TLS key negotiation failed to occur within 60 seconds
-
Hello all,
I need a hand please.
Bottom Line up front:
Client logs state TLS key negotiation failed to occur within 60 seconds, TLS handshake failed.I have been running into this issue for a while now. Everything worked fine and then I tried setting up Surfshark on Pfsense to act as a VPN for my entire network. I followed this Guide. Basically I was playing out of my league and was messing with some settings I shouldn't have and of course didn't backup my configuration before hand. Lesson learned. Anyway I wen't back through that same guide and tried undoing everything I did. I think I got it all and my internet started working again. So major problem solved. But OpenVPN wasn't working anymore. I figured my best bet would be to use the OpenVPN setup wizard and just make a second instance of OvenVPN on a new port. That didn't work so i started doing the following troubleshooting steps
- Exported the new certs after creating a new instance of OpenVPN. Still receive the same error.
- Ensure I wasn't trying to connect from the same network
- Tried on both my phone and my laptop to ensure it wasn't specific to one client
- rechecked my firewall for the 30th time to make sure it is configured the same as the wizard set it up as.
- Installed WireGuard to say screw it and at least have access in the mean time and WireGuard doesn't work either.
So I checked logs. (I am not very smart and I am also not very good at reading logs, plus I am pretty new. So I am basically a recipe for a bad time) I don't really know what I am looking for but I have read many other forum posts with the same title that basically say "Firewall issue" "Check Pfsense logs" but I don't know what to change in my firewall if I have something wrong. If someone can baby step me through this I would be very grateful.
-
@anthadeas
You client tries to connect to an IPv6 and an IPv4, each port 1194, but your server is listening only on an IPv4, which is another one then the client tries to connect to.So what does your client log show? Are these connection attempts to different servers?
If it is the same host name resolving to both, IPv4 and v6 ensure to enable both on the server.
Use the client export utility an export the whole client config and import it again at the client.Note: for quick step back pfSense stores some config changes, which you can easily go back in Diagnostics > Backup & Restore > Config History.