I have 2 OpenVZ Ubuntu servers hosted with a vps vendor, both with an OpenVPN link back to the office network, along with several transient laptops/android phones using the vpn with all working perfectly for months..
The server runs on standard udp port 1194, and uses a routed tun connection. Both of the vps are configured identically for OpenVPN, with only "server1" recently starting to constantly time out during handshake to the vpn server. "server2" has had no problems, and connects normally, plus no problems with the misc laptops and android devices. The server uses the "easy-rsa" PKI scheme, with a self-signed ca and a cert/key for each host that connects.
I've tried regenerating certs/keys for all of the systems, with no effect, and verified connectivity between the host and vpn server. Some googling led me to a forum thread that warns when issues like this happen, on an OpenVZ vps, to check the tun interface. I had the vps vendor check that, and they report that the tun interface is working fine..
A syslog snip of the error shown on the server.. (The obfuscated ip address is the correct ip address for the client vps..)
Sep 6 14:24:56 svnetgw daemon.notice openvpn: xx.xx.xxx.xxx:45629 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ] Sep 6 14:24:56 svnetgw daemon.notice openvpn: xx.xx.xxx.xxx:45629 TLS: Initial packet from xx.xx.xxx.xxx:45629, sid=5dfe1f0d 3c07de86 Sep 6 14:25:56 svnetgw daemon.err openvpn: xx.xx.xxx.xxx:45629 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) Sep 6 14:25:56 svnetgw daemon.err openvpn: xx.xx.xxx.xxx:45629 TLS Error: TLS handshake failed Sep 6 14:25:56 svnetgw daemon.notice openvpn: xx.xx.xxx.xxx:45629 SIGUSR1[soft,tls-error] received, client-instance restarting
The error makes me think theres a problem with the network path between the vps and server, but I can ssh TO the vps, then ssh from it TO the host running the OpenVZ server with no problems.. No idea where to go from here...