Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    CONNECTION WITH REMOTE SERVER NOT ESTABLISHED BECAUSE OF A SERVER VERIFICATION METHOD ERROR

    Scheduled Pinned Locked Moved OpenVPN
    45 Posts 6 Posters 3.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • stephenw10S
      stephenw10 Netgate Administrator
      last edited by

      What is you current OpenVPN client config after making those changes?

      What is the provider asking for?

      Steve

      1 Reply Last reply Reply Quote 0
      • R
        romantik70
        last edited by

        i am only certain about a thing : the vpn works becuse i have tried to connect an vm with the windows openvpn program . on that vm there is a server web and i have put an html page .Connecting to that web server's page through an other connection i can load correctly the web page , so i am sure that the vpn connection has no mulfunction.. What i cannot do is to make it work with pfsense , but i need it , because my network has multiple VMs , that need to share that public static ip address that the vpn offers to me. In the picture attached there is a schetch of my network . The first time i did it , almost 1 year ago with the same provider shpv.fr it worked.After a period of time they changed configuration and i got that error. i quitted the service for one year because they told me that they didnt give pfsense support , the same answer they have given now , afterall , and i didnt manage to use the service any more.i have searched other privider that provides similar services at the same cheap price but i havent been able to find one similar so i have decide to return with them , but the support is scarce , after all they are french .my network.png .

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator
          last edited by johnpoz

          That drawing is pretty useless to be honest..

          What is the ovpn file they gave you to connect with?

          Going to state again that warning has is not the reason your failing to connect.. Its a warning that your not validating the server cert.. That is all... its not a failure reason..

          I see the same error when I connect to my openvpn AS,

          Dec 17 12:20:05 	openvpn 	94221 	WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info. 
          

          Connects just fine...

          Dec 17 12:20:11 	openvpn 	94221 	Initialization Sequence Completed
          Dec 17 12:20:11 	openvpn 	94221 	WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
          Dec 17 12:20:06 	openvpn 	94221 	/usr/local/sbin/ovpn-linkup ovpnc3 1500 1553 172.27.240.11 255.255.240.0 init
          Dec 17 12:20:06 	openvpn 	94221 	/sbin/route add -net 172.27.240.0 172.27.240.1 255.255.240.0
          Dec 17 12:20:06 	openvpn 	94221 	/sbin/ifconfig ovpnc3 172.27.240.11 172.27.240.1 mtu 1500 netmask 255.255.240.0 up 
          

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          R 1 Reply Last reply Reply Quote 0
          • R
            romantik70
            last edited by

            whatever warnig or error it is the vpn it's not working i dont have the inner nat address it's a 172.etc.tct.etc address for translating tcp pockets inside my network . overall the vpn it's not working . and i cannot find the reason it isnt .

            1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator
              last edited by johnpoz

              UP our log level in your client!! So you can see more detail.

              loglevel.jpg

              If need be take it past 5 into the debug level..

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              1 Reply Last reply Reply Quote 0
              • R
                romantik70 @johnpoz
                last edited by

                @johnpoz i didnt draw it for any other reason to show my network i didnt meant to show it to you for explanatory reasons . however , if you see my last screenshot there shvpn failure.png ould be an ip address instead of that n/a. to the OPT interface .

                1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator
                  last edited by johnpoz

                  Well our not going to get an IP if you don't connect, we can not see WHY your not connecting without up your log level to give us detail on the connection attempt that warning of not verify server cert has nothing to do with why the connection is failing.

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  1 Reply Last reply Reply Quote 0
                  • PippinP
                    Pippin
                    last edited by

                    Not providing asked info, no help...

                    I gloomily came to the ironic conclusion that if you take a highly intelligent person and give them the best possible, elite education, then you will most likely wind up with an academic who is completely impervious to reality.
                    Halton Arp

                    1 Reply Last reply Reply Quote 0
                    • R
                      romantik70
                      last edited by

                      these are the logs it gives out when i try to connect man if you van help you are the best in the forum.logs.png

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        The client tries to connect and the other side does not respond at all. After 1 min it gives up and starts again.
                        Something there is completely mismatched.

                        We need to see the info the provider sent you to connect to. Not the password, cert etc.

                        And the current config in pfSense of the OpenVPN client.

                        Steve

                        1 Reply Last reply Reply Quote 0
                        • R
                          romantik70
                          last edited by johnpoz

                          "zip removed by mod" here is the file they provided to me

                          1 Reply Last reply Reply Quote 0
                          • GertjanG
                            Gertjan
                            last edited by Gertjan

                            Not related (edit : but will totally break everything) : Correct this :

                            17de2e7a-98f8-4a27-a2b4-8c05a421f0b0-image.png

                            No "help me" PM's please. Use the forum, the community will thank you.
                            Edit : and where are the logs ??

                            1 Reply Last reply Reply Quote 0
                            • stephenw10S
                              stephenw10 Netgate Administrator
                              last edited by

                              Ok! Now we're getting somewhere.

                              The server is at ovpn-20.shpv.fr on port 443 and you're connecting to port 1194.
                              It's also using TCP and you're connecting using UDP. So not surprisingly it's not responding!

                              You should use the host name there rather than the IP directly as you have in the earlier screenshot. That IP might change.

                              Correct those things on the client. Post a new screenshot of the client setup.
                              Re-test.

                              Steve

                              R 1 Reply Last reply Reply Quote 0
                              • GertjanG
                                Gertjan
                                last edited by Gertjan

                                I created a VPN client with the opvn file.

                                6f5412f9-3a46-4431-86e0-d4a2e602fa62-image.png

                                The connection is there.
                                Right now it blocks on :

                                9109807f-a531-4e0b-a4d7-e31612aad1ca-image.png

                                edit : @romantik70 : I completely deleted the config from my pfSense setup.
                                I advise to to remove the zip file you posted above - or at least 'destroy' the cert keys in it.

                                No "help me" PM's please. Use the forum, the community will thank you.
                                Edit : and where are the logs ??

                                1 Reply Last reply Reply Quote 1
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator
                                  last edited by

                                  Also they are setting compression to no

                                  comp-lzo no

                                  Looks like you didn't even look in the file at all.. Just clicked some random shit and wondering why not working.

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  GertjanG 1 Reply Last reply Reply Quote 0
                                  • GertjanG
                                    Gertjan @johnpoz
                                    last edited by

                                    @johnpoz :

                                    I should be ok :

                                    2984974e-32b2-424c-a415-3a2fff80f57c-image.png

                                    The opvn file ( /var/etc/openvpn/clientx.conf ) constructed mentions :

                                    0b0ab8e9-13ef-4dd8-aaf8-7446c709c446-image.png

                                    No "help me" PM's please. Use the forum, the community will thank you.
                                    Edit : and where are the logs ??

                                    1 Reply Last reply Reply Quote 0
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator
                                      last edited by johnpoz

                                      Exactly... And upon looking closer at his first posts... Looks like he tried to set it up as server vs a client?

                                      And he put the CA cert as a user cert, etc. etc..

                                      I also deleted the attached zip, so nobody else can grab it..

                                      Seems odd that that they would be running access server vs the community version... AS is for companies, its not all that cheap at 15$ per user per year to start with.. You would think they would just configure the community FREE version to maximize profit..

                                      At 24 € a user - the cost of the license $15 USD per year... Thats not much per year per user at all.. At current exchange they make like 10 bucks a year per user.. That has to pay for infrastructure and bandwidth as well... Not a very good cost model ;)

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                                      1 Reply Last reply Reply Quote 0
                                      • R
                                        romantik70 @stephenw10
                                        last edited by

                                        @stephenw10 did the cahnges you asked me to do but there is a host resolution issue so it' s bettere i pu the ip address instead of the hostname .
                                        openvpnlogs1.png
                                        i have tried to change the hostname in the ip address and i leave unchanged the otrher and the logs turned back to be what they are before as you can see , in the next pictured i have taken after changing. I am starting to be pissed off of this fucking pfsense.openvpnlogs2.png .
                                        I would like to make the last attempt after that i will think to abandone pfsense . My question is what do you use for your network , pfsense like me or onther solution.If you use pfsense would you please screeshot the setting you got on your pfsense so i do the same .

                                        GertjanG 1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator
                                          last edited by

                                          Ok I have your zip file - give me one sec...

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          1 Reply Last reply Reply Quote 0
                                          • GertjanG
                                            Gertjan @romantik70
                                            last edited by

                                            @romantik70 said in CONNECTION WITH REMOTE SERVER NOT ESTABLISHED BECAUSE OF A SERVER VERIFICATION METHOD ERROR:

                                            i will think to abandone pfsense

                                            Setting up an OPENVPN client on some other firewall/router will give you the same issues .... because the items to set will be identical ....

                                            c27b67c7-fc97-43c3-901d-88d15e01007f-image.png

                                            This means your pfSense has a broken DNS setup ....it can't resolve domain names.

                                            Check for yourself :

                                            e5f7a150-c19c-4882-be3c-c5d15e091bfe-image.png

                                            @romantik70 said in CONNECTION WITH REMOTE SERVER NOT ESTABLISHED BECAUSE OF A SERVER VERIFICATION METHOD ERROR:

                                            My question is what do you use for your network , pfsense like me or onther solution.If you use pfsense would you please screeshot the setting you got on your pfsense so i do the same .

                                            That could be hundreds of screens.
                                            Far more easier would be : reset pfSense to default.
                                            If needed, setup WAN.
                                            Check that your are connected to the Inter etc.
                                            DO NOT change anything else.

                                            And just to motivate you : setting up a VPN client to use a VPN server (that doesn't detail close to nothing about how to do so in your case) is difficult to do for someone who as experience with the issue. With no experiences it's close to impossible.
                                            Settings up a OpenVPN server (on pfSense) should be done first. Because you have a Phone with a Open VPN client app, so you can test things for yourself and see the logs on both sides (very important).
                                            This learning process is not something optional. It's needed - burning the learning steps a guarantee final outcome : it won't be a "Pass".

                                            Always go step by step.

                                            @johnpoz said in CONNECTION WITH REMOTE SERVER NOT ESTABLISHED BECAUSE OF A SERVER VERIFICATION METHOD ERROR:

                                            Ok I have your zip file - give me one sec...

                                            Optimist ^^ Give him one hour or so.
                                            (see my posts above ....)

                                            No "help me" PM's please. Use the forum, the community will thank you.
                                            Edit : and where are the logs ??

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.