0

I have tried to set up a OpenVPN on my pi, using this guide: http://readwrite.com/2014/04/10/raspberry-pi-vpn-tutorial-server-secure-web-browsing/#awesm=~oBvYD8BOiTdCQN

I cannot connect with the following error being generated:

UDP link local: (not bound)
UDP link remote: [AF_INET]xx.xxx.x.xx:1194
TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
TLS Error: TLS handshake failed
SIGUSR1[soft,tls-error] received, process restarting

Looking here (https://openvpn.net/index.php/open-source/faq/79-client/253-tls-error-tls-key-negotiation-failed-to-occur-within-60-seconds-check-your-network-connectivity.html) this is a common error which suggests problems with:

  1. Firewall
  2. Port forwarding
  3. Wrong server address
  4. Windows whitelist problems

Regarding 1: I run the following script prior to connecting, which is meant to punch a hole in the firewall (see step 12 of the guide) - this is meant to be automated but I can't find where to place it to make this happen, but that is a question for another post. For now i run this manually:

#!/bin/sh
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.1$

I execute with "&& echo OK || echo Failed" and it executes fine.

So, although I am not very well versed in this stuff, I believe the firewall issue is not the issue.

Regarding 2:
IP address for my PI is static at 192.168.0.20; port forwarding is set to 1194 (see config files below)

Regarding 3:
I have stared at this for quite a while now, but can't see the problem. Here is my server.config file:

local 192.168.0.20
dev tun proto udp
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/pi_server.crt
key /etc/openvpn/easy-rsa/keys/pi_server.key
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
server 10.8.0.0 255.255.255.0
# server and remote endpoints
ifconfig 10.8.0.1 10.8.0.2
# Add route to Client routing table for the OpenVPN Server
push "route 10.8.0.1 255.255.255.255"
# Add route to Client routing table for the OpenVPN Subnet
push "route 10.8.0.0 255.255.255.0"
# your local subnet
push "route 192.168.0.20 255.255.255.0"
# Set primary domain name server address to the SOHO Router
# If your router does not do DNS, you can use Google DNS 8.8.8.8
push "dhcp-option DNS 192.168.0.1"
# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
client-to-client duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-128-CBC
comp-lzo
user nobody
group nogroup
persist-key persist-tun
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 1

Regarding 4.
I am trying to connect from Ubuntu.

Responding to Goldilock's comment below:

Output of iptables -L POSTROUTING, after running the firewall script, gives:

iptables: No chain/target/match by that name.

Running iptables -L gives:

Chain INPUT (policy ACCEPT) target prot opt source
destination

Chain FORWARD (policy ACCEPT) target prot opt source
destination

Chain OUTPUT (policy ACCEPT) target prot opt source
destination

I am not sure what I am looking for here.

At this point I remain pretty stumped. I feel like I have looked at numerous server.config files and multiple guides, but I can't see what the problem might be.

If anyone can spot any problems that would be much appreciated.

  • Maybe you should include the output of iptables -L POSTROUTING from after you run that command. If you are running a firewall, it may not help since -A is append to the end of the rules, and ones before it take priority. – goldilocks Jan 5 '18 at 14:44
2

it seems that your problem could be the keys and not the firewall, some of the commons issues when connecting a Raspberry Pi and a VPN server is the OpenVPN version, for instance, if your server is using (2.4) and the client is using 2.3 (as I might guess due to the date of the tutorial) the keys won't be compatible, make sure both are using the latest version.

you can start by executing this:

sudo openvpn --version

if both versions are different, 2.3 vs 2.4, you will need to upgrade one or downgrade one.

now, for the server configuration, I had issues with UDP, so, maybe you can try with TCP

port 1194
proto tcp                          # we use TCP
dev tun                            # TUN kernel module enabled
ca ca.crt
cert server.crt
key server.key 
dh dh2048.pem
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"    # optional
push "dhcp-option DNS 8.8.4.4"    # optional
keepalive 10 120
tls-crypt myvpn.tlsauth           # I use tls-crypt over tls-auth
cipher AES-256-CBC
compress lz4-v2                   # opptional compression
push "compress lz4-v2"            # opptional compression
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log        # server logs location
log /var/log/openvpn.log
verb 3
remote-cert-eku "TLS Web Client Authentication"  # optional

in the above example, I'm pushing DNS from the server to the client to have access to internet besides the VPN, you can remove

push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

if you don't want it

the above should go on your server.conf file on $OPENVPN_HOME/server.conf (if you didn't change the default location it should be /etc/openvpn/server.conf)

on the client side

client
tls-client
ca /home/donhk/open/ca.crt        # server certificate
cert /home/donhk/open/pibox.crt   # client certificate
key /home/donhk/open/pibox.key    # client key
tls-crypt /home/donhk/open/myvpn.tlsauth # server auth file
proto tcp                         # we use TCP
remote X.X.X.X 1194 tcp           # server de
dev tun                           # your server must have tun or tap module enabled at kernel level
topology subnet
cipher AES-256-CBC                # this should be the same as server
log /var/log/openvpn.log          # client logs location
pull
script-security 2                # optional
up /etc/openvpn/update-resolv-conf  # optional
down /etc/openvpn/update-resolv-conf # optional

notice that I'm using

script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

it is to enable the pushed DNS from the server, those are optional if you don't want

you can write the client.conf or a client.ovpn and use it as

sudo openvpn --config client.ovpn

or manage it as part of the service, and start the client as

sudo systemctl start openvpn@client.service

before start up the client make sure that both, the server and the client are using the correct time settings (ntp module)

sudo timedatectl

if you get this

 Local time: Sun 2018-04-01 19:29:27 UTC
 Universal time: Sun 2018-04-01 19:29:27 UTC
 RTC time: n/a
 Time zone: UTC (UTC, +0000)
 NTP enabled: no       # ntp is not enabled
NTP synchronized: no
 RTC in local TZ: no
 DST active: n/a

it means that the certificates won't be able to be validated (because there is no date on the server/client and the certificates expiration date may be invalid)

to install the ntp and configure it you can use

sudo yum install -y ntp
sudo systemctl start ntpd

set your time zone

sudo timedatectl set-timezone  Your_TimeZone

once the above is set, and if your firewall is properly configured, the client should be able to talk to the server

I wrote how I accomplished it here:

Set up a media server on a Raspberry Pi and access it from anywhere

Excerpt:

[Warning] This will be a long post

Hope that helps

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.