf file with the following lines on the top: inline 'interface eth0' inline 'static ip_address=192.168.1.2' inline 'static router=192.168.1.1' inline 'static domain_name_server=192.168.1.1' The port forwarding was done on the router with the settings UDP+TCP source (any) --> destination 1194 for the Pi device on 192.168.1.2. Should I be using the Static NAT in the firewall software of the router?
    – Danica Panica
    Dec 11 '15 at 23:54
1

Examine the results of portscan on the broadband address of your router. That will provide information on your router's inbound access policy settings.

Does not look like the router is configured to redirect to your local ipaddress:1194. Perhaps add this port redirection on your router and check once again. Also,port 22 is open, you could check if a simple ssh goes through. eg: ssh

Improve this answer
2
  • here is the port scan result on the home router:
    – Danica Panica
    Dec 14 '15 at 6:30
  • here is the port scan result on the home router: Port Scan has started... Port Scanning host: Open TCP Port: 22 ssh Open TCP Port: 23 telnet Open TCP Port: 80 http Open TCP Port: 234 Open TCP Port: 443 https Open TCP Port: 992 telnets Port Scan has completed… I realized that there are no UDP ports. Why is that?
    – Danica Panica
    Dec 14 '15 at 6:37
0

I know that this is an old thread but like me anyone could have the same problem. In my case i used the VPN in my windows and android all day and at the end i had to restart my PI, that's when this problem started.

After so many failed searches what worked?

=> Go to your opvn profile and comment the line tls-version-min 1.2 and in android if you use openvpn app then just go to preferences and disable Minimun TLS version.

I hope this help someone ;)

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.