0

OpenVPN running on Raspbian (Raspberry Pi Debian, Wheezy).

Relatively stock, didn't do anything other than install OpenVPN, and generated some keys.

Server config:

local 192.168.1.175
port 1194
proto udp
dev tun
ca keys/ca.crt
cert keys/server.crt
key keys/server.key
dh keys/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
client-to-client
duplicate-cn
keepalive 10 120
tls-auth keys/ta.key 0
cipher BF-CBC
comp-lzo
max-clients 10
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log        /var/log/openvpn.log
verb 3

Client config:

client
dev tun
proto udp
remote [A_GALAXY_FAR_FAR_AWAY] 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert foo.crt
key foo.key
remote-cert-tls server
cipher BF-CBC
comp-lzo
verb 3

Client Log:

Sat Jun 27 22:17:19 2015 OpenVPN 2.3.7 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Jun  8 2015
Sat Jun 27 22:17:19 2015 library versions: OpenSSL 1.0.1m 19 Mar 2015, LZO 2.08
Sat Jun 27 22:17:19 2015 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Sat Jun 27 22:17:19 2015 Need hold release from management interface, waiting...
Sat Jun 27 22:17:19 2015 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Sat Jun 27 22:17:19 2015 MANAGEMENT: CMD 'state on'
Sat Jun 27 22:17:19 2015 MANAGEMENT: CMD 'log all on'
Sat Jun 27 22:17:19 2015 MANAGEMENT: CMD 'hold off'
Sat Jun 27 22:17:19 2015 MANAGEMENT: CMD 'hold release'
Sat Jun 27 22:17:22 2015 MANAGEMENT: CMD 'proxy NONE  '
Sat Jun 27 22:17:23 2015 Socket Buffers: R=[8192->8192] S=[8192->8192]
Sat Jun 27 22:17:23 2015 MANAGEMENT: >STATE:1435465043,RESOLVE,,,
Sat Jun 27 22:17:23 2015 UDPv4 link local: [undef]
Sat Jun 27 22:17:23 2015 UDPv4 link remote: [AF_INET]67.177.250.212:1194
Sat Jun 27 22:17:23 2015 MANAGEMENT: >STATE:1435465043,WAIT,,,
Sat Jun 27 22:18:23 2015 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sat Jun 27 22:18:23 2015 TLS Error: TLS handshake failed
Sat Jun 27 22:18:23 2015 SIGUSR1[soft,tls-error] received, process restarting
Sat Jun 27 22:18:23 2015 MANAGEMENT: >STATE:1435465103,RECONNECTING,tls-error,,

I've never really configured OpenVPN before, I'm wondering if I screwed something up.

I have the PI VPN server assigned to a static IP of 192.168.1.175

I'm connecting to it from a local machine on the local network just to test it. But I did try to connect from a place nearby (a Subway I frequent) and it still wouldn't work.

Server ifconfig:

eth0      Link encap:Ethernet  HWaddr b8:27:eb:c6:38:f8
          inet addr:192.168.1.175  Bcast:192.168.1.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:134472 errors:0 dropped:458 overruns:0 frame:0
          TX packets:8010 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:10519275 (10.0 MiB)  TX bytes:847593 (827.7 KiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:9 errors:0 dropped:0 overruns:0 frame:0
          TX packets:9 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:612 (612.0 B)  TX bytes:612 (612.0 B)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

I haven't set any rules for iptables (which I suspect may be the issue):

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

I've forwarded port 1194 to 192.168.1.175 (the VPN server) in my router properly, it's visable or at least it was when I tried using the tap over tcp, now I'm trying tun over udp because that's suppose to be easier / better or something.

I don't really know what I'm suppose to do here.

Thanks in advance!

EDIT: Routing:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         myrouter.local  0.0.0.0         UG    0      0        0 eth0
default         myrouter.local  0.0.0.0         UG    202    0        0 eth0
10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
10.8.0.2        *               255.255.255.255 UH    0      0        0 tun0
192.168.1.0     *               255.255.255.0   U     202    0        0 eth0

Forwarding is enabled:

sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1
1

This was commented in the client config:

# If a tls-auth key is used on the server
# then every client must also have the key.
tls-auth ta.key 1

I needed the TLS key and obviously this needed to be uncommented.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.