TLS Error: TLS key negotiation failed to occur [closed]

Question

I have an OpenVPN server. I have troubles connecting to it.

I have followed step by step (a few times) the instructions on How to Set Up an OpenVPN Server on Ubuntu 18.04. However, when I run

sudo openvpn --config client1.ovpn

I get:

Sat Aug  8 21:45:34 2020 OpenVPN 2.4.4 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on May 14 2019
Sat Aug  8 21:45:34 2020 library versions: OpenSSL 1.1.1  11 Sep 2018, LZO 2.08
Sat Aug  8 21:45:34 2020 Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Sat Aug  8 21:45:34 2020 Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Sat Aug  8 21:45:34 2020 TCP/UDP: Preserving recently used remote address: [AF_INET]185.2.52.91:1194
Sat Aug  8 21:45:34 2020 Socket Buffers: R=[212992->212992] S=[212992->212992]
Sat Aug  8 21:45:34 2020 UDP link local: (not bound)
Sat Aug  8 21:45:34 2020 UDP link remote: [AF_INET]185.2.52.91:1194
Sat Aug  8 21:46:34 2020 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sat Aug  8 21:46:34 2020 TLS Error: TLS handshake failed
Sat Aug  8 21:46:34 2020 SIGUSR1[soft,tls-error] received, process restarting
Sat Aug  8 21:46:34 2020 Restart pause, 5 second(s)
Sat Aug  8 21:46:39 2020 TCP/UDP: Preserving recently used remote address: [AF_INET]185.2.52.91:1194
Sat Aug  8 21:46:39 2020 Socket Buffers: R=[212992->212992] S=[212992->212992]
Sat Aug  8 21:46:39 2020 UDP link local: (not bound)
Sat Aug  8 21:46:39 2020 UDP link remote: [AF_INET]185.2.52.91:1194
Sat Aug  8 21:47:39 2020 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sat Aug  8 21:47:39 2020 TLS Error: TLS handshake failed
Sat Aug  8 21:47:39 2020 SIGUSR1[soft,tls-error] received, process restarting
Sat Aug  8 21:47:39 2020 Restart pause, 5 second(s)

This was tried from the same network where the server is. I have also tried to connect from an Android device from another network, without much luck.

Questions:

1. For testing purposes, can I connect to the server from the local network?
2. Does the IP that one needs to introduce in the client.conf have to be the public IP which one can get e.g. from https://api.ipify.org/?
3. Since there are multiple machines connected to this network, how can the connection be established simply via the public IP? Don't I have to tell specify somewhere the private IP the server has on the network?
4. The contents of client.ovpn seem to be a concatenation of client.conf, the key, cert and ca files. Is this right? I was expecting the client configuration to look more like an ssh key.

Answer 1

Your questions:

1. Of course you can connect from your local network.
2. You can put any IP in your client config - public, private, whatever - as long as it is the correct ip to connect to your server! So if your client is in local network, you should put the private ip inside the client.conf, not the public one!
3. If you want your openvpn server to be available to public internet, you need port forwarding - you need to tell your router "to listen to udp port 1194 and to forward that to udp <private ip>:1194" (assuming that your server listens to udp 1194 !)
4. This depends on the config. Usually, the ca, cert, and key options want a filename - but you can specify some options inline. Excerpt from the manpage:

INLINE FILE SUPPORT
       OpenVPN allows including files in the main configuration for the --ca, --cert,
       --dh, --extra-certs, --key, --pkcs12, --secret, --crl-verify, --http-proxy-user-pass, 
       --tls-auth and --tls-crypt options.
       Each inline file started by the line <option> and ended by the line </option>

PS: Your client log only shows that your client does not receive a reply from the specified ip & port (maybe a missing port forward?)