Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    CONNECTION WITH REMOTE SERVER NOT ESTABLISHED BECAUSE OF A SERVER VERIFICATION METHOD ERROR

    Scheduled Pinned Locked Moved OpenVPN
    45 Posts 6 Posters 4.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R
      romantik70
      last edited by

      these are the logs it gives out when i try to connect man if you van help you are the best in the forum.logs.png

      1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        The client tries to connect and the other side does not respond at all. After 1 min it gives up and starts again.
        Something there is completely mismatched.

        We need to see the info the provider sent you to connect to. Not the password, cert etc.

        And the current config in pfSense of the OpenVPN client.

        Steve

        1 Reply Last reply Reply Quote 0
        • R
          romantik70
          last edited by johnpoz

          "zip removed by mod" here is the file they provided to me

          1 Reply Last reply Reply Quote 0
          • GertjanG
            Gertjan
            last edited by Gertjan

            Not related (edit : but will totally break everything) : Correct this :

            17de2e7a-98f8-4a27-a2b4-8c05a421f0b0-image.png

            No "help me" PM's please. Use the forum, the community will thank you.
            Edit : and where are the logs ??

            1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              Ok! Now we're getting somewhere.

              The server is at ovpn-20.shpv.fr on port 443 and you're connecting to port 1194.
              It's also using TCP and you're connecting using UDP. So not surprisingly it's not responding!

              You should use the host name there rather than the IP directly as you have in the earlier screenshot. That IP might change.

              Correct those things on the client. Post a new screenshot of the client setup.
              Re-test.

              Steve

              R 1 Reply Last reply Reply Quote 0
              • GertjanG
                Gertjan
                last edited by Gertjan

                I created a VPN client with the opvn file.

                6f5412f9-3a46-4431-86e0-d4a2e602fa62-image.png

                The connection is there.
                Right now it blocks on :

                9109807f-a531-4e0b-a4d7-e31612aad1ca-image.png

                edit : @romantik70 : I completely deleted the config from my pfSense setup.
                I advise to to remove the zip file you posted above - or at least 'destroy' the cert keys in it.

                No "help me" PM's please. Use the forum, the community will thank you.
                Edit : and where are the logs ??

                1 Reply Last reply Reply Quote 1
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator
                  last edited by

                  Also they are setting compression to no

                  comp-lzo no

                  Looks like you didn't even look in the file at all.. Just clicked some random shit and wondering why not working.

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  GertjanG 1 Reply Last reply Reply Quote 0
                  • GertjanG
                    Gertjan @johnpoz
                    last edited by

                    @johnpoz :

                    I should be ok :

                    2984974e-32b2-424c-a415-3a2fff80f57c-image.png

                    The opvn file ( /var/etc/openvpn/clientx.conf ) constructed mentions :

                    0b0ab8e9-13ef-4dd8-aaf8-7446c709c446-image.png

                    No "help me" PM's please. Use the forum, the community will thank you.
                    Edit : and where are the logs ??

                    1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by johnpoz

                      Exactly... And upon looking closer at his first posts... Looks like he tried to set it up as server vs a client?

                      And he put the CA cert as a user cert, etc. etc..

                      I also deleted the attached zip, so nobody else can grab it..

                      Seems odd that that they would be running access server vs the community version... AS is for companies, its not all that cheap at 15$ per user per year to start with.. You would think they would just configure the community FREE version to maximize profit..

                      At 24 € a user - the cost of the license $15 USD per year... Thats not much per year per user at all.. At current exchange they make like 10 bucks a year per user.. That has to pay for infrastructure and bandwidth as well... Not a very good cost model ;)

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      1 Reply Last reply Reply Quote 0
                      • R
                        romantik70 @stephenw10
                        last edited by

                        @stephenw10 did the cahnges you asked me to do but there is a host resolution issue so it' s bettere i pu the ip address instead of the hostname .
                        openvpnlogs1.png
                        i have tried to change the hostname in the ip address and i leave unchanged the otrher and the logs turned back to be what they are before as you can see , in the next pictured i have taken after changing. I am starting to be pissed off of this fucking pfsense.openvpnlogs2.png .
                        I would like to make the last attempt after that i will think to abandone pfsense . My question is what do you use for your network , pfsense like me or onther solution.If you use pfsense would you please screeshot the setting you got on your pfsense so i do the same .

                        GertjanG 1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by

                          Ok I have your zip file - give me one sec...

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          1 Reply Last reply Reply Quote 0
                          • GertjanG
                            Gertjan @romantik70
                            last edited by

                            @romantik70 said in CONNECTION WITH REMOTE SERVER NOT ESTABLISHED BECAUSE OF A SERVER VERIFICATION METHOD ERROR:

                            i will think to abandone pfsense

                            Setting up an OPENVPN client on some other firewall/router will give you the same issues .... because the items to set will be identical ....

                            c27b67c7-fc97-43c3-901d-88d15e01007f-image.png

                            This means your pfSense has a broken DNS setup ....it can't resolve domain names.

                            Check for yourself :

                            e5f7a150-c19c-4882-be3c-c5d15e091bfe-image.png

                            @romantik70 said in CONNECTION WITH REMOTE SERVER NOT ESTABLISHED BECAUSE OF A SERVER VERIFICATION METHOD ERROR:

                            My question is what do you use for your network , pfsense like me or onther solution.If you use pfsense would you please screeshot the setting you got on your pfsense so i do the same .

                            That could be hundreds of screens.
                            Far more easier would be : reset pfSense to default.
                            If needed, setup WAN.
                            Check that your are connected to the Inter etc.
                            DO NOT change anything else.

                            And just to motivate you : setting up a VPN client to use a VPN server (that doesn't detail close to nothing about how to do so in your case) is difficult to do for someone who as experience with the issue. With no experiences it's close to impossible.
                            Settings up a OpenVPN server (on pfSense) should be done first. Because you have a Phone with a Open VPN client app, so you can test things for yourself and see the logs on both sides (very important).
                            This learning process is not something optional. It's needed - burning the learning steps a guarantee final outcome : it won't be a "Pass".

                            Always go step by step.

                            @johnpoz said in CONNECTION WITH REMOTE SERVER NOT ESTABLISHED BECAUSE OF A SERVER VERIFICATION METHOD ERROR:

                            Ok I have your zip file - give me one sec...

                            Optimist ^^ Give him one hour or so.
                            (see my posts above ....)

                            No "help me" PM's please. Use the forum, the community will thank you.
                            Edit : and where are the logs ??

                            1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator
                              last edited by johnpoz

                              Ok that guy is NOT answering on port 443...

                              Maybe he blocks me because from US and not France? But there is NO answer back to that that host IP on 443...

                              noanswer.png

                              So no you would not be able to connect.... But you have to setup your client correctly...

                              Lets see the log from when you use that opvn file to connect from your client...

                              From that file

                              proto tcp
                              remote ovpn-20.shpv.fr
                              port 443
                              

                              And there is ZERO reply back from that host on 443, no RST, no syn,ack - nothing... So no it would not be possible to connect a vpn..

                              Show us your clients log when you run it on say windows.

                              I imported that ovpn file into my vpn client on my windows machine - and NO answer.. Maybe he doesn't like US IP address?? Didn't mention that when you did that it worked - if so lets see the log of that connection.

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              1 Reply Last reply Reply Quote 0
                              • GertjanG
                                Gertjan
                                last edited by

                                @johnpoz : see my last image above.
                                I could connect ..... calling from France, true.

                                Btw : using
                                proto tcp
                                remote ovpn-20.shpv.fr
                                port 443

                                No "help me" PM's please. Use the forum, the community will thank you.
                                Edit : and where are the logs ??

                                1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator
                                  last edited by johnpoz

                                  I don't see an answer back - and looks like you forgot to put in the tls key?

                                  Let me see your sniff where you get a response - just import that ovpn into a client openvpn on a windows/linux box - so we can see the full log of client connecting..

                                  edit... Now the client is connecting

                                  Thu Dec 19 17:40:19 2019 Initialization Sequence Completed
                                  Thu Dec 19 17:40:19 2019 Register_dns request sent to the service
                                  Thu Dec 19 17:40:19 2019 MANAGEMENT: >STATE:1576798819,CONNECTED,SUCCESS,172.27.224.11,185.212.227.121,443,192.168.9.100,64601
                                  

                                  Give me a sec to move it back into pfsense.

                                  edit: Ok connected just fine using his ovpn file transposed to pfsense client.

                                  connected.jpg

                                  edit2: settings
                                  settings.jpg

                                  edit3: Ok created interface and setup outbound nat - and now routing traffic through it

                                  usingit.jpg

                                  edit4: Disconnect and back to my normal wan IP
                                  disconnect.jpg

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  R 1 Reply Last reply Reply Quote 0
                                  • GertjanG
                                    Gertjan
                                    last edited by Gertjan

                                    Nice !
                                    The only difference (your screen and mine) I can see : Auth digest algorithm : You set to SHA1, I had SHA256.

                                    I'm pretty sure I saw a

                                    auth SHA256
                                    

                                    in his opvn file.

                                    No "help me" PM's please. Use the forum, the community will thank you.
                                    Edit : and where are the logs ??

                                    1 Reply Last reply Reply Quote 0
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator
                                      last edited by johnpoz

                                      nope didn't see that... So it default to old default of sha1, not the best setting these days...

                                      But clearly as you can see works just fine with pfsense - just have to take the settings correctly from the ovpn file and put them in the gui... What would be really slick as shit is if there was an importer ;) Someone should really code that ;) I don't have any use for it - but could save many users headaches to be sure..

                                      Maybe you caught this

                                      ## -----BEGIN RSA SIGNATURE-----
                                      ## DIGEST:sha256
                                      

                                      But that is not part of the config.

                                      edit: I think they must of been having issues before, since it wasn't connecting before at all..

                                      edit2: I would prob make sure not to pull routes and just policy route - was in a hurry so didn't pay much mind.. Its all disabled currently but will leave it ready to go until OP says he has it working ;)

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                                      1 Reply Last reply Reply Quote 0
                                      • R
                                        romantik70 @johnpoz
                                        last edited by

                                        @johnpoz i didnt forget to put tls key as you can see by screenshot . tried to make all the changes you tell me to do , but anfortunately there is no changes. i have noted and i dony know why oy happens that when i put the entire host ovpn-20.shpv.fr it always answer me that it is not able to resolve the host , error that i dont get when i put the ip address . it 's an hard hard issue to solve ....i can say yoy that the first time a collugue if mine....just an america man from texas Mattew ( i worked in the nato base here in naples , where i knew him . i am a solder from the italian army ....he made me discover pfsense cause i didnt know it at all ) the vpn worked .After one year they made some setting changes and after that changes the vpns finished working ,When i asked support for it they only could answer that dey didnt support pfsense.I say business is business , do you care i take the subscription help me solve this fucking issue , but french are french no way of changhing their mind.An other clue that their mind are insane is that they give an internationak service and they have web pages written only in french language , strange guys , strange guys they are. I want to tell you a funny story on french guys when last stayed to Kobul for duty wit the NATO .I went twice in Kobul first time with germans , second with french , would you aspect that germans are more confortable and funny then french , i wouldnt.When you stay in the base , at night we arrange parties , there sheltered places in the base , where we make parties , we drink , what to do , when you go outside in patrol you are fortunate if you get back.They even invited a ferman rock band to celebrate di OKTOBER FEST , what a day man i got drunk as a monkey , we say here in italy.When , came french everything changed .The suddnly , built a little Effel Tower before the bar where all soldiers went to relax. The even made stupid private partie , no private parties with germans , you could access to whatever fuckuing party they did. A collegue of mine , an american wanted to access a party they was helding , and the french guy said him : it's a french private party , you are american you cannot get in. The american answered : you should appriciate my presense in the party man, because it is thanks to me that you speak french , you would have spoken germans . hahhahahahah that's true no graditude.hostname.png tls.png

                                        1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator
                                          last edited by johnpoz

                                          Lets see your full page... of settings of your client, like I posted.

                                          seems like you put a colon in your hostname:443 vs just the hostname??

                                          from a client or pfsense resolve just the name?

                                          $ dig ovpn-20.shpv.fr
                                          
                                          ; <<>> DiG 9.14.7 <<>> ovpn-20.shpv.fr
                                          ;; global options: +cmd
                                          ;; Got answer:
                                          ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 16646
                                          ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
                                          
                                          ;; OPT PSEUDOSECTION:
                                          ; EDNS: version: 0, flags:; udp: 4096
                                          ;; QUESTION SECTION:
                                          ;ovpn-20.shpv.fr.               IN      A
                                          
                                          ;; ANSWER SECTION:
                                          ovpn-20.shpv.fr.        4734    IN      A       185.212.227.121
                                          
                                          ;; Query time: 2 msec
                                          ;; SERVER: 192.168.3.10#53(192.168.3.10)
                                          ;; WHEN: Thu Dec 19 21:31:17 Central Standard Time 2019
                                          ;; MSG SIZE  rcvd: 60
                                          

                                          I see from your settings you have auth and encryption... I doubt they are allowing for that, you notice I am just using auth..

                                          Why are you putting in something for username and password? You do not need that!!!

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          1 Reply Last reply Reply Quote 0
                                          • R
                                            romantik70
                                            last edited by

                                            i Did settings changes you hinted me but nothing changes i appriciate your efforts of helping me but i am strongly thinking about to use something different than pfsense for building ny network , i will try to set on a linux VM openvpn and try to do some portforwarding with linux to redirect my ip public address tcp's port to my inner VMs. The first time i used vpn by shpv.fr provider it worked but all setting were made by an american collegue of mine here in the NATO base in Naples ( i am a soldier by the army) , but the dude , fortunately for him , less for fortunetky for me , got back to states , i think now he is in duty to Hawaii ilands m blessed him . Thank you far all man.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.