как соединить две локальные сети офисов, р

l2grom

Зачем новую тему создал? Ясно же в логе сказано - соединение идет, но TLS ключ не отдается клиенту. еще лог сервера покажи

Sun Sep 26 17:20:52 2010 OpenVPN 2.2-beta3 i686-pc-mingw32 [SSL] [LZO2] [PKCS11] built on Sep 2 2010
Sun Sep 26 17:20:52 2010 NOTE: OpenVPN 2.1 requires '–script-security 2' or higher to call user-defined scripts or executables
Sun Sep 26 17:20:52 2010 LZO compression initialized
Sun Sep 26 17:20:52 2010 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sun Sep 26 17:20:52 2010 Socket Buffers: R=[8192->8192] S=[8192->8192]
Sun Sep 26 17:20:52 2010 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sun Sep 26 17:20:52 2010 Local Options hash (VER=V4): '41690919'
Sun Sep 26 17:20:52 2010 Expected Remote Options hash (VER=V4): '530fdded'
Sun Sep 26 17:20:52 2010 UDPv4 link local: [undef]
Sun Sep 26 17:20:52 2010 UDPv4 link remote: 192.168.1.2:1194
Sun Sep 26 17:20:52 2010 TLS: Initial packet from 192.168.1.2:1194, sid=41a48419 4becccb3
Sun Sep 26 17:20:52 2010 VERIFY OK: depth=1, /C=RU/ST=CA/L=Tymen/O=CCK/CN=pfSense-CA/emailAddress=aleksi1980@mail.ru
Sun Sep 26 17:20:52 2010 VERIFY OK: nsCertType=SERVER
Sun Sep 26 17:20:52 2010 VERIFY OK: depth=0, /C=RU/ST=CA/O=CCK/CN=server/emailAddress=aleksi1980@mail.ru
Sun Sep 26 17:21:52 2010 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sun Sep 26 17:21:52 2010 TLS Error: TLS handshake failed
Sun Sep 26 17:21:52 2010 TCP/UDP: Closing socket
Sun Sep 26 17:21:52 2010 SIGUSR1[soft,tls-error] received, process restarting
Sun Sep 26 17:21:52 2010 Restart pause, 2 second(s)
Sun Sep 26 17:21:54 2010 NOTE: OpenVPN 2.1 requires '–script-security 2' or higher to call user-defined scripts or executables
Sun Sep 26 17:21:54 2010 Re-using SSL/TLS context
Sun Sep 26 17:21:54 2010 LZO compression initialized
Sun Sep 26 17:21:54 2010 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sun Sep 26 17:21:54 2010 Socket Buffers: R=[8192->8192] S=[8192->8192]
Sun Sep 26 17:21:54 2010 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sun Sep 26 17:21:54 2010 Local Options hash (VER=V4): '41690919'
Sun Sep 26 17:21:54 2010 Expected Remote Options hash (VER=V4): '530fdded'
Sun Sep 26 17:21:54 2010 UDPv4 link local: [undef]
Sun Sep 26 17:21:54 2010 UDPv4 link remote: 192.168.1.2:1194
Sun Sep 26 17:21:54 2010 TLS: Initial packet from 192.168.1.2:1194, sid=a768bba8 07080589
Sun Sep 26 17:21:54 2010 VERIFY OK: depth=1, /C=RU/ST=CA/L=Tymen/O=CCK/CN=pfSense-CA/emailAddress=aleksi1980@mail.ru
Sun Sep 26 17:21:54 2010 VERIFY OK: nsCertType=SERVER
Sun Sep 26 17:21:54 2010 VERIFY OK: depth=0, /C=RU/ST=CA/O=CCK/CN=server/emailAddress=aleksi1980@mail.ru
Sun Sep 26 17:22:54 2010 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sun Sep 26 17:22:54 2010 TLS Error: TLS handshake failed
Sun Sep 26 17:22:54 2010 TCP/UDP: Closing socket
Sun Sep 26 17:22:54 2010 SIGUSR1[soft,tls-error] received, process restarting
Sun Sep 26 17:22:54 2010 Restart pause, 2 second(s)
Sun Sep 26 17:22:56 2010 NOTE: OpenVPN 2.1 requires '–script-security 2' or higher to call user-defined scripts or executables
Sun Sep 26 17:22:56 2010 Re-using SSL/TLS context
Sun Sep 26 17:22:56 2010 LZO compression initialized
Sun Sep 26 17:22:56 2010 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sun Sep 26 17:22:56 2010 Socket Buffers: R=[8192->8192] S=[8192->8192]
Sun Sep 26 17:22:56 2010 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sun Sep 26 17:22:56 2010 Local Options hash (VER=V4): '41690919'
Sun Sep 26 17:22:56 2010 Expected Remote Options hash (VER=V4): '530fdded'
Sun Sep 26 17:22:56 2010 UDPv4 link local: [undef]
Sun Sep 26 17:22:56 2010 UDPv4 link remote: 192.168.1.2:1194
Sun Sep 26 17:23:02 2010 TLS: Initial packet from 192.168.1.2:1194, sid=9f2d0d34 0a6e9042
Sun Sep 26 17:23:02 2010 VERIFY OK: depth=1, /C=RU/ST=CA/L=Tymen/O=CCK/CN=pfSense-CA/emailAddress=aleksi1980@mail.ru
Sun Sep 26 17:23:02 2010 VERIFY OK: nsCertType=SERVER
Sun Sep 26 17:23:02 2010 VERIFY OK: depth=0, /C=RU/ST=CA/O=CCK/CN=server/emailAddress=aleksi1980@mail.ru
Sun Sep 26 17:23:07 2010 TCP/UDP: Closing socket
Sun Sep 26 17:23:07 2010 SIGTERM[hard,] received, process exiting
Sun Sep 26 17:23:08 2010 OpenVPN 2.2-beta3 i686-pc-mingw32 [SSL] [LZO2] [PKCS11] built on Sep 2 2010
Sun Sep 26 17:23:08 2010 NOTE: OpenVPN 2.1 requires '–script-security 2' or higher to call user-defined scripts or executables
Sun Sep 26 17:23:08 2010 LZO compression initialized
Sun Sep 26 17:23:08 2010 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sun Sep 26 17:23:08 2010 Socket Buffers: R=[8192->8192] S=[8192->8192]
Sun Sep 26 17:23:08 2010 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sun Sep 26 17:23:08 2010 Local Options hash (VER=V4): '41690919'
Sun Sep 26 17:23:08 2010 Expected Remote Options hash (VER=V4): '530fdded'
Sun Sep 26 17:23:08 2010 UDPv4 link local: [undef]
Sun Sep 26 17:23:08 2010 UDPv4 link remote: 192.168.1.2:1194
Sun Sep 26 17:23:08 2010 TLS: Initial packet from 192.168.1.2:1194, sid=b9b6bdfa 48140be1
Sun Sep 26 17:23:08 2010 VERIFY OK: depth=1, /C=RU/ST=CA/L=Tymen/O=CCK/CN=pfSense-CA/emailAddress=aleksi1980@mail.ru
Sun Sep 26 17:23:08 2010 VERIFY OK: nsCertType=SERVER
Sun Sep 26 17:23:08 2010 VERIFY OK: depth=0, /C=RU/ST=CA/O=CCK/CN=server/emailAddress=aleksi1980@mail.ru

deutsche

покажите конфиг клиента, у вас в схеме шифрования вообще не должно быть TLS ключа.

l2grom

@deutsche:

покажите конфиг клиента, у вас в схеме шифрования вообще не должно быть TLS ключа.

##############################################

Sample client-side OpenVPN 2.0 config file

for connecting to multi-client server.

# #

This configuration can be used by multiple

clients, however each client should have

its own cert and key files.

# #

On Windows, you might want to rename this

file so it has a .ovpn extension

##############################################

client
dev tun
proto udp
remote 192.168.1.2 1194
ping 10
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert ovpn_client1.crt
key ovpn_client1.key
ns-cert-type server
comp-lzo
pull
verb 3

l2grom

@l2grom:

@deutsche:

покажите конфиг клиента, у вас в схеме шифрования вообще не должно быть TLS ключа.

##############################################

Sample client-side OpenVPN 2.0 config file

for connecting to multi-client server. #

# #

This configuration can be used by multiple

clients, however each client should have #

its own cert and key files.

# #

On Windows, you might want to rename this

file so it has a .ovpn extension #

##############################################

client
dev tun
proto udp
remote 192.168.1.2 1194
ping 10
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert ovpn_client1.crt
key ovpn_client1.key
ns-cert-type server
comp-lzo
pull
verb 3

Diagnostics: System logs: OpenVPN

Sep 25 11:32:18 openvpn[28033]: 192.168.1.1:1816 Re-using SSL/TLS context
Sep 25 11:32:18 openvpn[28033]: 192.168.1.1:1816 LZO compression initialized
Sep 25 11:32:18 openvpn[28033]: 192.168.1.1:1816 VERIFY ERROR: depth=1, error=certificate is not yet valid: /C=RU/ST=CA/L=Tymen/O=CCK/CN=pfSense-CA/emailAddress=aleksi1980@mail.ru
Sep 25 11:32:18 openvpn[28033]: 192.168.1.1:1816 TLS_ERROR: BIO read tls_read_plaintext error: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned
Sep 25 11:32:18 openvpn[28033]: 192.168.1.1:1816 TLS Error: TLS object -> incoming plaintext read error
Sep 25 11:32:18 openvpn[28033]: 192.168.1.1:1816 TLS Error: TLS handshake failed

deutsche

certificate is not yet valid
Неправильный сертификат (от другого CA)
Проверьте поле TLS, Shared key а лучше скриншотами.

l2grom

@deutsche:

certificate is not yet valid
Неправильный сертификат (от другого CA)
Проверьте поле TLS, Shared key а лучше скриншотами.

1.JPG_thumb

2.JPG_thumb

l2grom

Я не знаю куда рыть дальше, все сделано по мануалу, либо мануал кривой либо я не умею делать сертификаты интуитивно, прочел все что смог найти в инете и на форуме, по по шагам, не спал со вчерашнего дня, вторые сутки сижу. Следующий мой шаг ра…ать комп

l2grom

@l2grom:

Я не знаю куда рыть дальше, все сделано по мануалу, либо мануал кривой либо я не умею делать сертификаты интуитивно, прочел все что смог найти в инете и на форуме, по по шагам, не спал со вчерашнего дня, вторые сутки сижу. Следующий мой шаг ра…ать комп

Все сертификаты я создаю в одном и томже месте.

листинг
C:\Documents and Settings\LineageS.GROM>cd C:\Program Files\OpenVPN\easy-rsa

C:\Program Files\OpenVPN\easy-rsa>init-config.bat

C:\Program Files\OpenVPN\easy-rsa>copy vars.bat.sample vars.bat
Скопировано файлов: 1.

C:\Program Files\OpenVPN\easy-rsa>copy openssl.cnf.sample openssl.cnf
Скопировано файлов: 1.

C:\Program Files\OpenVPN\easy-rsa>vars.bat

C:\Program Files\OpenVPN\easy-rsa>clean-all.bat
Не удается найти указанный файл.
Скопировано файлов: 1.
Скопировано файлов: 1.

C:\Program Files\OpenVPN\easy-rsa>build-ca.bat
Loading 'screen' into random state - done
Generating a 1024 bit RSA private key
….++++++
...............++++++
writing new private key to 'keys\ca.key'

You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.

Country Name (2 letter code) [RU]:
State or Province Name (full name) [CA]:
Locality Name (eg, city) [Tymen]:
Organization Name (eg, company) [CCK]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:pfSense-CA
Email Address [aleksi1980@mail.ru]:

C:\Program Files\OpenVPN\easy-rsa>build-key-server.bat server
Loading 'screen' into random state - done
Generating a 1024 bit RSA private key
…..++++++
.............++++++
writing new private key to 'keys\server.key'

You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.

Country Name (2 letter code) [RU]:
State or Province Name (full name) [CA]:
Locality Name (eg, city) [Tymen]:
Organization Name (eg, company) [CCK]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:server
Email Address [aleksi1980@mail.ru]:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Using configuration from openssl.cnf
Loading 'screen' into random state - done
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName :PRINTABLE:'RU'
stateOrProvinceName :PRINTABLE:'CA'
localityName :PRINTABLE:'Tymen'
organizationName :PRINTABLE:'CCK'
commonName :PRINTABLE:'server'
emailAddress :IA5STRING:'aleksi1980@mail.ru'
Certificate is to be certified until Sep 23 11:25:03 2020 GMT (3650 days)
Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

C:\Program Files\OpenVPN\easy-rsa>build-dh.bat
Loading 'screen' into random state - done
Generating DH parameters, 1024 bit long safe prime, generator 2
This is going to take a long time
…..................................+..............+...........................
.......................................+..............+.........................
..................................+.............................................
....................................................................+...........
...............+....................+...........................................
.............................................................................+..
..............................+.................................................
........+...............+....................++++++*

C:\Program Files\OpenVPN\easy-rsa>build-key.bat ovpn_client1
Loading 'screen' into random state - done
Generating a 1024 bit RSA private key
........++++++
............................++++++
writing new private key to 'keys\ovpn_client1.key'

You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.

Country Name (2 letter code) [RU]:
State or Province Name (full name) [CA]:
Locality Name (eg, city) [Tymen]:
Organization Name (eg, company) [CCK]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:ovpn_client1
Email Address [aleksi1980@mail.ru]:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Using configuration from openssl.cnf
Loading 'screen' into random state - done
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName :PRINTABLE:'RU'
stateOrProvinceName :PRINTABLE:'CA'
localityName :PRINTABLE:'Tymen'
organizationName :PRINTABLE:'CCK'
commonName :T61STRING:'ovpn_client1'
emailAddress :IA5STRING:'aleksi1980@mail.ru'
Certificate is to be certified until Sep 23 11:27:19 2020 GMT (3650 days)
Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

C:\Program Files\OpenVPN\easy-rsa>

deutsche

мне жаль ваш комп, алексей.

l2grom

@deutsche:

мне жаль ваш комп, алексей.

содаю сртификаты и пишу сюда все по шагам
1. удаляю все из папки config папка остается пустой
2. удаляю папку keys и файлы .rnd openssl vars.bat
3. Перехожу из по CMD сюда C:\Program Files\OpenVPN\easy-rsa>
4. запускаю фаил init-config.bat
C:\Program Files\OpenVPN\easy-rsa>init-config.bat
C:\Program Files\OpenVPN\easy-rsa>copy vars.bat.sample vars.bat
Скопировано файлов: 1.
C:\Program Files\OpenVPN\easy-rsa>copy openssl.cnf.sample openssl.cnf
Скопировано файлов: 1.
C:\Program Files\OpenVPN\easy-rsa>
В результате у меня каталоге easy-rsa были созданы файлы openssl vars.bat
5. редаптирую Notepad++ фаил vars.bat
листинг файла до
@echo off
rem Edit this variable to point to
rem the openssl.cnf file included
rem with easy-rsa.

set HOME=%ProgramFiles%\OpenVPN\easy-rsa
set KEY_CONFIG=openssl.cnf

rem Edit this variable to point to
rem your soon-to-be-created key
rem directory.
rem
rem WARNING: clean-all will do
rem a rm -rf on this directory
rem so make sure you define
rem it correctly!
set KEY_DIR=keys

rem Increase this to 2048 if you
rem are paranoid. This will slow
rem down TLS negotiation performance
rem as well as the one-time DH parms
rem generation process.
set KEY_SIZE=1024

rem These are the default values for fields
rem which will be placed in the certificate.
rem Change these to reflect your site.
rem Don't leave any of these parms blank.

set KEY_COUNTRY=US
set KEY_PROVINCE=CA
set KEY_CITY=SanFrancisco
set KEY_ORG=OpenVPN
set KEY_EMAIL=mail@host.domain

и после

set KEY_COUNTRY=RU { россия }
set KEY_PROVINCE=na { не применимо }
set KEY_CITY=Tymen { город }
set KEY_ORG=CCK { название конторы }
set KEY_EMAIL=ai@mail.ru {email}

сохраняю.
6. из командной строки запускаю C:\Program Files\OpenVPN\easy-rsa>vars.bat
7. и C:\Program Files\OpenVPN\easy-rsa>clean-all.bat
листинг каманды
C:\Program Files\OpenVPN\easy-rsa>clean-all.bat
Не удается найти указанный файл.
Скопировано файлов: 1.
Скопировано файлов: 1.
8. запускаю C:\Program Files\OpenVPN\easy-rsa>build-ca.bat
оставляю все по умолчанию кроме
Common Name (eg, your name or your server's hostname) []:
сюда вписываю
Country Name (2 letter code) [RU]:
State or Province Name (full name) [na]:
Locality Name (eg, city) [Tymen]:
Organization Name (eg, company) [CCK]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:pfSense-CA
Email Address [ai@mail.ru]:
9. из командной строки C:\Program Files\OpenVPN\easy-rsa>build-key-server.bat server
остовляю все по умолчанию кроме commonName там вписываю server
листинг
Country Name (2 letter code) [RU]:
State or Province Name (full name) [na]:
Locality Name (eg, city) [Tymen]:
Organization Name (eg, company) [CCK]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:server
Email Address [ai@mail.ru]:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Using configuration from openssl.cnf
Loading 'screen' into random state - done
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName :PRINTABLE:'RU'
stateOrProvinceName :PRINTABLE:'na'
localityName :PRINTABLE:'Tymen'
organizationName :PRINTABLE:'CCK'
commonName :PRINTABLE:'server'
emailAddress :IA5STRING:'ai@mail.ru'
Certificate is to be certified until Sep 23 15:08:39 2020 GMT (3650 days)
Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

10. запускаю C:\Program Files\OpenVPN\easy-rsa>build-dh.bat
он мне там генерит что-то, все по умолчанию.
11. запуска C:\Program Files\OpenVPN\easy-rsa>build-key.bat ovpn_client1
остовляю все по умолчанию кроме Common Name пишу ovpn_client1
–---
Country Name (2 letter code) [RU]:
State or Province Name (full name) [na]:
Locality Name (eg, city) [Tymen]:
Organization Name (eg, company) [CCK]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:ovpn_client1
Email Address [ai@mail.ru]:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Using configuration from openssl.cnf
Loading 'screen' into random state - done
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName :PRINTABLE:'RU'
stateOrProvinceName :PRINTABLE:'na'
localityName :PRINTABLE:'Tymen'
organizationName :PRINTABLE:'CCK'
commonName :T61STRING:'ovpn_client1'
emailAddress :IA5STRING:'ai@mail.ru'
Certificate is to be certified until Sep 23 15:13:39 2020 GMT (3650 days)
Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

12 копирую три файла из созданного каталога C:\Program Files\OpenVPN\easy-rsa\keys в папку C:\Program Files\OpenVPN\config
ca.crt
ovpn_client1.key
ovpn_client1.crt

13 создаю фаил C:\Program Files\OpenVPN\ovpn_client1.ovpn со следующими параметрами
листинг

client
dev tun
proto udp
remote 192.168.1.2 1194
ping 10
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert ovpn_client1.crt
key ovpn_client1.key
ns-cert-type server
comp-lzo
pull
verb 3

14 копирую содержимое файлов соответственно в OpenVPN: Server: Edit
ca.crt into в "CA certificate" window
server.crt into в "Server Certificate" window
server.key into в "Server Key" window
dh1024.pem into в "DH parameters" window

сохраняю.

15 запускаю клиент с ярлыка рабочего стола. Выдает вот такую ошибку
лог клиента openVPN
Sun Sep 26 19:24:34 2010 OpenVPN 2.2-beta3 i686-pc-mingw32 [SSL] [LZO2] [PKCS11] built on Sep 2 2010
Sun Sep 26 19:24:34 2010 NOTE: OpenVPN 2.1 requires '–script-security 2' or higher to call user-defined scripts or executables
Sun Sep 26 19:24:34 2010 LZO compression initialized
Sun Sep 26 19:24:34 2010 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sun Sep 26 19:24:34 2010 Socket Buffers: R=[8192->8192] S=[8192->8192]
Sun Sep 26 19:24:34 2010 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sun Sep 26 19:24:34 2010 Local Options hash (VER=V4): '41690919'
Sun Sep 26 19:24:34 2010 Expected Remote Options hash (VER=V4): '530fdded'
Sun Sep 26 19:24:34 2010 UDPv4 link local: [undef]
Sun Sep 26 19:24:34 2010 UDPv4 link remote: 192.168.1.2:1194
Sun Sep 26 19:24:34 2010 TLS: Initial packet from 192.168.1.2:1194, sid=7a6d625c e8fa536e
Sun Sep 26 19:24:34 2010 VERIFY OK: depth=1, /C=RU/ST=na/L=Tymen/O=CCK/CN=pfSense-CA/emailAddress=ai@mail.ru
Sun Sep 26 19:24:34 2010 VERIFY OK: nsCertType=SERVER
Sun Sep 26 19:24:34 2010 VERIFY OK: depth=0, /C=RU/ST=na/O=CCK/CN=server/emailAddress=ai@mail.ru
Sun Sep 26 19:25:34 2010 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sun Sep 26 19:25:34 2010 TLS Error: TLS handshake failed
Sun Sep 26 19:25:34 2010 TCP/UDP: Closing socket
Sun Sep 26 19:25:34 2010 SIGUSR1[soft,tls-error] received, process restarting
Sun Sep 26 19:25:34 2010 Restart pause, 2 second(s)

лог сервера OpenVPN

Sep 25 13:32:18 openvpn[41044]: 192.168.1.1:2299 Re-using SSL/TLS context
Sep 25 13:32:18 openvpn[41044]: 192.168.1.1:2299 LZO compression initialized
Sep 25 13:32:18 openvpn[41044]: 192.168.1.1:2299 VERIFY ERROR: depth=1, error=certificate is not yet valid: /C=RU/ST=na/L=Tymen/O=CCK/CN=pfSense-CA/emailAddress=ai@mail.ru
Sep 25 13:32:18 openvpn[41044]: 192.168.1.1:2299 TLS_ERROR: BIO read tls_read_plaintext error: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned
Sep 25 13:32:18 openvpn[41044]: 192.168.1.1:2299 TLS Error: TLS object -> incoming plaintext read error
Sep 25 13:32:18 openvpn[41044]: 192.168.1.1:2299 TLS Error: TLS handshake failed

И ХОТЬ ТРЕСНИ, ГДЕ Я ОШИБСЯ? Кто подскажет?

deutsche

Версия pfsense, openvpn (сервер и клиент)?
покажите
/var/etc/openvpn_server0.conf
/usr/local/sbin/openvpn –version

Вот этот клиент попробуйте(а не бету) http://openvpn.net/index.php/open-source/downloads.html#latest-stable

l2grom

@l2grom:

@deutsche:

Версия pfsense, openvpn (сервер и клиент)?

1.2.3-RELEASE
built on Sun Dec 6 23:21:36 EST 2009

клиент

Версия 2.1 RC15:

Спасибо, результат отпишу.

l2grom

на сервере
Sep 25 14:30:42 openvpn[48129]: 192.168.1.1:2563 VERIFY ERROR: depth=1, error=certificate is not yet valid: /C=RU/ST=na/L=Tymen/O=CCK/CN=pfSense-CA/emailAddress=ai@mail.ru
Sep 25 14:30:42 openvpn[48129]: 192.168.1.1:2563 TLS_ERROR: BIO read tls_read_plaintext error: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned
Sep 25 14:30:42 openvpn[48129]: 192.168.1.1:2563 TLS Error: TLS object -> incoming plaintext read error
Sep 25 14:30:42 openvpn[48129]: 192.168.1.1:2563 TLS Error: TLS handshake failed

в клиенте
Sun Sep 26 20:26:25 2010 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sun Sep 26 20:26:25 2010 TLS Error: TLS handshake failed
Sun Sep 26 20:26:25 2010 TCP/UDP: Closing socket

Все тоже самое, таже самая ошибка.

l2grom

@l2grom:

на сервере
Sep 25 14:30:42 openvpn[48129]: 192.168.1.1:2563 VERIFY ERROR: depth=1, error=certificate is not yet valid: /C=RU/ST=na/L=Tymen/O=CCK/CN=pfSense-CA/emailAddress=ai@mail.ru
Sep 25 14:30:42 openvpn[48129]: 192.168.1.1:2563 TLS_ERROR: BIO read tls_read_plaintext error: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned
Sep 25 14:30:42 openvpn[48129]: 192.168.1.1:2563 TLS Error: TLS object -> incoming plaintext read error
Sep 25 14:30:42 openvpn[48129]: 192.168.1.1:2563 TLS Error: TLS handshake failed

в клиенте
Sun Sep 26 20:26:25 2010 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sun Sep 26 20:26:25 2010 TLS Error: TLS handshake failed
Sun Sep 26 20:26:25 2010 TCP/UDP: Closing socket

Все тоже самое, таже самая ошибка.

Я в принципе не претендую на эту технологию связи, раз она такая xxx, работает только на словах и бумаге, может есть другие способы подключения?

deutsche

Таки покажите текстовый конфиг сервера и версию. С PKI TLS быть не должно!
Можно брать любой VPN, например l2tp

Кстати, у Вас уже почти готово русское хау-то для OpenVPN.

l2grom

@deutsche:

Таки покажите текстовый конфиг сервера и версию. С PKI TLS быть не должно!
Можно брать любой VPN, например l2tp

Кстати, у Вас уже почти готово русское хау-то для OpenVPN.

Name pfSense-VM.local
Version 1.2.3-RELEASE
built on Sun Dec 6 23:21:36 EST 2009
Platform pfSense

writepid /var/run/openvpn_server0.pid
#user nobody
#group nobody
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
dev tun
proto udp
cipher BF-CBC
up /etc/rc.filter_configure
down /etc/rc.filter_configure
tls-server
ifconfig 78.45.0.1 78.45.0.2
push "route 10.1.1.1 255.255.255.0"
lport 1194
push "dhcp-option DISABLE-NBT"
route 10.1.1.2 255.255.255.0
ca /var/etc/openvpn_server0.ca
cert /var/etc/openvpn_server0.cert
key /var/etc/openvpn_server0.key
dh /var/etc/openvpn_server0.dh
comp-lzo

deutsche

Строчка tls-server лишняя, удалите настройки (лучше вручную) и создайте заново.
Аутентификация должна быть PKI

l2grom

@deutsche:

Строчка tls-server лишняя, удалите настройки (лучше вручную) и создайте заново.
Аутентификация должна быть PKI

я удаляю ее, она снова появляется, и кеш почистил. что-то может не там делаю?

правлю фаил openvpn_server0.conf после захода на web- морду настройки возвращаются.

l2grom

@l2grom:

@deutsche:

Строчка tls-server лишняя, удалите настройки (лучше вручную) и создайте заново.
Аутентификация должна быть PKI

добился этого, настройки не слетают но

writepid /var/run/openvpn_server0.pid
#user nobody
#group nobody
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
dev tun
proto udp
cipher BF-CBC
up /etc/rc.filter_configure
down /etc/rc.filter_configure
server 78.45.0.0 255.255.255.0
client-config-dir /var/etc/openvpn_csc
lport 1194
ca /var/etc/openvpn_server0.ca
cert /var/etc/openvpn_server0.cert
key /var/etc/openvpn_server0.key
dh /var/etc/openvpn_server0.dh
comp-lzo

лог сервера ))))))))))
Sep 25 16:15:18 openvpn[2456]: 192.168.1.1:3179 Re-using SSL/TLS context
Sep 25 16:15:18 openvpn[2456]: 192.168.1.1:3179 LZO compression initialized
Sep 25 16:15:19 openvpn[2456]: 192.168.1.1:3179 VERIFY ERROR: depth=1, error=certificate is not yet valid: /C=RU/ST=na/L=Tymen/O=CCK/CN=pfSense-CA/emailAddress=ai@mail.ru
Sep 25 16:15:19 openvpn[2456]: 192.168.1.1:3179 TLS_ERROR: BIO read tls_read_plaintext error: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned
Sep 25 16:15:19 openvpn[2456]: 192.168.1.1:3179 TLS Error: TLS object -> incoming plaintext read error
Sep 25 16:15:19 openvpn[2456]: 192.168.1.1:3179 TLS Error: TLS handshake failed

l2grom

я расшарил удаленный рабочий стол, может зайдете посмотрите), ибо я не знаю в чем дело, одно на уме, пакет не работает ибо кривой либо не дописан.

как соединить две локальные сети офисов, р

Sample client-side OpenVPN 2.0 config file

for connecting to multi-client server.

This configuration can be used by multiple

clients, however each client should have

its own cert and key files.

On Windows, you might want to rename this

file so it has a .ovpn extension

Sample client-side OpenVPN 2.0 config file

for connecting to multi-client server. #

This configuration can be used by multiple

clients, however each client should have #

its own cert and key files.

On Windows, you might want to rename this

file so it has a .ovpn extension #

C:\Program Files\OpenVPN\easy-rsa>build-ca.bat Loading 'screen' into random state - done Generating a 1024 bit RSA private key ….++++++ ...............++++++ writing new private key to 'keys\ca.key'

C:\Program Files\OpenVPN\easy-rsa>build-key-server.bat server Loading 'screen' into random state - done Generating a 1024 bit RSA private key …..++++++ .............++++++ writing new private key to 'keys\server.key'

C:\Program Files\OpenVPN\easy-rsa>build-key.bat ovpn_client1 Loading 'screen' into random state - done Generating a 1024 bit RSA private key ........++++++ ............................++++++ writing new private key to 'keys\ovpn_client1.key'

C:\Program Files\OpenVPN\easy-rsa>build-ca.bat
Loading 'screen' into random state - done
Generating a 1024 bit RSA private key
….++++++
...............++++++
writing new private key to 'keys\ca.key'

C:\Program Files\OpenVPN\easy-rsa>build-key-server.bat server
Loading 'screen' into random state - done
Generating a 1024 bit RSA private key
…..++++++
.............++++++
writing new private key to 'keys\server.key'

C:\Program Files\OpenVPN\easy-rsa>build-key.bat ovpn_client1
Loading 'screen' into random state - done
Generating a 1024 bit RSA private key
........++++++
............................++++++
writing new private key to 'keys\ovpn_client1.key'