1

I am using openvpn linux server and windows xp as client. Firewall is disabled in both the client and server. I don't understand why I am getting as "TLS error: TLS handshake failed". I am using UDP port 1194 in both the server and client.TLS initial packet is sent from the server but the client could not respond to it. Could any one please help me in resolving this problem.

Thanks in advance:-)

Please find attached config and log files.

/etc/OpenVPN/server.conf

port 1194
proto udp
dev tun
ca /etc/OpenVPN/openvpn-2.3.14/ca.crt
cert /etc/OpenVPN/openvpn-2.3.14/server.crt
key /etc/OpenVPN/openvpn-2.3.14/server.key
dh /etc/OpenVPN/openvpn-2.3.14/dh1024.pem
server 192.168.2.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
tls-auth /etc/OpenVPN/easy-rsa-old-master/easy-rsa/2.0/keys/ta.key 0
cipher BF-CBC # Blowfish (default)
persist-key
persist-tun
status openvpn-status.log
verb 3

C:\Program Files\Open VPN\Config\client.ovpn

client
dev tun
proto udp
remote 192.168.2.66 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca "C:\Program Files\OpenVPN\easy-rsa\keys\ca.crt"
cert "C:\Program Files\OpenVPN\easy-rsa\keys\client1.crt"
key "C:\Program Files\OpenVPN\easy-rsa\keys\client1.key"
remote-cert-tls server
tls-auth "C:\Program Files\OpenVPN\easy-rsa\keys\ta.key" 1
cipher AES-256-CBC
verb 3

server log file

Tue Apr 18 10:38:11 2017 OpenVPN 2.3.14 i686-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Apr 10 2017
Tue Apr 18 10:38:11 2017 library versions: OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008, LZO 2.09
Tue Apr 18 10:38:11 2017 Diffie-Hellman initialized with 1024 bit key
Tue Apr 18 10:38:11 2017 Control Channel Authentication: using '/etc/OpenVPN/easy-rsa-old-master/easy-rsa/2.0/keys/ta.key' as a OpenVPN static key file
Tue Apr 18 10:38:11 2017 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Apr 18 10:38:11 2017 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Apr 18 10:38:11 2017 Socket Buffers: R=[110592->110592] S=[110592->110592]
Tue Apr 18 10:38:11 2017 ROUTE_GATEWAY 192.168.2.2/255.255.255.0 IFACE=eth0 HWADDR=74:d4:35:e3:ff:5b
Tue Apr 18 10:38:11 2017 TUN/TAP device tun0 opened
Tue Apr 18 10:38:11 2017 TUN/TAP TX queue length set to 100
Tue Apr 18 10:38:11 2017 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Apr 18 10:38:11 2017 /sbin/ifconfig tun0 192.168.2.1 pointopoint 192.168.2.2 mtu 1500
Tue Apr 18 10:38:11 2017 /sbin/route add -net 192.168.2.0 netmask 255.255.255.0 gw 192.168.2.2
Tue Apr 18 10:38:11 2017 UDPv4 link local (bound): [undef]
Tue Apr 18 10:38:11 2017 UDPv4 link remote: [undef]
Tue Apr 18 10:38:11 2017 MULTI: multi_init called, r=256 v=256
Tue Apr 18 10:38:11 2017 IFCONFIG POOL: base=192.168.2.4 size=62, ipv6=0
Tue Apr 18 10:38:11 2017 IFCONFIG POOL LIST
Tue Apr 18 10:38:11 2017 Initialization Sequence Completed
Tue Apr 18 10:38:15 2017 192.168.2.27:1175 TLS: Initial packet from [AF_INET]192.168.2.27:1175, sid=d2919ee5 81172007
Tue Apr 18 10:39:10 2017 192.168.2.27:1177 TLS: Initial packet from [AF_INET]192.168.2.27:1177, sid=bced6247 c1788fef
Tue Apr 18 10:39:15 2017 192.168.2.27:1175 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Tue Apr 18 10:39:15 2017 192.168.2.27:1175 TLS Error: TLS handshake failed
Tue Apr 18 10:39:15 2017 192.168.2.27:1175 SIGUSR1[soft,tls-error] received, client-instance restarting

client log file

Tue Apr 18 10:46:54 2017 OpenVPN 2.3.14 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Feb 1 2017
Tue Apr 18 10:46:54 2017 Windows version 5.1 (Windows XP) 32bit
Tue Apr 18 10:46:54 2017 library versions: OpenSSL 1.0.2k 26 Jan 2017, LZO 2.09
Tue Apr 18 10:46:54 2017 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Tue Apr 18 10:46:54 2017 Need hold release from management interface, waiting...
Tue Apr 18 10:46:54 2017 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Tue Apr 18 10:46:54 2017 MANAGEMENT: CMD 'state on'
Tue Apr 18 10:46:54 2017 MANAGEMENT: CMD 'log all on'
Tue Apr 18 10:46:54 2017 MANAGEMENT: CMD 'hold off'
Tue Apr 18 10:46:54 2017 MANAGEMENT: CMD 'hold release'
Tue Apr 18 10:46:54 2017 Control Channel Authentication: using 'C:\Program Files\OpenVPN\easy-rsa\keys\ta.key' as a OpenVPN static key file
Tue Apr 18 10:46:54 2017 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Apr 18 10:46:54 2017 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Apr 18 10:46:54 2017 Socket Buffers: R=[8192->8192] S=[8192->8192] Tue Apr 18 10:46:54 2017 UDPv4 link local: [undef]
Tue Apr 18 10:46:54 2017 UDPv4 link remote: [AF_INET]192.168.2.66:1194
Tue Apr 18 10:46:54 2017 MANAGEMENT: >STATE:1492492614,WAIT,,,
Tue Apr 18 10:49:23 2017 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Tue Apr 18 10:49:23 2017 TLS Error: TLS handshake failed
Tue Apr 18 10:49:23 2017 SIGUSR1[soft,tls-error] received, process restarting
Tue Apr 18 10:49:23 2017 MANAGEMENT: >STATE:1492492763,RECONNECTING,tls-error,,
Tue Apr 18 10:49:23 2017 Restart pause, 2 second(s)
Tue Apr 18 10:49:25 2017 Socket Buffers: R=[8192->8192] S=[8192->8192]
Tue Apr 18 10:49:25 2017 UDPv4 link local: [undef]
Tue Apr 18 10:49:25 2017 UDPv4 link remote: [AF_INET]192.168.2.66:1194
Tue Apr 18 10:49:25 2017 MANAGEMENT: >STATE:1492492765,WAIT,,,

tls authentication key is 2048 bit key and diffie hiellman is 1024 bit

1 Answer 1

1

There is already a very similar question on serverfault: Fix 'TLS Error: TLS handshake failed' on OpenVPN client

If this question does not fit your needs, could you please give us some more information about your system, your configuration and a more detailed error message from the servers and clients logs? If the server is responding on the client (Quote: "TLS initial packet is sent from the server ..."), but the client is not establishing a connection, the error is probably located somewhere deeper in the system and some more details would be useful.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .