1

I recently bought a Odroid C2 with Ubuntu 16.04 operating system. I have installed OpenVPN to be able to have access from everywhere to my home network. I have Samba sharing folders...

I followed this tutorial: https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-ubuntu-16-04

I have TLS problems when I try to connect my Windows 10 client to the server with the OpenVPN GUI for Windows.

TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
TLS Error: TLS handshake failed

OpenVPN GUI Log:

Fri Jun 10 22:56:35 2016 OpenVPN 2.3.11 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on May 10 2016
Fri Jun 10 22:56:35 2016 Windows version 6.2 (Windows 8 or greater) 64bit
Fri Jun 10 22:56:35 2016 library versions: OpenSSL 1.0.1t  3 May 2016, LZO 2.09
Fri Jun 10 22:56:35 2016 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Fri Jun 10 22:56:35 2016 Need hold release from management interface, waiting...
Fri Jun 10 22:56:36 2016 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Fri Jun 10 22:56:36 2016 MANAGEMENT: CMD 'state on'
Fri Jun 10 22:56:36 2016 MANAGEMENT: CMD 'log all on'
Fri Jun 10 22:56:36 2016 MANAGEMENT: CMD 'hold off'
Fri Jun 10 22:56:36 2016 MANAGEMENT: CMD 'hold release'
Fri Jun 10 22:56:36 2016 Control Channel Authentication: tls-auth using INLINE static key file
Fri Jun 10 22:56:36 2016 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Jun 10 22:56:36 2016 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Jun 10 22:56:36 2016 Socket Buffers: R=[65536->65536] S=[65536->65536]
Fri Jun 10 22:56:36 2016 UDPv4 link local: [undef]
Fri Jun 10 22:56:36 2016 UDPv4 link remote: [AF_INET](My address IP):1194
Fri Jun 10 22:56:36 2016 MANAGEMENT: >STATE:1465613796,WAIT,,,
Fri Jun 10 22:57:36 2016 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Fri Jun 10 22:57:36 2016 TLS Error: TLS handshake failed
Fri Jun 10 22:57:36 2016 SIGUSR1[soft,tls-error] received, process restarting
Fri Jun 10 22:57:36 2016 MANAGEMENT: >STATE:1465613856,RECONNECTING,tls-error,,
Fri Jun 10 22:57:36 2016 Restart pause, 2 second(s)
Fri Jun 10 22:57:38 2016 Socket Buffers: R=[65536->65536] S=[65536->65536]
Fri Jun 10 22:57:38 2016 UDPv4 link local: [undef]
Fri Jun 10 22:57:38 2016 UDPv4 link remote: [AF_INET] (My address IP):1194
Fri Jun 10 22:57:38 2016 MANAGEMENT: >STATE:1465613858,WAIT,,,

My client configuration (.ovpn file) without the text in comment:

client
dev tun
proto udp
remote (My address IP) 1194
resolv-retry infinite
nobind
persist-tun
remote-cert-tls server
comp-lzo
verb 3
key-direction 1

(The ca.crt, the client.crt and the client.key files are include in the ovpn file)

My server configuration (server.conf) without the text in comment:

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 10 120
tls-auth ta.key 0
key-direction 0
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3

On my router I set the Port Forwarding for the 1194 port with the Odroid IP address: see the picture

I also try the TCP proto but it retry the connection every 5 seconds.

Can you help me please! :)

1

If you are sure that you are connecting to correct public IP address then Ubuntus firewall might be blocking the connection. OpenVPN works for me with following rules:

iptables -A INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 1194 -j ACCEPT
iptables -A INPUT -i tun+ -j ACCEPT
iptables -A OUTPUT -o tun+ -j ACCEPT

And ofcourse need to save the rules. Iptables-persistent is nice tool for this:

sudo apt-get install iptables-persistent

After it's installed, you can save/reload iptables rules anytime:

sudo /etc/init.d/iptables-persistent save 
sudo /etc/init.d/iptables-persistent reload

For further troubleshooting you could monitor the traffic from server side to see if anything is reaching port 1194:

sudo apt-get-install ngrep
ngrep port 1194

Good luck

  • Thanks! But it's not working, maybe it's my crappy router. And ngrep gives me nothing :( so there's no port 1194 communication. I'll probably buy a DD WRT router to own my openVPN server... – Julien D. Jun 17 '16 at 1:25
  • It would be nice if you could connect Odroid directly to the internet and if it still won't work then it's probably your internet service provider problem. – Taavi Jun 17 '16 at 6:29
  • With some research on internet, my internet service provider blocks home server. I probably have no choice and change my internet provider.. – Julien D. Jun 28 '16 at 3:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.