Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    OpenVPN client to to server issue

    OpenVPN
    3
    11
    1.5k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      alaacho
      last edited by

      Hay guys,

      We are using OpenVPN server to allow our users to access the office network from outside. we are using a DNS name, as we do not have a static IP. The connection was functioning perfectly until yesterday.

      Initially, we have update pfsense 2.60 and then proceeded to update to versions 2.7.0, 2.7.1, and finally 2.7.2. However, throughout all these stages, the issue persists, and I am unable to establish a successful connection from smartphones\PCs.

      When attempting to connect from outside the office, I have to make approximately 10 to 15 attempts, and in one of those attempts, I succeed. However, once I disconnect, I cannot establish a connection again. and now no conection at all.

      I am currently using the following settings for remote access: Remote Access (User Auth), Data Encryption Algorithms AES-128-GCM, AES-128-CBC

      logs from VPN client app

      Mon Dec 11 17:08:58 2023 OpenVPN 2.5.2 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Apr 21 2021
      Mon Dec 11 17:08:58 2023 Windows version 10.0 (Windows 10 or greater) 64bit
      Mon Dec 11 17:08:58 2023 library versions: OpenSSL 1.1.1k 25 Mar 2021, LZO 2.10
      Mon Dec 11 17:09:05 2023 TCP/UDP: Preserving recently used remote address: [AF_INET] IP?????:1195
      Mon Dec 11 17:09:05 2023 UDPv4 link local: (not bound)
      Mon Dec 11 17:09:05 2023 UDPv4 link remote: [AF_INET]IP????:1195
      Mon Dec 11 17:10:05 2023 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
      Mon Dec 11 17:10:05 2023 TLS Error: TLS handshake failed

      V A 2 Replies Last reply Reply Quote 1
      • V
        viragomann @alaacho
        last edited by

        @alaacho
        Probably it's more helpful, what's logged on the server, when you attempt to connect.

        A 1 Reply Last reply Reply Quote 0
        • A
          alaacho @viragomann
          last edited by

          Thank you @viragomann

          I appreciate your response.

          I have only received firewall logs, but there are no logs available for unsuccessful connections from the OpenVPN logs.

          below from PFsense firewall logs

          action pass

          1 Dec 12 08:21:57 WAN02 OpenVPN Cayan_OpenVPN (1627826872) my home ip:2044 10.254.254.3:1194 UDP

          Rule Type: Pass
          Interface: WAN02
          Protocol: UDP
          Source: my home ip
          Destination: 10.254.254.3
          Destination Port: 1194
          IP Protocol: Inet

          and below logs from my phone

          [Dec 12, 2023, 17:50:15] ----- OpenVPN Start -----

          [Dec 12, 2023, 17:50:15] EVENT: CORE_THREAD_ACTIVE

          [Dec 12, 2023, 17:50:15] OpenVPN core 3.git::081bfebe:RelWithDebInfo android arm64 64-bit PT_PROXY

          [Dec 12, 2023, 17:50:15] Frame=512/2048/512 mssfix-ctrl=1250

          [Dec 12, 2023, 17:50:15] UNUSED OPTIONS
          0 [persist-tun]
          1 [persist-key]
          2 [data-ciphers] [AES-128-GCM:AES-128-CBC]
          3 [data-ciphers-fallback] [AES-128-CBC]
          5 [tls-client]
          8 [nobind]
          11 [explicit-exit-notify]

          [Dec 12, 2023, 17:50:15] EVENT: RESOLVE

          [Dec 12, 2023, 17:50:16] Contacting [64:ff9b::bc35:bb1f]:1194 via UDP

          [Dec 12, 2023, 17:50:16] EVENT: WAIT

          [Dec 12, 2023, 17:50:16] Connecting to [ourname.ddns.net]:1194 (64:ff9b::bc35:bb1f) via UDPv6

          [Dec 12, 2023, 17:50:25] Server poll timeout, trying next remote entry...

          [Dec 12, 2023, 17:50:25] EVENT: RECONNECTING

          [Dec 12, 2023, 17:50:25] EVENT: RESOLVE

          [Dec 12, 2023, 17:50:25] Contacting officeIP:1194 via UDP

          [Dec 12, 2023, 17:50:25] EVENT: WAIT

          [Dec 12, 2023, 17:50:25] Connecting to [ourname.ddns.net]:1194 (officeIP) via UDPv4

          [Dec 12, 2023, 17:50:35] Server poll timeout, trying next remote entry...

          [Dec 12, 2023, 17:50:35] EVENT: RECONNECTING

          and below logs from PC OpenVPN client

          Tue Dec 12 17:50:54 2023 OpenVPN 2.5.2 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Apr 21 2021
          Tue Dec 12 17:50:54 2023 Windows version 10.0 (Windows 10 or greater) 64bit
          Tue Dec 12 17:50:54 2023 library versions: OpenSSL 1.1.1k 25 Mar 2021, LZO 2.10
          Tue Dec 12 17:50:56 2023 TCP/UDP: Preserving recently used remote address: [AF_INET]officeIP:1194
          Tue Dec 12 17:50:56 2023 UDPv4 link local: (not bound)
          Tue Dec 12 17:50:56 2023 UDPv4 link remote: [AF_INET]officeIP:1194
          Tue Dec 12 17:51:56 2023 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
          Tue Dec 12 17:51:56 2023 TLS Error: TLS handshake failed
          Tue Dec 12 17:51:56 2023 SIGUSR1[soft,tls-error] received, process restarting
          Tue Dec 12 17:52:01 2023 TCP/UDP: Preserving recently used remote address: [AF_INET]officeIP:1194
          Tue Dec 12 17:52:01 2023 UDPv4 link local: (not bound)
          Tue Dec 12 17:52:01 2023 UDPv4 link remote: [AF_INET]officeIP:1194
          Tue Dec 12 17:53:01 2023 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
          Tue Dec 12 17:53:01 2023 TLS Error: TLS handshake failed
          Tue Dec 12 17:53:01 2023 SIGUSR1[soft,tls-error] received, process restarting
          Tue Dec 12 17:53:08 2023 TCP/UDP: Preserving recently used remote address: [AF_INET]officeIP:1194
          Tue Dec 12 17:53:08 2023 UDPv4 link local: (not bound)
          Tue Dec 12 17:53:08 2023 UDPv4 link remote: [AF_INET]officeIP:1194
          Tue Dec 12 17:54:09 2023 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
          Tue Dec 12 17:54:09 2023 TLS Error: TLS handshake failed
          Tue Dec 12 17:54:09 2023 SIGUSR1[soft,tls-error] received, process restarting
          Tue Dec 12 17:54:14 2023 TCP/UDP: Preserving recently used remote address: [AF_INET]officeIP:1194
          Tue Dec 12 17:54:14 2023 UDPv4 link local: (not bound)
          Tue Dec 12 17:54:14 2023 UDPv4 link remote: [AF_INET]officeIP:1194
          Tue Dec 12 17:55:14 2023 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
          Tue Dec 12 17:55:14 2023 TLS Error: TLS handshake failed
          Tue Dec 12 17:55:14 2023 SIGUSR1[soft,tls-error] received, process restarting

          V 1 Reply Last reply Reply Quote 0
          • V
            viragomann @alaacho
            last edited by

            @alaacho said in OpenVPN client to to server issue:

            1 Dec 12 08:21:57 WAN02 OpenVPN Cayan_OpenVPN (1627826872) my home ip:2044 10.254.254.3:1194 UDP

            "My home" is your WAN IP, or something else?
            What is the destination address?
            Seems to me like an outbound connection.

            The client log error almost indicates that the server is unreachable from the client. And there can be certain reasons for this. That's why it is not very helpful.

            If you don't have more, I'd sniff the traffic on the WAN to check if the OpenVPN packets even reach pfSense.
            If not, your ISP did possibly some changes.

            Do you have a real public IP on pfSense WAN or is there an ISP router in front of it?

            A 1 Reply Last reply Reply Quote 0
            • A
              alaacho @viragomann
              last edited by

              Hi @viragomann

              My home" is your WAN IP, or something else?
              "that's client-side from outside the office using my laptop/Phone"

              What is the destination address?
              "officeIP:1194 that's our PFsense office"

              The client log error almost indicates that the server is unreachable from the client. And there can be certain reasons for this. That's why it is not very helpful.

              "I'm unsure why there are no logs from OpenVPN, considering that the connection reaches the firewall and successfully passes through port 1194."

              If you don't have more, I'd sniff the traffic on the WAN to check if the OpenVPN packets even reach pfSense.

              " As the connection successfully reaches the firewall and passes through. If I need to track the connection further, where else should I look beyond the firewall logs? "

              If not, your ISP did possibly some changes.
              "I have been attempting to contact them, but it seems that the customer support of the ISP does not fully comprehend the issue at hand"

              Do you have a real public IP on pfSense WAN
              "No, we do not have a static IP address, which is why we have been utilizing Dynamic DNS from No-IP (www.noip.com). It has been functioning smoothly for the past three years without any problems"

              or is there an ISP router in front of it?

              "(ISP) provided a fiber optic Router, which is located in front of PFsense, almost same as below"

              [link text](link url)

              V 1 Reply Last reply Reply Quote 0
              • V
                viragomann @alaacho
                last edited by

                @alaacho
                All clear. So according to this, everything outside pfSense should work well. On pfSense you see that the OpenVPN packets are passed to port 1194, where the server is listening on.

                So if the server is running I'd expect to see an entry in the OpenVPN log, when a client tries to connect.
                Check the servers verbosity level and set it to 4, then try to reconnect.

                BTW: Your phone tries IPv6 first, which makes no sense if you only have an IPv4 address on pfSense or forward only IPv4 on the ISP router.

                A 1 Reply Last reply Reply Quote 0
                • A
                  Aseknet @alaacho
                  last edited by Aseknet

                  @alaacho,
                  I have the exact same TLS Error message after upgrading to version 2.7.2.
                  I know openVPN worked on 2.7.0 with the same setup (have not changed any settings).
                  On version 2.7.1, I am not sure if I tested OpenVPN so dont know the status there.

                  Please advice if you find the issue and how to correct it!

                  //Aseknet

                  A 1 Reply Last reply Reply Quote 0
                  • A
                    alaacho @viragomann
                    last edited by

                    THank you @viragomann for your reply,

                    I am still uncertain about where to locate the logs beyond the firewall logs. Additionally, I am unfamiliar with the process of checking the servers' verbosity level and setting it to 4. I have already disabled the V6 connection, but the issue persists.

                    1 Reply Last reply Reply Quote 0
                    • A
                      alaacho @Aseknet
                      last edited by

                      HI @Aseknet

                      Unfortunately, the issue still persists. Please note that the problem started when we were on version 2.6.0. I spent more than 12 hours trying to figure it out, and then I upgraded step by step until version 2.7.2. However, during each upgrade, I performed the test again, but the issue remains unresolved.

                      Additionally, whenever we attempt to establish a connection, we can see the incoming connection in the firewall logs, but no further logs are generated.

                      in rare circumstances, the connection from my mobile using the OpenVPN app was able to connect after several attempts, but unfortunately, it disconnects after a few seconds.

                      Please inform me if you manage to resolve this issue as well.

                      A 1 Reply Last reply Reply Quote 0
                      • A
                        Aseknet @alaacho
                        last edited by

                        @alaacho,
                        Found the issue, I was using unsupporrted Ciphers. Only allowed is AES-256-GCM and AES-128-GCM. Please check that theese are selected under server and then export new clients
                        This is well documented in the first post in this OpenVPN forum.
                        I had AES-256 and AES-128 selected, but mine was not "-GCM".

                        //Aseknet

                        A 1 Reply Last reply Reply Quote 1
                        • A
                          alaacho @Aseknet
                          last edited by

                          Hi @Aseknet
                          I apologize for the delay in responding. I made the recommended changes and tested them on the same day, but there was no difference.

                          However, yesterday I tried reconnecting and it started working. The new exported client from AES-256-GCM and the old are also functioning properly. I can't figure out if the issue was with the key or my ISP. Thank you so much.

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.