Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Help Setting up OpenVPN

    OpenVPN
    2
    20
    1.3k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • V
      viragomann @csellsense
      last edited by

      @csellsense
      Does the client key match that one shown in the server settings.
      Possibly you accidentally created a new one on the server.

      Also possible that there are incompatible server settings.
      Can you post the settings from both, server and client?

      1 Reply Last reply Reply Quote 0
      • C
        csellsense
        last edited by

        They do match from the profile exported and the settings page.

        Trying to attach the requested configs, redacted the Certs but confirmed they do match the certs from the console: PFSenseOpenVPNConfig.zip

        V 1 Reply Last reply Reply Quote 0
        • V
          viragomann @csellsense
          last edited by

          @csellsense
          Cannot see a fault.

          Maybe we get more info on what's failing if you enhance the servers verbosity level to 4.

          Also check the client log for hints.

          C 1 Reply Last reply Reply Quote 0
          • C
            csellsense @viragomann
            last edited by

            @viragomann Not seeing anything really additional after increasing log verbosity to 4. Just the logs for client closing.

            Here is a sample of client logs during connect attempt:

            [Feb 06, 2024, 11:14:36] ----- OpenVPN Start -----

            [Feb 06, 2024, 11:14:36] EVENT: CORE_THREAD_ACTIVE

            [Feb 06, 2024, 11:14:36] OpenVPN core 3.8.4connectX(3.git::c424d46c:RelWithDebInfo) android arm64 64-bit PT_PROXY

            [Feb 06, 2024, 11:14:36] Frame=512/2112/512 mssfix-ctrl=1250

            [Feb 06, 2024, 11:14:36] NOTE: This configuration contains options that were not used:

            [Feb 06, 2024, 11:14:36] Unsupported option (ignored)

            [Feb 06, 2024, 11:14:36] 0 [persist-tun]

            [Feb 06, 2024, 11:14:36] 1 [persist-key]

            [Feb 06, 2024, 11:14:36] 2 [data-ciphers] [AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305:AES-256-CBC]

            [Feb 06, 2024, 11:14:36] 3 [data-ciphers-fallback] [AES-256-CBC]

            [Feb 06, 2024, 11:14:36] 12 [explicit-exit-notify]

            [Feb 06, 2024, 11:14:36] EVENT: RESOLVE

            [Feb 06, 2024, 11:14:36] Contacting <WAN REDACTED>:1194 via UDP

            [Feb 06, 2024, 11:14:36] EVENT: WAIT

            [Feb 06, 2024, 11:14:36] Connecting to [<WAN REDACTED>]:1194 (<WAN REDACTED>) via UDPv4

            [Feb 06, 2024, 11:14:46] Server poll timeout, trying next remote entry...

            [Feb 06, 2024, 11:14:46] EVENT: RECONNECTING

            [Feb 06, 2024, 11:14:46] EVENT: RESOLVE

            [Feb 06, 2024, 11:14:46] Contacting <WAN REDACTED>:1194 via UDP

            [Feb 06, 2024, 11:14:46] EVENT: WAIT

            [Feb 06, 2024, 11:14:46] Connecting to [<WAN REDACTED>]:1194 (<WAN REDACTED>) via UDPv4

            [Feb 06, 2024, 11:14:56] Server poll timeout, trying next remote entry...

            [Feb 06, 2024, 11:14:56] EVENT: RECONNECTING

            [Feb 06, 2024, 11:14:56] EVENT: RESOLVE

            [Feb 06, 2024, 11:14:56] Contacting <WAN REDACTED>:1194 via UDP

            [Feb 06, 2024, 11:14:56] EVENT: WAIT

            [Feb 06, 2024, 11:14:56] Connecting to [<WAN REDACTED>]:1194 (<WAN REDACTED>) via UDPv4

            [Feb 06, 2024, 11:14:59] EVENT: CANCELLED

            [Feb 06, 2024, 11:14:59] EVENT: DISCONNECTED

            [Feb 06, 2024, 11:14:59] Tunnel bytes per CPU second: 0

            [Feb 06, 2024, 11:14:59] ----- OpenVPN Stop -----

            [Feb 06, 2024, 11:14:59] EVENT: CORE_THREAD_DONE

            1 Reply Last reply Reply Quote 0
            • C
              csellsense
              last edited by

              Updated to lvl 8 verbosity:

              Feb 6 11:21:56 openvpn 55916 I/O WAIT TR|Tw|SR|Sw [10/0]
              Feb 6 11:21:56 openvpn 55916 PO_CTL rwflags=0x0001 ev=9 arg=0x002c78bc
              Feb 6 11:21:56 openvpn 55916 PO_CTL rwflags=0x0001 ev=4 arg=0x002c78b8
              Feb 6 11:21:56 openvpn 55916 PO_CTL rwflags=0x0001 ev=5 arg=0x002c78b4
              Feb 6 11:21:56 openvpn 55916 PO_CTL rwflags=0x0001 ev=6 arg=0x002c87c8
              Feb 6 11:21:56 openvpn 55916 SCHEDULE: schedule_find_least NULL
              Feb 6 11:21:56 openvpn 55916 GET INST BY REAL: <EXT IP REDACTED>:12772 [failed]
              Feb 6 11:21:56 openvpn 55916 TLS Error: incoming packet authentication failed from [AF_INET]<EXT IP REDACTED>:12772
              Feb 6 11:21:56 openvpn 55916 Authenticate/Decrypt packet error: packet HMAC authentication failed
              Feb 6 11:21:56 openvpn 55916 MULTI: REAP range 128 -> 144
              Feb 6 11:21:56 openvpn 55916 I/O WAIT status=0x0001
              Feb 6 11:21:56 openvpn 55916 PO_WAIT[0,0] fd=6 rev=0x00000001 rwflags=0x0001 arg=0x002c87c8
              Feb 6 11:21:55 openvpn 55916 I/O WAIT TR|Tw|SR|Sw [10/0]
              Feb 6 11:21:55 openvpn 55916 PO_CTL rwflags=0x0001 ev=9 arg=0x002c78bc
              Feb 6 11:21:55 openvpn 55916 PO_CTL rwflags=0x0001 ev=4 arg=0x002c78b8
              Feb 6 11:21:55 openvpn 55916 PO_CTL rwflags=0x0001 ev=5 arg=0x002c78b4
              Feb 6 11:21:55 openvpn 55916 PO_CTL rwflags=0x0001 ev=6 arg=0x002c87c8
              Feb 6 11:21:55 openvpn 55916 SCHEDULE: schedule_find_least NULL
              Feb 6 11:21:55 openvpn 55916 GET INST BY REAL: <EXT IP REDACTED>:12772 [failed]
              Feb 6 11:21:55 openvpn 55916 TLS Error: incoming packet authentication failed from [AF_INET]<EXT IP REDACTED>:12772
              Feb 6 11:21:55 openvpn 55916 Authenticate/Decrypt packet error: packet HMAC authentication failed
              Feb 6 11:21:55 openvpn 55916 MULTI: REAP range 112 -> 128
              Feb 6 11:21:55 openvpn 55916 I/O WAIT status=0x0001
              Feb 6 11:21:55 openvpn 55916 PO_WAIT[0,0] fd=6 rev=0x00000001 rwflags=0x0001 arg=0x002c87c8
              Feb 6 11:21:54 openvpn 55916 I/O WAIT TR|Tw|SR|Sw [10/0]
              Feb 6 11:21:54 openvpn 55916 PO_CTL rwflags=0x0001 ev=9 arg=0x002c78bc
              Feb 6 11:21:54 openvpn 55916 PO_CTL rwflags=0x0001 ev=4 arg=0x002c78b8
              Feb 6 11:21:54 openvpn 55916 PO_CTL rwflags=0x0001 ev=5 arg=0x002c78b4
              Feb 6 11:21:54 openvpn 55916 PO_CTL rwflags=0x0001 ev=6 arg=0x002c87c8
              Feb 6 11:21:54 openvpn 55916 SCHEDULE: schedule_find_least NULL
              Feb 6 11:21:54 openvpn 55916 GET INST BY REAL: <EXT IP REDACTED>:12772 [failed]
              Feb 6 11:21:54 openvpn 55916 TLS Error: incoming packet authentication failed from [AF_INET]<EXT IP REDACTED>:12772
              Feb 6 11:21:54 openvpn 55916 Authenticate/Decrypt packet error: packet HMAC authentication failed
              Feb 6 11:21:54 openvpn 55916 MULTI: REAP range 96 -> 112
              Feb 6 11:21:54 openvpn 55916 I/O WAIT status=0x0001
              Feb 6 11:21:54 openvpn 55916 PO_WAIT[0,0] fd=6 rev=0x00000001 rwflags=0x0001 arg=0x002c87c8
              Feb 6 11:21:53 openvpn 55916 I/O WAIT TR|Tw|SR|Sw [10/0]
              Feb 6 11:21:53 openvpn 55916 PO_CTL rwflags=0x0001 ev=9 arg=0x002c78bc
              Feb 6 11:21:53 openvpn 55916 PO_CTL rwflags=0x0001 ev=4 arg=0x002c78b8
              Feb 6 11:21:53 openvpn 55916 PO_CTL rwflags=0x0001 ev=5 arg=0x002c78b4
              Feb 6 11:21:53 openvpn 55916 PO_CTL rwflags=0x0001 ev=6 arg=0x002c87c8
              Feb 6 11:21:53 openvpn 55916 SCHEDULE: schedule_find_least NULL
              Feb 6 11:21:53 openvpn 55916 GET INST BY REAL: <EXT IP REDACTED>:12772 [failed]
              Feb 6 11:21:53 openvpn 55916 TLS Error: incoming packet authentication failed from [AF_INET]<EXT IP REDACTED>:12772
              Feb 6 11:21:53 openvpn 55916 Authenticate/Decrypt packet error: packet HMAC authentication failed
              Feb 6 11:21:53 openvpn 55916 MULTI: REAP range 80 -> 96
              Feb 6 11:21:53 openvpn 55916 I/O WAIT status=0x0001
              Feb 6 11:21:53 openvpn 55916 PO_WAIT[0,0] fd=6 rev=0x00000001 rwflags=0x0001 arg=0x002c87c8
              Feb 6 11:21:52 openvpn 55916 I/O WAIT TR|Tw|SR|Sw [10/0]
              Feb 6 11:21:52 openvpn 55916 PO_CTL rwflags=0x0001 ev=9 arg=0x002c78bc

              V 1 Reply Last reply Reply Quote 0
              • V
                viragomann @csellsense
                last edited by

                @csellsense
                Unfortunately this doesn't even give more information.

                Maybe there is an issue with the UDP packet size for whatever reason. You can try with TCP.

                Or try to connect with another client using a different internet connection.

                C 1 Reply Last reply Reply Quote 0
                • C
                  csellsense @viragomann
                  last edited by

                  @viragomann Tried with changing OpenVPN server settings to TCP, made sure WAN and OpenVPN firewall rules allowed TCP on that port, exported new profile, when trying to load that into my phone, it gives an error saying "remote option not specified" even though when I look at the file with txt editor - remote has

                  remote <WAN IP> 1194 tcp4

                  V 1 Reply Last reply Reply Quote 0
                  • V
                    viragomann @csellsense
                    last edited by

                    @csellsense
                    Got an idea. Try to remove the "4" at the end of the remote line.
                    As far as I remember, there were issues with this on certain clients.

                    C 1 Reply Last reply Reply Quote 0
                    • C
                      csellsense @viragomann
                      last edited by

                      @viragomann no luck :/ same error

                      persist-tun
                      persist-key
                      data-ciphers AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305:AES-256-CBC
                      data-ciphers-fallback AES-256-CBC
                      auth SHA256
                      tls-client
                      client
                      remote <WAN IP> 1194 tcp
                      nobind
                      verify-x509-name "OpenVPN_ServerCertv2" name
                      auth-user-pass
                      remote-cert-tls server

                      V 1 Reply Last reply Reply Quote 0
                      • V
                        viragomann @csellsense
                        last edited by

                        @csellsense
                        So I'm wondering, what the client is complaining regarding the remote line. The rest is straight forward.

                        C 1 Reply Last reply Reply Quote 0
                        • C
                          csellsense @viragomann
                          last edited by

                          @viragomann Tried UDP again without the 4 - was able to load the profile but not able to connect.

                          C 1 Reply Last reply Reply Quote 0
                          • C
                            csellsense @csellsense
                            last edited by

                            @viragomann alright, so after a LOT of research, reading I don't know how many guides and whatnot... rebuilding the whole thing several times over.... eventually I just needed to use a different client export. I was using the one for Android and the one for OpenVPN Connect (Android/iOS). I tried using the generic inline config and that is working without trouble! Screenshot included. The "Most Clients" config is working. There are some very minor changes to the config file but apparently that's what was hanging me up!

                            9598215c-089e-49d5-8385-3abba00dbcc9-image.png

                            V 1 Reply Last reply Reply Quote 0
                            • V
                              viragomann @csellsense
                              last edited by

                              @csellsense
                              I recently exported the "OpenVPN Connect" file and imported it into a recent version of the app on Android 14 and could connect immediately.

                              However, could be that older OS versions have different.

                              C 1 Reply Last reply Reply Quote 0
                              • C
                                csellsense @viragomann
                                last edited by

                                @viragomann appreciate you helping me to troubleshoot anyways!

                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.