Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have 2 OpenVZ Ubuntu servers hosted with a vps vendor, both with an OpenVPN link back to the office network, along with several transient laptops/android phones using the vpn with all working perfectly for months..

The server runs on standard udp port 1194, and uses a routed tun connection. Both of the vps are configured identically for OpenVPN, with only "server1" recently starting to constantly time out during handshake to the vpn server. "server2" has had no problems, and connects normally, plus no problems with the misc laptops and android devices. The server uses the "easy-rsa" PKI scheme, with a self-signed ca and a cert/key for each host that connects.

I've tried regenerating certs/keys for all of the systems, with no effect, and verified connectivity between the host and vpn server. Some googling led me to a forum thread that warns when issues like this happen, on an OpenVZ vps, to check the tun interface. I had the vps vendor check that, and they report that the tun interface is working fine..

A syslog snip of the error shown on the server.. (The obfuscated ip address is the correct ip address for the client vps..)

Sep  6 14:24:56 svnetgw daemon.notice openvpn[453]: xx.xx.xxx.xxx:45629 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]

Sep  6 14:24:56 svnetgw daemon.notice openvpn[453]: xx.xx.xxx.xxx:45629 TLS: Initial packet from xx.xx.xxx.xxx:45629, sid=5dfe1f0d 3c07de86

Sep  6 14:25:56 svnetgw daemon.err openvpn[453]: xx.xx.xxx.xxx:45629 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)

Sep  6 14:25:56 svnetgw daemon.err openvpn[453]: xx.xx.xxx.xxx:45629 TLS Error: TLS handshake failed

Sep  6 14:25:56 svnetgw daemon.notice openvpn[453]: xx.xx.xxx.xxx:45629 SIGUSR1[soft,tls-error] received, client-instance restarting

The error makes me think theres a problem with the network path between the vps and server, but I can ssh TO the vps, then ssh from it TO the host running the OpenVZ server with no problems.. No idea where to go from here...

share|improve this question
Anything on the server side openvpn logs? –  cjc Sep 6 '12 at 23:01
ummm.. That WAS the server-side openvpn log.. –  lvdave Sep 7 '12 at 16:08
That's what I get for reading quickly! Anyway, the usual thing to do at this point is to make sure that the server and client clocks are in sync. –  cjc Sep 7 '12 at 16:41
Hadn't thought of that, but just checked and both the server and the client clocks are within a second of each other.. –  lvdave Sep 7 '12 at 21:52
Decided to nuke the problem from orbit.. Since the vps only has a couple programs which are easily rsync'ed over to the other vps for temporary storage, I did the rsync, then did a reinstall of the OS, and moved the rsync'ed stuff back over.. Of course OpenVPN now works just fine, like it did before whatever happened to the old vps image... Thanks –  lvdave Sep 19 '12 at 20:49
show 4 more comments

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.