CONNECTION WITH REMOTE SERVER NOT ESTABLISHED BECAUSE OF A SERVER VERIFICATION METHOD ERROR

romantik70 · Dec 15, 2019, 6:15 PM

Hello folk i am a pfsense newbie and i have bought a vpn with openvpn protocol by a french provider sgpv.fr , cheap one but in doesnt give much cupport on pfsense , so i am addressing this issue to you m hoping one of you will give me the answer i need to solve it. I cant establish the connection with the server after have installed all the certificates : ca , client cert and follwed the guide step by step but it ansewer me with sime errors in the system logs :
Dec 15 18:28:08 openvpn 9908 SIGUSR1[soft,ping-restart] received, process restarting
Dec 15 18:28:18 openvpn 9908 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Dec 15 18:28:18 openvpn 9908 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Dec 15 18:28:18 openvpn 9908 TCP/UDP: Preserving recently used remote address: [AF_INET]185.212.227.121:1194
Dec 15 18:28:18 openvpn 9908 UDPv4 link local (bound): [AF_INET]192.168.1.107:443
Dec 15 18:28:18 openvpn 9908 UDPv4 link remote: [AF_INET]185.212.227.121:1194
Dec 15 18:29:18 openvpn 9908 [UNDEF] Inactivity timeout (--ping-restart), restarting
can everyone of you tell me how to solve it and establish a connection with the remote server.!

THERE ARE SOME SCREENSHOTS PF THE CONFIGURATION OF MY PFSENSE APPLIANCE IF SOMEONE CAN HELP ME I WILL VERY GLAD.

1.png

kiokoman · Dec 15, 2019, 8:03 PM

aprire 3 discussioni uguali e scritte in maiuscolo non è proprio il massimo, magari cancella le altre.. se hai acquistato un servizio vpn dovrai configurare solo la parte client sul tuo pfsense, non la parte server visto che sono loro a fare da server.
lato client, 185.212.227.121 non ti risponde neanche.. oltre al fatto che sei dietro a un altro modem/router prima di pfsense (doppia nat) che dovresti verificare se fa passare il traffico per la vpn

romantik70 · Dec 15, 2019, 8:24 PM

This post is deleted!

romantik70 · Dec 15, 2019, 8:25 PM

Thank you for answering me even if the gentlness it's not the best side of you .... if the block letter bother you i dont care . i make it to underlight the post title. i am not beyond a modem because my modem is a simple one . you have probably missunderstood my question : i need to know how to solve ... the issue . that i am the client side of it i was slowing understand, thanks anyway man .The 3 times repeated post maybe it's simply an error.

kiokoman · Dec 16, 2019, 9:20 PM

yeah gg, i just politely told you to delete your 3 errors,nothing more. i already told you what's going on and what to check/what to do. if you are unable to understand that 192.168.1.107 is a local network and you are in a double NAT situation / that 185.212 is not aswering you and that the server stuff is totaly wrong maybe it's time for you to ask help from your local computer shop because as far as I'm concerned you are on you own from now on

stephenw10 · Dec 16, 2019, 12:11 AM

You seem to have configured an OpenVPN server in those first 3 screenshots. Remove the server config, you are trying to setup pfSense as a client.

In the client setup remove the local port setting. It should probably be random. It should definitely not be 443.
Is the remote server port supposed to be 443?

Set the correct client certificate there. Currently it's set to none but you uploaded a client cert.

Is that the correct algorithm? What instructions does the provider give?

Steve

Gertjan · Dec 16, 2019, 7:08 AM

@romantik70 said in CONNECTION WITH REMOTE SERVER NOT ESTABLISHED BECAUSE OF A SERVER VERIFICATION METHOD ERROR:

a french provider sgpv.fr , cheap one but in doesnt give much cupport on pfsense

That must be shpv.fr ....
True, no doc on there site - nothing.

They should have send you a ovpn file.
Something like this :

dev tun
tun-ipv6
persist-tun
persist-key
cipher AES-256-CBC
ncp-ciphers AES-256-GCM:AES-128-GCM
auth SHA256
tls-client
client
resolv-retry infinite
remote  ovpn-20.shpv.fr 1194 udp
setenv opt block-outside-dns
lport 0
verify-x509-name "ovpn-20.shpv.fr" name
remote-cert-tls server

<ca>
-----BEGIN CERTIFICATE-----
MIIEejCCA2KgAwIBAgIBADANBgkqhkiG9w0BAQsFADCBhTELMAkGA1UEBhMCRlIx
CzAJBgNVBAgTAkxHMQ8wDQYDVQQHEwZDdXpvcm4xEDAOBgNVBAoTB015IENvbXAx
....
1MfwfMdquqHOhL5g50oNQx2IPzEAxQYFN50ldEa2UISrFAT1XTEzt4WColWm6BVN
KTRaTO1TFK6r0vBduzLKT6+67L1d94R7PhDmxlo+iHFAxGQZ+0j47kNreXd+cpPA
31jwp8xl3G6sP5uzEgjDhpXsLJDWxA8+91hNB+SzRJIHO/KoUulIOW0yKDAzBg==
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
MIIFyzCCBLOgAwIBAgIBCDANBgkqhkiG9w0BAQsFADCBhTELMAkGA1UEBhMCRlIx
CzAJBgNVBAgTAkxHMQ8wDQYDVQQHEwZDdXpvcm4xEDAOBgNVBAoTB015IENvbXAx
.....
bPdyJELvVKb2R1KmSeIhZWD35DTXFXLFWjrqMNGEK9IS1BI0tKBe9d65AG6Wa4Fm
vprkfrgTJXzgpwn0IvQuKywX6SiTSsXNdKQguRlW6IXRRjYgSa/zzGRcGhM4Tbc=
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQCiCfugEqEwwYLt
WB30IU69/WyuNmie6u+8BuB/YqCrvaw+OE/k9CfBOPSnz6uTdhXzNuVsCEgohYx5
......
ofYH48jmh0k7phi7NIpUOX3p6p6lZzfAKwIcWL02sUsYl0Ksq/t4FcOxfjM5SMCs
1DUju9boXwK3W0iYaN840z458YshdVJswNBea+pXUrxThZAwignlF1D5X2APBgCj
+w1macvEpWG5bEVWLk+F15ynoBSdqWQ=
-----END PRIVATE KEY-----
</key>
<tls-crypt>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
893c76e84187bb1e40f987c83db4d256
....
ece32853d36402fe32c384500c0baa5d
d98ddda17568898ed19b75671bb24467
8c5a6102dc6ab3275c6fa36d8853b668
-----END OpenVPN Static key V1-----
</tls-crypt>

The <ca> .... </ca> has to be imported in the System > Certificate Manager > CAs : : click on "Add" and then select "Import an existing Certificate Authority" - Don't fille in the "Certificate Private Key (optional)", just the "Certificate data".
The <cert> .... </cert> and <key> ... </key> jhave to be imported into System Certificate Manager > Certificates : click on "Add" and then select "Import an existing Certificate"

Now create a OPVN client.
Over there, you'll be copy pasting the <tls-crypt>, also present in the ovpn file.
Most of the settings can be set directly, some ned to be set after trail-and-error testing.

Btw : it is highly advisable to choose a provider that gives details about how to set openvpn - as a client - on your side.
This often boils down to installing https://www.ovpn.com/en/guides/windows-openvpn-gui - and then 'import' the ovpn file your supplier gave you => done. Millions are using OpenVPN like that, we all need this app so we can connect from "home" to our company infrastructure a safe way.
I advise you strongly to test this first. Still the OpenVPN GUI client and connect it to your VPN provider.
Take note of the logs .... and when all works as aspected, try implementing aan openvpn client on pfSense.

Note : confirm that you want to connect your entire network to this VPN ...

romantik70 · Dec 16, 2019, 9:20 PM

@kiokoman man thank you for all … but your believes stay with you and keep them with you ….. dont answer any more to my topics it's not either the right way or the right tone to do it i will be on my own…. bye

stephenw10 · Dec 17, 2019, 3:27 AM

Hmm. He really did just ask you to post one thread, which is reasonable. I think there's just a misunderstanding here.

Steve

romantik70 · Dec 17, 2019, 1:44 PM

This post is deleted!

romantik70 · Dec 17, 2019, 1:51 PM

he is a red neck ....do you understand what is a red neck a peasant with peaseant behaviours that's it ....much thank to you guidance but still i havent solved the issue ...i will try again

Gertjan · Dec 17, 2019, 2:37 PM

As for the questions :
What did your receive from sgpv.fr ? is it really in reality shpv.fr ? A ovpn file ? Something else ?
What do they propose to actually use your connection ?

johnpoz · Dec 17, 2019, 5:54 PM

@romantik70 said in CONNECTION WITH REMOTE SERVER NOT ESTABLISHED BECAUSE OF A SERVER VERIFICATION METHOD ERROR:

WARNING: No server certificate verification method has been enabled.

That shouldn't stop you from connecting, that is just a warning..
I suggest you up your logging level to get more info on why exactly your not connecting

stephenw10 · Dec 17, 2019, 6:02 PM

What is you current OpenVPN client config after making those changes?

What is the provider asking for?

Steve

romantik70 · Dec 17, 2019, 10:02 PM

i am only certain about a thing : the vpn works becuse i have tried to connect an vm with the windows openvpn program . on that vm there is a server web and i have put an html page .Connecting to that web server's page through an other connection i can load correctly the web page , so i am sure that the vpn connection has no mulfunction.. What i cannot do is to make it work with pfsense , but i need it , because my network has multiple VMs , that need to share that public static ip address that the vpn offers to me. In the picture attached there is a schetch of my network . The first time i did it , almost 1 year ago with the same provider shpv.fr it worked.After a period of time they changed configuration and i got that error. i quitted the service for one year because they told me that they didnt give pfsense support , the same answer they have given now , afterall , and i didnt manage to use the service any more.i have searched other privider that provides similar services at the same cheap price but i havent been able to find one similar so i have decide to return with them , but the support is scarce , after all they are french . .

johnpoz · Dec 17, 2019, 10:29 PM

That drawing is pretty useless to be honest..

What is the ovpn file they gave you to connect with?

Going to state again that warning has is not the reason your failing to connect.. Its a warning that your not validating the server cert.. That is all... its not a failure reason..

I see the same error when I connect to my openvpn AS,

Dec 17 12:20:05 	openvpn 	94221 	WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.

Connects just fine...

Dec 17 12:20:11 	openvpn 	94221 	Initialization Sequence Completed
Dec 17 12:20:11 	openvpn 	94221 	WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Dec 17 12:20:06 	openvpn 	94221 	/usr/local/sbin/ovpn-linkup ovpnc3 1500 1553 172.27.240.11 255.255.240.0 init
Dec 17 12:20:06 	openvpn 	94221 	/sbin/route add -net 172.27.240.0 172.27.240.1 255.255.240.0
Dec 17 12:20:06 	openvpn 	94221 	/sbin/ifconfig ovpnc3 172.27.240.11 172.27.240.1 mtu 1500 netmask 255.255.240.0 up

romantik70 · Dec 17, 2019, 10:30 PM

whatever warnig or error it is the vpn it's not working i dont have the inner nat address it's a 172.etc.tct.etc address for translating tcp pockets inside my network . overall the vpn it's not working . and i cannot find the reason it isnt .

johnpoz · Dec 17, 2019, 10:32 PM

UP our log level in your client!! So you can see more detail.

If need be take it past 5 into the debug level..

romantik70 · Dec 17, 2019, 10:34 PM

@johnpoz i didnt draw it for any other reason to show my network i didnt meant to show it to you for explanatory reasons . however , if you see my last screenshot there sh ould be an ip address instead of that n/a. to the OPT interface .

johnpoz · Dec 17, 2019, 10:36 PM

Well our not going to get an IP if you don't connect, we can not see WHY your not connecting without up your log level to give us detail on the connection attempt that warning of not verify server cert has nothing to do with why the connection is failing.