OpenVPN connection issue
-
Wonder if someone could help me troubleshoot a problem.
I have a Netgate 1100 running pfsense+ 23.05.1-RELEASE (arm64) and I'm trying to get OpenVPN working so I can remotely connect to my OPT1 (DMZ) segment.My WAN has a DHCP assigned public IP (but I have DDNS working so there is a FQDN that always resolves)
I used the OpenVPN wizard to create the server and export the client config.I run the client config on an external Linux machine and I see it connect on the firewall but there is no virtual IP assigned:
The logs show "Initialization Sequence Completed" and "/dev/tun1 opened" but then nothing happens and I get TLS errors:
Sep 8 18:31:35 openvpn 29272 event_wait : Interrupted system call (fd=-1,code=4)
Sep 8 18:31:37 openvpn 29272 /sbin/ifconfig ovpns1 192.168.222.1 -alias
Sep 8 18:31:37 openvpn 29272 /usr/local/sbin/ovpn-linkdown ovpns1 1500 0 192.168.222.1 255.255.255.0 init
Sep 8 18:31:37 openvpn 80879 Flushing states on OpenVPN interface ovpns1 (Link Down)
Sep 8 18:31:37 openvpn 29272 SIGTERM[hard,] received, process exiting
Sep 8 18:31:39 openvpn 53296 OpenVPN 2.6.2 aarch64-portbld-freebsd14.0 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [MH/RECVDA] [AEAD] [DCO]
Sep 8 18:31:39 openvpn 53296 library versions: OpenSSL 1.1.1t-freebsd 7 Feb 2023, LZO 2.10
Sep 8 18:31:39 openvpn 53296 DCO version: FreeBSD 14.0-CURRENT #1 plus-RELENG_23_05_1-n256108-459fc493a87: Wed Jun 28 04:25:15 UTC 2023 root@freebsd:/var/jenkins/workspace/pfSense-Plus-snapshots-23_05_1-main/obj/aarch64/0P4W6joa/var/jenkins/workspace/pfSense-Plus-snapshots-23_05_1-main/source
Sep 8 18:31:39 openvpn 57677 WARNING: using --duplicate-cn and --client-config-dir together is probably not what you want
Sep 8 18:31:39 openvpn 57677 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Sep 8 18:31:39 openvpn 57677 WARNING: experimental option --capath /var/etc/openvpn/server1/ca
Sep 8 18:31:39 openvpn 57677 TUN/TAP device ovpns1 exists previously, keep at program end
Sep 8 18:31:39 openvpn 57677 TUN/TAP device /dev/tun1 opened
Sep 8 18:31:39 openvpn 57677 /sbin/ifconfig ovpns1 192.168.222.1/24 mtu 1500 up
Sep 8 18:31:40 openvpn 57677 /usr/local/sbin/ovpn-linkup ovpns1 1500 0 192.168.222.1 255.255.255.0 init
Sep 8 18:31:40 openvpn 57677 UDPv4 link local (bound): [AF_INET]2x.xxx.xxx.x5:1194
Sep 8 18:31:40 openvpn 57677 UDPv4 link remote: [AF_UNSPEC]
Sep 8 18:31:40 openvpn 57677 Initialization Sequence Completed
Sep 8 19:32:35 openvpn 57677 2x.xxx.xxx.x7:43643 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sep 8 19:32:35 openvpn 57677 2x.xxx.xxx.x7:43643 TLS Error: TLS handshake failed
Sep 8 19:33:40 openvpn 57677 2x.xxx.xxx.x7:51591 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sep 8 19:33:40 openvpn 57677 2x.xxx.xxx.x7:51591 TLS Error: TLS handshake failedSame on the client side - TLS errors.
2023-09-08 22:07:19 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
2023-09-08 22:07:19 TLS Error: TLS handshake failed
2023-09-08 22:07:19 SIGUSR1[soft,tls-error] received, process restartingI checked to ensure the TLS key matches on the server and client.
Interesting that when I try to connect and even put in bogus username and password, I get the same errors.
Any ideas?
-
Without server and client settings, no one can help you) there is something wrong with your settings
-
@Stef93
I'm new to pfsense, is there an easy way to get the server settings without screenshots of the GUI? -
/var/etc/openvpn/server(your server id)/config.ovpn
example
/var/etc/openvpn/server1/config.ovpn -
server1.ovpn
dev ovpns1
disable-dco
verb 3
dev-type tun
dev-node /dev/tun1
writepid /var/run/openvpn_server1.pid
#user nobody
#group nobody
script-security 3
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
proto udp4
auth SHA256
up /usr/local/sbin/ovpn-linkup
down /usr/local/sbin/ovpn-linkdown
client-connect /usr/local/sbin/openvpn.attributes.sh
client-disconnect /usr/local/sbin/openvpn.attributes.sh
local 2x.xx.xx.x5
engine devcrypto
tls-server
server 192.168.222.0 255.255.255.0
client-config-dir /var/etc/openvpn/server1/csc
plugin /usr/local/lib/openvpn/plugins/openvpn-plugin-auth-script.so /usr/local/sbin/ovpn_auth_verify_async user TG9jYWwgRGF0YWJhc2U= false server1 1194
tls-verify "/usr/local/sbin/ovpn_auth_verify tls 'openvpn_server' 1"
lport 1194
management /var/etc/openvpn/server1/sock unix
max-clients 5
push "route 192.168.22.0 255.255.255.0"
duplicate-cn
remote-cert-tls client
capath /var/etc/openvpn/server1/ca
cert /var/etc/openvpn/server1/cert
key /var/etc/openvpn/server1/key
dh /etc/dh-parameters.2048
tls-auth /var/etc/openvpn/server1/tls-auth 0
data-ciphers AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305:AES-256-CBC
data-ciphers-fallback AES-256-CBC
allow-compression no
persist-remote-ip
float
topology subnet
explicit-exit-notify 1
inactive 300CLIENT.ovpn
dev tun
persist-tun
persist-key
data-ciphers AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305:AES-256-CBC
data-ciphers-fallback AES-256-CBC
auth SHA256
tls-client
client
resolv-retry infinite
remote FQDN_to_WAN 1194 udp4
nobind
verify-x509-name "openvpn_server" name
auth-user-pass
remote-cert-tls server
explicit-exit-notify<ca>
-----BEGIN CERTIFICATE-----
MIID8TCCAtmgAwIBAgIIWHUO2JAZN+wwDQYJKoZIhvcNAQELBQAwVTEUMBIGA1UE
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
MIIEOzCCAyOgAwIBAgIBAzANBgkqhkiG9w0BAQsFADBVMRQwEgYDVQQDEwtpbnRl
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC+XaVPf5oMFoPc
-----END PRIVATE KEY-----
</key>
key-direction 1
<tls-auth>2048 bit OpenVPN static key
-----BEGIN OpenVPN Static key V1-----
5cb31652d73c24ad65db0b111fbb68eb
-----END OpenVPN Static key V1-----
</tls-auth> -
@jonh001 said in OpenVPN connection issue:
push "route 192.168.22.0 255.255.255.0"
duplicate-cnRemove route 192.168.22.0 255.255.255.0 and disable duplicate-cn
Client Specific Overrides there is?
Has the interface been added?
after everything restart opevpnI still advise you to read it, netgate writes excellent instructions and even offers examples with pictures)
https://docs.netgate.com/pfsense/en/latest/recipes/openvpn-ra.html -
@Stef93
I did review all the documentation and watched several YouTube videos before posting in the forums.
I was under the impression that the wizard would take care of 99% of the configurations for a basic scenario.The interface has been added (I think) - when I look at OpenVPN status, the header shows "ovpns1: SSL VPN in UDP4:1194 / Client Connections: 0" where I believe ovpns1 is the interface name. It also shows up under the Firewall Rules section. However I don't see it specifically listed under Interface Assignments - I only see the usual WAN, LAN and OPT1 (which is my DMZ).
I have since deleted the VPN config and associated rules and rebuilt it - same issue.
-
@jonh001 said in OpenVPN connection issue:
However I don't see it specifically listed under Interface Assignments
-
I think the OpenVPN interface is created automatically even though it doesn't show up in Interface Assignments as there is a "OpenVPN" item in the Firewall rules.
If I go to Interface Assignments and create a new one, it will show up in the Firewall rules as well.
Even if I create a new rule for the new interface, I still have the same issue
-
@jonh001
That's not all, you can add a rule that allows everything on the new interface.
Did you get the user settings through the wizard?
Get it again through Packages - openvpn-client-export, only there it is possible to specify the connection interface you will need -
I'm confused by your client settings, since such settings are only for the mobile application, are you going to use it on the phone?
-
@Stef93
Yes everything was through the wizard. And the client portion was via the client export utility. -
@Stef93
It gets stranger. When I use the client export utility to get the IOS config and then import it into the OpenVPN app on my iPad, it DOES connect, although I still cannot see anything on the permitted subnet. The iPad was just a test, I don't plan on using this via a mobile device.