CONNECTION WITH REMOTE SERVER NOT ESTABLISHED BECAUSE OF A SERVER VERIFICATION METHOD ERROR

johnpoz

UP our log level in your client!! So you can see more detail.

If need be take it past 5 into the debug level..

romantik70

@johnpoz i didnt draw it for any other reason to show my network i didnt meant to show it to you for explanatory reasons . however , if you see my last screenshot there sh vpn failure.png ould be an ip address instead of that n/a. to the OPT interface .

johnpoz

Well our not going to get an IP if you don't connect, we can not see WHY your not connecting without up your log level to give us detail on the connection attempt that warning of not verify server cert has nothing to do with why the connection is failing.

Pippin

Not providing asked info, no help...

romantik70

these are the logs it gives out when i try to connect man if you van help you are the best in the forum.

stephenw10

The client tries to connect and the other side does not respond at all. After 1 min it gives up and starts again.
Something there is completely mismatched.

We need to see the info the provider sent you to connect to. Not the password, cert etc.

And the current config in pfSense of the OpenVPN client.

Steve

romantik70

"zip removed by mod" here is the file they provided to me

Gertjan

Not related (edit : but will totally break everything) : Correct this :

stephenw10

Ok! Now we're getting somewhere.

The server is at ovpn-20.shpv.fr on port 443 and you're connecting to port 1194.
It's also using TCP and you're connecting using UDP. So not surprisingly it's not responding!

You should use the host name there rather than the IP directly as you have in the earlier screenshot. That IP might change.

Correct those things on the client. Post a new screenshot of the client setup.
Re-test.

Steve

Gertjan

I created a VPN client with the opvn file.

The connection is there.
Right now it blocks on :

edit : @romantik70 : I completely deleted the config from my pfSense setup.
I advise to to remove the zip file you posted above - or at least 'destroy' the cert keys in it.

johnpoz

Also they are setting compression to no

comp-lzo no

Looks like you didn't even look in the file at all.. Just clicked some random shit and wondering why not working.

Gertjan

@johnpoz :

I should be ok :

The opvn file ( /var/etc/openvpn/clientx.conf ) constructed mentions :

johnpoz

Exactly... And upon looking closer at his first posts... Looks like he tried to set it up as server vs a client?

And he put the CA cert as a user cert, etc. etc..

I also deleted the attached zip, so nobody else can grab it..

Seems odd that that they would be running access server vs the community version... AS is for companies, its not all that cheap at 15$ per user per year to start with.. You would think they would just configure the community FREE version to maximize profit..

At 24 € a user - the cost of the license $15 USD per year... Thats not much per year per user at all.. At current exchange they make like 10 bucks a year per user.. That has to pay for infrastructure and bandwidth as well... Not a very good cost model ;)

romantik70

@stephenw10 did the cahnges you asked me to do but there is a host resolution issue so it' s bettere i pu the ip address instead of the hostname .

i have tried to change the hostname in the ip address and i leave unchanged the otrher and the logs turned back to be what they are before as you can see , in the next pictured i have taken after changing. I am starting to be pissed off of this fucking pfsense. .
I would like to make the last attempt after that i will think to abandone pfsense . My question is what do you use for your network , pfsense like me or onther solution.If you use pfsense would you please screeshot the setting you got on your pfsense so i do the same .

johnpoz

Ok I have your zip file - give me one sec...

Gertjan

@romantik70 said in CONNECTION WITH REMOTE SERVER NOT ESTABLISHED BECAUSE OF A SERVER VERIFICATION METHOD ERROR:

i will think to abandone pfsense

Setting up an OPENVPN client on some other firewall/router will give you the same issues .... because the items to set will be identical ....

This means your pfSense has a broken DNS setup ....it can't resolve domain names.

Check for yourself :

@romantik70 said in CONNECTION WITH REMOTE SERVER NOT ESTABLISHED BECAUSE OF A SERVER VERIFICATION METHOD ERROR:

My question is what do you use for your network , pfsense like me or onther solution.If you use pfsense would you please screeshot the setting you got on your pfsense so i do the same .

That could be hundreds of screens.
Far more easier would be : reset pfSense to default.
If needed, setup WAN.
Check that your are connected to the Inter etc.
DO NOT change anything else.

And just to motivate you : setting up a VPN client to use a VPN server (that doesn't detail close to nothing about how to do so in your case) is difficult to do for someone who as experience with the issue. With no experiences it's close to impossible.
Settings up a OpenVPN server (on pfSense) should be done first. Because you have a Phone with a Open VPN client app, so you can test things for yourself and see the logs on both sides (very important).
This learning process is not something optional. It's needed - burning the learning steps a guarantee final outcome : it won't be a "Pass".

Always go step by step.

@johnpoz said in CONNECTION WITH REMOTE SERVER NOT ESTABLISHED BECAUSE OF A SERVER VERIFICATION METHOD ERROR:

Ok I have your zip file - give me one sec...

Optimist ^^ Give him one hour or so.
(see my posts above ....)

johnpoz

Ok that guy is NOT answering on port 443...

Maybe he blocks me because from US and not France? But there is NO answer back to that that host IP on 443...

So no you would not be able to connect.... But you have to setup your client correctly...

Lets see the log from when you use that opvn file to connect from your client...

From that file

proto tcp
remote ovpn-20.shpv.fr
port 443

And there is ZERO reply back from that host on 443, no RST, no syn,ack - nothing... So no it would not be possible to connect a vpn..

Show us your clients log when you run it on say windows.

I imported that ovpn file into my vpn client on my windows machine - and NO answer.. Maybe he doesn't like US IP address?? Didn't mention that when you did that it worked - if so lets see the log of that connection.

Gertjan

@johnpoz : see my last image above.
I could connect ..... calling from France, true.

Btw : using
proto tcp
remote ovpn-20.shpv.fr
port 443

johnpoz

I don't see an answer back - and looks like you forgot to put in the tls key?

Let me see your sniff where you get a response - just import that ovpn into a client openvpn on a windows/linux box - so we can see the full log of client connecting..

edit... Now the client is connecting

Thu Dec 19 17:40:19 2019 Initialization Sequence Completed
Thu Dec 19 17:40:19 2019 Register_dns request sent to the service
Thu Dec 19 17:40:19 2019 MANAGEMENT: >STATE:1576798819,CONNECTED,SUCCESS,172.27.224.11,185.212.227.121,443,192.168.9.100,64601

Give me a sec to move it back into pfsense.

edit: Ok connected just fine using his ovpn file transposed to pfsense client.

edit2: settings

edit3: Ok created interface and setup outbound nat - and now routing traffic through it

edit4: Disconnect and back to my normal wan IP

Gertjan

Nice !
The only difference (your screen and mine) I can see : Auth digest algorithm : You set to SHA1, I had SHA256.

I'm pretty sure I saw a

auth SHA256

in his opvn file.