Cannot Connect to VPN

[Udbytossen]

Hi Forum.
I have a little issue - that I cannot see my mistake somewhere:
I have setup my new XG7100-1U - and all internal networks works fine - but I do have an issue regarding OpenVPN

When testing my new Configuration - I Only used an internal IP - And I did not have any issues with connectin from my old existing LAN to the WAN IP of the Netgate

Now I configured and setup my PFsense - and every portforward etc are actually working as intended.
But When I'm testing my VPN - it will not connect to the PFsense.
My Laptop is connected through 3G Router - so I'm comming from a public IP. - and here is where something goes wrong.
My VPN server --> https://ibb.co/DKkbBQH ( When I testet this connection - it was working fine on internal LAN during the setup process.
In my OpenVPN GUI - I'm getting these log:

Sat Aug 10 08:53:15 2019 OpenVPN 2.4.7 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Apr 25 2019
Sat Aug 10 08:53:15 2019 Windows version 6.2 (Windows 8 or greater) 64bit
Sat Aug 10 08:53:15 2019 library versions: OpenSSL 1.1.0j  20 Nov 2018, LZO 2.10
Enter Management Password:
Sat Aug 10 08:53:16 2019 TCP/UDP: Preserving recently used remote address: [AF_INET]5.103.38.98:10094
Sat Aug 10 08:53:16 2019 UDP link local (bound): [AF_INET][undef]:1194
Sat Aug 10 08:53:16 2019 UDP link remote: [AF_INET]5.103.38.98:10094
Sat Aug 10 08:54:16 2019 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sat Aug 10 08:54:16 2019 TLS Error: TLS handshake failed
Sat Aug 10 08:54:16 2019 SIGUSR1[soft,tls-error] received, process restarting
Sat Aug 10 08:54:21 2019 TCP/UDP: Preserving recently used remote address: [AF_INET]5.103.38.98:10094
Sat Aug 10 08:54:21 2019 UDP link local (bound): [AF_INET][undef]:1194
Sat Aug 10 08:54:21 2019 UDP link remote: [AF_INET]5.103.38.98:10094
Sat Aug 10 08:55:21 2019 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sat Aug 10 08:55:21 2019 TLS Error: TLS handshake failed
Sat Aug 10 08:55:21 2019 SIGUSR1[soft,tls-error] received, process restarting
Sat Aug 10 08:55:26 2019 TCP/UDP: Preserving recently used remote address: [AF_INET]5.103.38.98:10094
Sat Aug 10 08:55:26 2019 UDP link local (bound): [AF_INET][undef]:1194
Sat Aug 10 08:55:26 2019 UDP link remote: [AF_INET]5.103.38.98:10094
Sat Aug 10 08:56:26 2019 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sat Aug 10 08:56:26 2019 TLS Error: TLS handshake failed
Sat Aug 10 08:56:26 2019 SIGUSR1[soft,tls-error] received, process restarting
Sat Aug 10 08:56:31 2019 TCP/UDP: Preserving recently used remote address: [AF_INET]5.103.38.98:10094
Sat Aug 10 08:56:31 2019 UDP link local (bound): [AF_INET][undef]:1194
Sat Aug 10 08:56:31 2019 UDP link remote: [AF_INET]5.103.38.98:10094

I've have deleted all Certificates and recreate those afterwards - to make sure nothing was wong with the certificates.
I've deleted and recreated the firewall rule --> https://ibb.co/V33WyRn
a little more detailed: https://ibb.co/tzh5Dc4

But cannot get connection through the VPN - and I cannot see where it goes wrong. My Service says its OK and up and running: https://ibb.co/yWJH4Kh

And my logfile from OpenVPN only shows:

Aug 10 08:58:48	openvpn	95626	MANAGEMENT: CMD 'quit'
Aug 10 08:58:48	openvpn	95626	MANAGEMENT: Client disconnected
Aug 10 08:58:48	openvpn	53719	MANAGEMENT: Client connected from /var/etc/openvpn/server2.sock
Aug 10 08:58:48	openvpn	53719	MANAGEMENT: CMD 'status 2'
Aug 10 08:58:48	openvpn	53719	MANAGEMENT: CMD 'quit'
Aug 10 08:58:48	openvpn	53719	MANAGEMENT: Client disconnected
Aug 10 08:58:52	openvpn	95626	tls-crypt unwrap error: packet authentication failed
Aug 10 08:58:52	openvpn	95626	TLS Error: tls-crypt unwrapping failed from [AF_INET]109.57.149.202:1194
Aug 10 08:59:00	openvpn	95626	tls-crypt unwrap error: packet authentication failed
Aug 10 08:59:00	openvpn	95626	TLS Error: tls-crypt unwrapping failed from [AF_INET]109.57.149.202:1194
Aug 10 08:59:16	openvpn	95626	tls-crypt unwrap error: packet authentication failed
Aug 10 08:59:16	openvpn	95626	TLS Error: tls-crypt unwrapping failed from [AF_INET]109.57.149.202:1194
Aug 10 08:59:49	openvpn	95626	MANAGEMENT: Client connected from /var/etc/openvpn/server1.sock
Aug 10 08:59:50	openvpn	95626	MANAGEMENT: CMD 'status 2'
Aug 10 08:59:50	openvpn	95626	MANAGEMENT: CMD 'quit'
Aug 10 08:59:50	openvpn	95626	MANAGEMENT: Client disconnected
Aug 10 08:59:50	openvpn	53719	MANAGEMENT: Client connected from /var/etc/openvpn/server2.sock
Aug 10 08:59:50	openvpn	53719	MANAGEMENT: CMD 'status 2'
Aug 10 08:59:50	openvpn	53719	MANAGEMENT: CMD 'quit'
Aug 10 08:59:50	openvpn	53719	MANAGEMENT: Client disconnected
Aug 10 09:00:52	openvpn	95626	MANAGEMENT: Client connected from /var/etc/openvpn/server1.sock
Aug 10 09:00:52	openvpn	95626	MANAGEMENT: CMD 'status 2'
Aug 10 09:00:52	openvpn	95626	MANAGEMENT: CMD 'quit'
Aug 10 09:00:52	openvpn	95626	MANAGEMENT: Client disconnected
Aug 10 09:00:52	openvpn	53719	MANAGEMENT: Client connected from /var/etc/openvpn/server2.sock
Aug 10 09:00:52	openvpn	53719	MANAGEMENT: CMD 'status 2'
Aug 10 09:00:52	openvpn	53719	MANAGEMENT: CMD 'quit'
Aug 10 09:00:52	openvpn	53719	MANAGEMENT: Client disconnected
Aug 10 09:01:54	openvpn	95626	MANAGEMENT: Client connected from /var/etc/openvpn/server1.sock
Aug 10 09:01:54	openvpn	95626	MANAGEMENT: CMD 'status 2'
Aug 10 09:01:54	openvpn	95626	MANAGEMENT: CMD 'quit'
Aug 10 09:01:54	openvpn	95626	MANAGEMENT: Client disconnected
Aug 10 09:01:54	openvpn	53719	MANAGEMENT: Client connected from /var/etc/openvpn/server2.sock
Aug 10 09:01:55	openvpn	53719	MANAGEMENT: CMD 'status 2'
Aug 10 09:01:55	openvpn	53719	MANAGEMENT: CMD 'quit'
Aug 10 09:01:55	openvpn	53719	MANAGEMENT: Client disconnected

My ovpn file looks like this:

dev tun
persist-tun
persist-key
cipher AES-256-CBC
ncp-disable
auth SHA512
tls-client
client
resolv-retry infinite
remote 5.103.38.98 10094 udp
verify-x509-name "OpenVPN Server" name
auth-user-pass Webmeup/auth.cfg
remote-cert-tls server
auth-nocache

My OpenVPN GUI is version 2.4.7-1607-Win10
Can anyone see I made a mistake somewhere - or could point me in the rigth direction

[kiokoman]

i can tell you that right now port 10094 is filtered, the port is blocked by firewall or other network obstacle or nothing is listening there

[johnpoz]

@Udbytossen said in Cannot Connect to VPN:

Aug 10 08:58:52 openvpn 95626 tls-crypt unwrap error: packet authentication failed

You have tls key mismatch or your settings for tls auth and encryption mismatch?

You didn't post up your server config.. so hard to tell for sure.

[Udbytossen]

Well - Found the error

For getting it working internal in test - I forced the Gateway on the VPN Server.
I removed this and everything is working now

[johnpoz]

@Udbytossen said in Cannot Connect to VPN:

TLS Error: tls-crypt unwrapping failed from [AF_INET]109.57.149.202:1194

Something hitting your box from that 109 address where the TLS didn't auth..

Your IP having a /29 mask doesn't have anything to do with listening on the correct address.

Also not sure why your having your clients source port be 1194?