CONNECTION WITH REMOTE SERVER NOT ESTABLISHED BECAUSE OF A SERVER VERIFICATION METHOD ERROR
-
Hello folk i am a pfsense newbie and i have bought a vpn with openvpn protocol by a french provider sgpv.fr , cheap one but in doesnt give much cupport on pfsense , so i am addressing this issue to you m hoping one of you will give me the answer i need to solve it. I cant establish the connection with the server after have installed all the certificates : ca , client cert and follwed the guide step by step but it ansewer me with sime errors in the system logs :
Dec 15 18:28:08 openvpn 9908 SIGUSR1[soft,ping-restart] received, process restarting
Dec 15 18:28:18 openvpn 9908 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Dec 15 18:28:18 openvpn 9908 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Dec 15 18:28:18 openvpn 9908 TCP/UDP: Preserving recently used remote address: [AF_INET]185.212.227.121:1194
Dec 15 18:28:18 openvpn 9908 UDPv4 link local (bound): [AF_INET]192.168.1.107:443
Dec 15 18:28:18 openvpn 9908 UDPv4 link remote: [AF_INET]185.212.227.121:1194
Dec 15 18:29:18 openvpn 9908 [UNDEF] Inactivity timeout (--ping-restart), restarting
can everyone of you tell me how to solve it and establish a connection with the remote server.!THERE ARE SOME SCREENSHOTS PF THE CONFIGURATION OF MY PFSENSE APPLIANCE IF SOMEONE CAN HELP ME I WILL VERY GLAD.
-
aprire 3 discussioni uguali e scritte in maiuscolo non è proprio il massimo, magari cancella le altre.. se hai acquistato un servizio vpn dovrai configurare solo la parte client sul tuo pfsense, non la parte server visto che sono loro a fare da server.
lato client, 185.212.227.121 non ti risponde neanche.. oltre al fatto che sei dietro a un altro modem/router prima di pfsense (doppia nat) che dovresti verificare se fa passare il traffico per la vpn
-
This post is deleted!
-
Thank you for answering me even if the gentlness it's not the best side of you .... if the block letter bother you i dont care . i make it to underlight the post title. i am not beyond a modem because my modem is a simple one . you have probably missunderstood my question : i need to know how to solve ... the issue . that i am the client side of it i was slowing understand, thanks anyway man .The 3 times repeated post maybe it's simply an error.
-
yeah gg, i just politely told you to delete your 3 errors,nothing more. i already told you what's going on and what to check/what to do. if you are unable to understand that 192.168.1.107 is a local network and you are in a double NAT situation / that 185.212 is not aswering you and that the server stuff is totaly wrong maybe it's time for you to ask help from your local computer shop because as far as I'm concerned you are on you own from now on
-
You seem to have configured an OpenVPN server in those first 3 screenshots. Remove the server config, you are trying to setup pfSense as a client.
In the client setup remove the local port setting. It should probably be random. It should definitely not be 443.
Is the remote server port supposed to be 443?Set the correct client certificate there. Currently it's set to none but you uploaded a client cert.
Is that the correct algorithm? What instructions does the provider give?
Steve
-
@romantik70 said in CONNECTION WITH REMOTE SERVER NOT ESTABLISHED BECAUSE OF A SERVER VERIFICATION METHOD ERROR:
a french provider sgpv.fr , cheap one but in doesnt give much cupport on pfsense
That must be shpv.fr ....
True, no doc on there site - nothing.They should have send you a ovpn file.
Something like this :dev tun tun-ipv6 persist-tun persist-key cipher AES-256-CBC ncp-ciphers AES-256-GCM:AES-128-GCM auth SHA256 tls-client client resolv-retry infinite remote ovpn-20.shpv.fr 1194 udp setenv opt block-outside-dns lport 0 verify-x509-name "ovpn-20.shpv.fr" name remote-cert-tls server <ca> -----BEGIN CERTIFICATE----- MIIEejCCA2KgAwIBAgIBADANBgkqhkiG9w0BAQsFADCBhTELMAkGA1UEBhMCRlIx CzAJBgNVBAgTAkxHMQ8wDQYDVQQHEwZDdXpvcm4xEDAOBgNVBAoTB015IENvbXAx .... 1MfwfMdquqHOhL5g50oNQx2IPzEAxQYFN50ldEa2UISrFAT1XTEzt4WColWm6BVN KTRaTO1TFK6r0vBduzLKT6+67L1d94R7PhDmxlo+iHFAxGQZ+0j47kNreXd+cpPA 31jwp8xl3G6sP5uzEgjDhpXsLJDWxA8+91hNB+SzRJIHO/KoUulIOW0yKDAzBg== -----END CERTIFICATE----- </ca> <cert> -----BEGIN CERTIFICATE----- MIIFyzCCBLOgAwIBAgIBCDANBgkqhkiG9w0BAQsFADCBhTELMAkGA1UEBhMCRlIx CzAJBgNVBAgTAkxHMQ8wDQYDVQQHEwZDdXpvcm4xEDAOBgNVBAoTB015IENvbXAx ..... bPdyJELvVKb2R1KmSeIhZWD35DTXFXLFWjrqMNGEK9IS1BI0tKBe9d65AG6Wa4Fm vprkfrgTJXzgpwn0IvQuKywX6SiTSsXNdKQguRlW6IXRRjYgSa/zzGRcGhM4Tbc= -----END CERTIFICATE----- </cert> <key> -----BEGIN PRIVATE KEY----- MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQCiCfugEqEwwYLt WB30IU69/WyuNmie6u+8BuB/YqCrvaw+OE/k9CfBOPSnz6uTdhXzNuVsCEgohYx5 ...... ofYH48jmh0k7phi7NIpUOX3p6p6lZzfAKwIcWL02sUsYl0Ksq/t4FcOxfjM5SMCs 1DUju9boXwK3W0iYaN840z458YshdVJswNBea+pXUrxThZAwignlF1D5X2APBgCj +w1macvEpWG5bEVWLk+F15ynoBSdqWQ= -----END PRIVATE KEY----- </key> <tls-crypt> # # 2048 bit OpenVPN static key # -----BEGIN OpenVPN Static key V1----- 893c76e84187bb1e40f987c83db4d256 .... ece32853d36402fe32c384500c0baa5d d98ddda17568898ed19b75671bb24467 8c5a6102dc6ab3275c6fa36d8853b668 -----END OpenVPN Static key V1----- </tls-crypt>The <ca> .... </ca> has to be imported in the System > Certificate Manager > CAs : : click on "Add" and then select "Import an existing Certificate Authority" - Don't fille in the "Certificate Private Key (optional)", just the "Certificate data".
The <cert> .... </cert> and <key> ... </key> jhave to be imported into System Certificate Manager > Certificates : click on "Add" and then select "Import an existing Certificate"Now create a OPVN client.
Over there, you'll be copy pasting the <tls-crypt>, also present in the ovpn file.
Most of the settings can be set directly, some ned to be set after trail-and-error testing.Btw : it is highly advisable to choose a provider that gives details about how to set openvpn - as a client - on your side.
This often boils down to installing https://www.ovpn.com/en/guides/windows-openvpn-gui - and then 'import' the ovpn file your supplier gave you => done. Millions are using OpenVPN like that, we all need this app so we can connect from "home" to our company infrastructure a safe way.
I advise you strongly to test this first. Still the OpenVPN GUI client and connect it to your VPN provider.
Take note of the logs .... and when all works as aspected, try implementing aan openvpn client on pfSense.Note : confirm that you want to connect your entire network to this VPN ...
-
@kiokoman man thank you for all … but your believes stay with you and keep them with you ….. dont answer any more to my topics it's not either the right way or the right tone to do it i will be on my own…. bye
-
Hmm. He really did just ask you to post one thread, which is reasonable. I think there's just a misunderstanding here.
Steve
-
This post is deleted!
-
he is a red neck ....do you understand what is a red neck a peasant with peaseant behaviours that's it ....much thank to you guidance but still i havent solved the issue ...i will try again
-
As for the questions :
What did your receive from sgpv.fr ? is it really in reality shpv.fr ? A ovpn file ? Something else ?
What do they propose to actually use your connection ?
-
@romantik70 said in CONNECTION WITH REMOTE SERVER NOT ESTABLISHED BECAUSE OF A SERVER VERIFICATION METHOD ERROR:
WARNING: No server certificate verification method has been enabled.
That shouldn't stop you from connecting, that is just a warning..
I suggest you up your logging level to get more info on why exactly your not connecting
-
What is you current OpenVPN client config after making those changes?
What is the provider asking for?
Steve
-
i am only certain about a thing : the vpn works becuse i have tried to connect an vm with the windows openvpn program . on that vm there is a server web and i have put an html page .Connecting to that web server's page through an other connection i can load correctly the web page , so i am sure that the vpn connection has no mulfunction.. What i cannot do is to make it work with pfsense , but i need it , because my network has multiple VMs , that need to share that public static ip address that the vpn offers to me. In the picture attached there is a schetch of my network . The first time i did it , almost 1 year ago with the same provider shpv.fr it worked.After a period of time they changed configuration and i got that error. i quitted the service for one year because they told me that they didnt give pfsense support , the same answer they have given now , afterall , and i didnt manage to use the service any more.i have searched other privider that provides similar services at the same cheap price but i havent been able to find one similar so i have decide to return with them , but the support is scarce , after all they are french .
.
-
That drawing is pretty useless to be honest..
What is the ovpn file they gave you to connect with?
Going to state again that warning has is not the reason your failing to connect.. Its a warning that your not validating the server cert.. That is all... its not a failure reason..
I see the same error when I connect to my openvpn AS,
Dec 17 12:20:05 openvpn 94221 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.Connects just fine...
Dec 17 12:20:11 openvpn 94221 Initialization Sequence Completed Dec 17 12:20:11 openvpn 94221 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this Dec 17 12:20:06 openvpn 94221 /usr/local/sbin/ovpn-linkup ovpnc3 1500 1553 172.27.240.11 255.255.240.0 init Dec 17 12:20:06 openvpn 94221 /sbin/route add -net 172.27.240.0 172.27.240.1 255.255.240.0 Dec 17 12:20:06 openvpn 94221 /sbin/ifconfig ovpnc3 172.27.240.11 172.27.240.1 mtu 1500 netmask 255.255.240.0 up
-
whatever warnig or error it is the vpn it's not working i dont have the inner nat address it's a 172.etc.tct.etc address for translating tcp pockets inside my network . overall the vpn it's not working . and i cannot find the reason it isnt .
-
UP our log level in your client!! So you can see more detail.
If need be take it past 5 into the debug level..
-
@johnpoz i didnt draw it for any other reason to show my network i didnt meant to show it to you for explanatory reasons . however , if you see my last screenshot there sh
ould be an ip address instead of that n/a. to the OPT interface .
-
Well our not going to get an IP if you don't connect, we can not see WHY your not connecting without up your log level to give us detail on the connection attempt that warning of not verify server cert has nothing to do with why the connection is failing.
-
Not providing asked info, no help...
-
these are the logs it gives out when i try to connect man if you van help you are the best in the forum.
-
The client tries to connect and the other side does not respond at all. After 1 min it gives up and starts again.
Something there is completely mismatched.We need to see the info the provider sent you to connect to. Not the password, cert etc.
And the current config in pfSense of the OpenVPN client.
Steve
-
"zip removed by mod" here is the file they provided to me
-
Not related (edit : but will totally break everything) : Correct this :
-
Ok! Now we're getting somewhere.
The server is at ovpn-20.shpv.fr on port 443 and you're connecting to port 1194.
It's also using TCP and you're connecting using UDP. So not surprisingly it's not responding!You should use the host name there rather than the IP directly as you have in the earlier screenshot. That IP might change.
Correct those things on the client. Post a new screenshot of the client setup.
Re-test.Steve
-
I created a VPN client with the opvn file.
The connection is there.
Right now it blocks on :
edit : @romantik70 : I completely deleted the config from my pfSense setup.
I advise to to remove the zip file you posted above - or at least 'destroy' the cert keys in it.
-
Also they are setting compression to no
comp-lzo no
Looks like you didn't even look in the file at all.. Just clicked some random shit and wondering why not working.
-
-
Exactly... And upon looking closer at his first posts... Looks like he tried to set it up as server vs a client?
And he put the CA cert as a user cert, etc. etc..
I also deleted the attached zip, so nobody else can grab it..
Seems odd that that they would be running access server vs the community version... AS is for companies, its not all that cheap at 15$ per user per year to start with.. You would think they would just configure the community FREE version to maximize profit..
At 24 € a user - the cost of the license $15 USD per year... Thats not much per year per user at all.. At current exchange they make like 10 bucks a year per user.. That has to pay for infrastructure and bandwidth as well... Not a very good cost model ;)
-
@stephenw10 did the cahnges you asked me to do but there is a host resolution issue so it' s bettere i pu the ip address instead of the hostname .
i have tried to change the hostname in the ip address and i leave unchanged the otrher and the logs turned back to be what they are before as you can see , in the next pictured i have taken after changing. I am starting to be pissed off of this fucking pfsense.
.
I would like to make the last attempt after that i will think to abandone pfsense . My question is what do you use for your network , pfsense like me or onther solution.If you use pfsense would you please screeshot the setting you got on your pfsense so i do the same .
-
Ok I have your zip file - give me one sec...
-
@romantik70 said in CONNECTION WITH REMOTE SERVER NOT ESTABLISHED BECAUSE OF A SERVER VERIFICATION METHOD ERROR:
i will think to abandone pfsense
Setting up an OPENVPN client on some other firewall/router will give you the same issues .... because the items to set will be identical ....
This means your pfSense has a broken DNS setup ....it can't resolve domain names.
Check for yourself :
@romantik70 said in CONNECTION WITH REMOTE SERVER NOT ESTABLISHED BECAUSE OF A SERVER VERIFICATION METHOD ERROR:
My question is what do you use for your network , pfsense like me or onther solution.If you use pfsense would you please screeshot the setting you got on your pfsense so i do the same .
That could be hundreds of screens.
Far more easier would be : reset pfSense to default.
If needed, setup WAN.
Check that your are connected to the Inter etc.
DO NOT change anything else.And just to motivate you : setting up a VPN client to use a VPN server (that doesn't detail close to nothing about how to do so in your case) is difficult to do for someone who as experience with the issue. With no experiences it's close to impossible.
Settings up a OpenVPN server (on pfSense) should be done first. Because you have a Phone with a Open VPN client app, so you can test things for yourself and see the logs on both sides (very important).
This learning process is not something optional. It's needed - burning the learning steps a guarantee final outcome : it won't be a "Pass".Always go step by step.
@johnpoz said in CONNECTION WITH REMOTE SERVER NOT ESTABLISHED BECAUSE OF A SERVER VERIFICATION METHOD ERROR:
Ok I have your zip file - give me one sec...
Optimist ^^ Give him one hour or so.
(see my posts above ....)
-
Ok that guy is NOT answering on port 443...
Maybe he blocks me because from US and not France? But there is NO answer back to that that host IP on 443...
So no you would not be able to connect.... But you have to setup your client correctly...
Lets see the log from when you use that opvn file to connect from your client...
From that file
proto tcp remote ovpn-20.shpv.fr port 443And there is ZERO reply back from that host on 443, no RST, no syn,ack - nothing... So no it would not be possible to connect a vpn..
Show us your clients log when you run it on say windows.
I imported that ovpn file into my vpn client on my windows machine - and NO answer.. Maybe he doesn't like US IP address?? Didn't mention that when you did that it worked - if so lets see the log of that connection.
-
@johnpoz : see my last image above.
I could connect ..... calling from France, true.Btw : using
proto tcp
remote ovpn-20.shpv.fr
port 443
-
I don't see an answer back - and looks like you forgot to put in the tls key?
Let me see your sniff where you get a response - just import that ovpn into a client openvpn on a windows/linux box - so we can see the full log of client connecting..
edit... Now the client is connecting
Thu Dec 19 17:40:19 2019 Initialization Sequence Completed Thu Dec 19 17:40:19 2019 Register_dns request sent to the service Thu Dec 19 17:40:19 2019 MANAGEMENT: >STATE:1576798819,CONNECTED,SUCCESS,172.27.224.11,185.212.227.121,443,192.168.9.100,64601Give me a sec to move it back into pfsense.
edit: Ok connected just fine using his ovpn file transposed to pfsense client.
edit2: settings
edit3: Ok created interface and setup outbound nat - and now routing traffic through it
edit4: Disconnect and back to my normal wan IP
-
Nice !
The only difference (your screen and mine) I can see : Auth digest algorithm : You set to SHA1, I had SHA256.I'm pretty sure I saw a
auth SHA256in his opvn file.
-
nope didn't see that... So it default to old default of sha1, not the best setting these days...
But clearly as you can see works just fine with pfsense - just have to take the settings correctly from the ovpn file and put them in the gui... What would be really slick as shit is if there was an importer ;) Someone should really code that ;) I don't have any use for it - but could save many users headaches to be sure..
Maybe you caught this
## -----BEGIN RSA SIGNATURE----- ## DIGEST:sha256But that is not part of the config.
edit: I think they must of been having issues before, since it wasn't connecting before at all..
edit2: I would prob make sure not to pull routes and just policy route - was in a hurry so didn't pay much mind.. Its all disabled currently but will leave it ready to go until OP says he has it working ;)
-
@johnpoz i didnt forget to put tls key as you can see by screenshot . tried to make all the changes you tell me to do , but anfortunately there is no changes. i have noted and i dony know why oy happens that when i put the entire host ovpn-20.shpv.fr it always answer me that it is not able to resolve the host , error that i dont get when i put the ip address . it 's an hard hard issue to solve ....i can say yoy that the first time a collugue if mine....just an america man from texas Mattew ( i worked in the nato base here in naples , where i knew him . i am a solder from the italian army ....he made me discover pfsense cause i didnt know it at all ) the vpn worked .After one year they made some setting changes and after that changes the vpns finished working ,When i asked support for it they only could answer that dey didnt support pfsense.I say business is business , do you care i take the subscription help me solve this fucking issue , but french are french no way of changhing their mind.An other clue that their mind are insane is that they give an internationak service and they have web pages written only in french language , strange guys , strange guys they are. I want to tell you a funny story on french guys when last stayed to Kobul for duty wit the NATO .I went twice in Kobul first time with germans , second with french , would you aspect that germans are more confortable and funny then french , i wouldnt.When you stay in the base , at night we arrange parties , there sheltered places in the base , where we make parties , we drink , what to do , when you go outside in patrol you are fortunate if you get back.They even invited a ferman rock band to celebrate di OKTOBER FEST , what a day man i got drunk as a monkey , we say here in italy.When , came french everything changed .The suddnly , built a little Effel Tower before the bar where all soldiers went to relax. The even made stupid private partie , no private parties with germans , you could access to whatever fuckuing party they did. A collegue of mine , an american wanted to access a party they was helding , and the french guy said him : it's a french private party , you are american you cannot get in. The american answered : you should appriciate my presense in the party man, because it is thanks to me that you speak french , you would have spoken germans . hahhahahahah that's true no graditude.
-
Lets see your full page... of settings of your client, like I posted.
seems like you put a colon in your hostname:443 vs just the hostname??
from a client or pfsense resolve just the name?
$ dig ovpn-20.shpv.fr ; <<>> DiG 9.14.7 <<>> ovpn-20.shpv.fr ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 16646 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;ovpn-20.shpv.fr. IN A ;; ANSWER SECTION: ovpn-20.shpv.fr. 4734 IN A 185.212.227.121 ;; Query time: 2 msec ;; SERVER: 192.168.3.10#53(192.168.3.10) ;; WHEN: Thu Dec 19 21:31:17 Central Standard Time 2019 ;; MSG SIZE rcvd: 60I see from your settings you have auth and encryption... I doubt they are allowing for that, you notice I am just using auth..
Why are you putting in something for username and password? You do not need that!!!
