You are not logged in.
Hello everyone,
I actually praise a Kimsufi server (KS1) in which i installed Archlinux.
I use it for applications (for exemple Team speak) whose openvpn.
However, i have an issue with my openvpn application.
I searched to resolve it for many hours but i didn't found...
It's why i post today : i really hope you'll can help me
The issue is I can't connect a client with the server,this is the logfile of the client (it is very long, it's why I put the entire folder in my cloud) :
http://cloud.vavalm.ovh/index.php/s/1uHqlr0xOC5OhOX )
This is an extract of the logfile (more precisely the end, when the error of none connection appeared) :
Tue Jun 09 16:42:57 2015 us=939776 MANAGEMENT: CMD 'proxy NONE '
Tue Jun 09 16:42:58 2015 us=953633 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Tue Jun 09 16:42:59 2015 us=47933 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Tue Jun 09 16:42:59 2015 us=47933 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jun 09 16:42:59 2015 us=47933 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jun 09 16:42:59 2015 us=48933 LZO compression initialized
Tue Jun 09 16:42:59 2015 us=48933 Control Channel MTU parms [ L:1560 D:168 EF:68 EB:0 ET:0 EL:0 ]
Tue Jun 09 16:42:59 2015 us=48933 Socket Buffers: R=[65536->65536] S=[65536->65536]
Tue Jun 09 16:42:59 2015 us=48933 MANAGEMENT: >STATE:1433860979,RESOLVE,,,
Tue Jun 09 16:42:59 2015 us=50505 Data Channel MTU parms [ L:1560 D:1450 EF:60 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Jun 09 16:42:59 2015 us=50505 Local Options String: 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
Tue Jun 09 16:42:59 2015 us=50505 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
Tue Jun 09 16:42:59 2015 us=50505 Local Options hash (VER=V4): '2f2c6498'
Tue Jun 09 16:42:59 2015 us=50505 Expected Remote Options hash (VER=V4): '9915e4a2'
Tue Jun 09 16:42:59 2015 us=50505 Attempting to establish TCP connection with [AF_INET]37.59.58.92:443 [nonblock]
Tue Jun 09 16:42:59 2015 us=50505 MANAGEMENT: >STATE:1433860979,TCP_CONNECT,,,
Tue Jun 09 16:43:00 2015 us=50799 TCP connection established with [AF_INET]37.59.58.92:443
Tue Jun 09 16:43:00 2015 us=50799 TCPv4_CLIENT link local: [undef]
Tue Jun 09 16:43:00 2015 us=50799 TCPv4_CLIENT link remote: [AF_INET]37.59.58.92:443
Tue Jun 09 16:43:00 2015 us=50799 MANAGEMENT: >STATE:1433860980,WAIT,,,
Tue Jun 09 16:43:00 2015 us=97742 MANAGEMENT: >STATE:1433860980,AUTH,,,
Tue Jun 09 16:43:00 2015 us=97742 TLS: Initial packet from [AF_INET]37.59.58.92:443, sid=cfbf7526 49ae2870
Tue Jun 09 16:43:01 2015 us=208583 VERIFY OK: depth=1, C=FR, ST=59, L=Lille, O=Nord, OU=MyOrganizationalUnit, CN=Nord CA, name=EasyRSA, emailAddress=vavalm@live.fr
Tue Jun 09 16:43:01 2015 us=208583 VERIFY OK: depth=0, C=FR, ST=59, L=Lille, O=Nord, OU=MyOrganizationalUnit, CN=server, name=EasyRSA, emailAddress=vavalm@live.fr
Tue Jun 09 16:43:02 2015 us=84772 Connection reset, restarting [0]
Tue Jun 09 16:43:02 2015 us=84772 TCP/UDP: Closing socket
Tue Jun 09 16:43:02 2015 us=84772 SIGUSR1[soft,connection-reset] received, process restarting
Tue Jun 09 16:43:02 2015 us=84772 MANAGEMENT: >STATE:1433860982,RECONNECTING,connection-reset,,
Tue Jun 09 16:43:02 2015 us=84772 Restart pause, 5 second(s)
Tue Jun 09 16:43:03 2015 us=86371 SIGTERM[hard,init_instance] received, process exiting
Tue Jun 09 16:43:03 2015 us=86371 MANAGEMENT: >STATE:1433860983,EXITING,init_instance,,My client setup is :
;dev tap
dev tun
# Windows needs the TAP-Windows adapter name from the Network Connections panel if you have more than one. On XP SP2, you may need to disable the firewall for the TAP adapter.
;dev-node MyTap
# Are we connecting to a TCP or UDP server? Use the same setting as on the server.
proto tcp
;proto udp
# The hostname/IP and port of the server. You can have multiple remote entries to load balance between the servers.
remote vavalm.ovh 443
# Choose a random host from the remote list for load-balancing. Otherwise try hosts in the order specified.
;remote-random
# Keep trying indefinitely to resolve the host name of the OpenVPN server. Very useful on machines which are not permanently connected to the internet such as laptops.
resolv-retry infinite
# Most clients don't need to bind to a specific local port number.
nobind
# Downgrade privileges after initialization (non-Windows only)
;user nobody
;group nobody
# Try to preserve some state across restarts.
persist-key
persist-tun
# If you are connecting through an HTTP proxy to reach the actual OpenVPN server, put the proxy server/IP and
# port number here. See the man page if your proxy server requires authentication.
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]
# Wireless networks often produce a lot of duplicate packets. Set this flag to silence duplicate packet warnings.
;mute-replay-warnings
# SSL/TLS parm
ca ca.crt
cert vavalm.crt
key vavalm.key
;ns-cert-type server
# If a tls-auth key is used on the server
# then every client must also have the key.
tls-auth ta.key 1
# Select a cryptographic cipher. If the cipher option is used on the server then you must also specify it here
cipher AES-256-CBC
# Enable compression on the VPN link
comp-lzo
# Set log file verbosity.
verb 4my server setup :
proto tcp
port 443
dev tun
# Cles et certificats
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh /etc/openvpn/dh2048.pem
tls-auth /etc/openvpn/ta.key 0
# Reseau
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
# Données et Securite
user nobody
group nobody #nogroup for debian nobody for archlinux
chroot /etc/openvpn/jail
persist-key
persist-tun
#cipher AES-256-CBC
cipher AES-256-CBC
#cipher DES-EDE3-CBC # Triple-DES
comp-lzo
#Log
verb 6
mute 20
status /var/log/openvpn-status.log
log-append /var/log/openvpn.log
log /var/log/openvpn.log
#autres
ifconfig-pool-persist ipp.txt
max-clients 10
ifconfig-pool-persist ipp.txt
max-clients 10
#client
client-to-client
keepalive 10 120Openvpn log files are ... empty
/var/log/openvpn-status.log
OpenVPN CLIENT LIST
Updated,Tue Jun 9 14:53:55 2015
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
GLOBAL STATS
Max bcast/mcast queue length,0
ENDopenvpn.log is not empty but i don't think it cans help us.
Stranges IP adress appear on it, why ? maybe attempts of connection/attack ?
Tue Jun 9 14:42:43 2015 us=276428 85.192.236.223:50813 NOTE: --mute triggered...
Tue Jun 9 14:42:44 2015 us=842319 85.192.236.223:50813 83 variation(s) on previous 20 message(s) suppressed by --mute
Tue Jun 9 14:42:44 2015 us=842480 85.192.236.223:50813 VERIFY ERROR: depth=0, error=unable to get local issuer certificate: C=FR, ST=59, L=Lille, O=Nord, OU=MyOrganizationalUnit, CN=vavalm, name=Valentin, emailAddress=vavalm@live.fr
Tue Jun 9 14:42:44 2015 us=842834 85.192.236.223:50813 TLS_ERROR: BIO read tls_read_plaintext error: error:14089086:SSL routines:ssl3_get_client_certificate:certificate verify failed
Tue Jun 9 14:42:44 2015 us=842917 85.192.236.223:50813 TLS Error: TLS object -> incoming plaintext read error
Tue Jun 9 14:42:44 2015 us=842990 85.192.236.223:50813 TLS Error: TLS handshake failed
Tue Jun 9 14:42:44 2015 us=843311 85.192.236.223:50813 Fatal TLS error (check_tls_errors_co), restarting
Tue Jun 9 14:42:44 2015 us=843464 85.192.236.223:50813 SIGUSR1[soft,tls-error] received, client-instance restarting
Tue Jun 9 14:42:44 2015 us=843679 TCP/UDP: Closing socketThank you !
Last edited by vavalm (2015-06-13 15:48:56)
Offline
Nobody can help me ?
Offline
I finally find the problem (after a lot of hours of search), The order of instructions was wrong :
i did :
source vars
./clean-all
./build-dh
./pkitool --initca
./pkitool --server server
./build-key-server server
openvpn --genkey --secret keys/ta.key
and finally the right order is :
source ./vars
./clean-all
./build-ca
./build-key-server server
./build-dh
./build-key client
openvpn --genkey --secret keys/ta.key
Offline