TLS handshake failed / OpenVPN with NetworkManager

scar

hello,

i am trying to get a VPN setup between my pfsense-1.2.3 boxes and a debian lenny client using NetworkManager.

i followed this guide to create the CA, server, and client certificates and keys:

http://thegoldenear.org/toolbox/unices/pfsense-1.2-openvpn-certificates-keys.html#client-certs

my VPN settings in pfsense:


protocol: UDP
local port: something random
address pool: new /24 subnet
local network: my LAN subnet
cryptography: AES-128-CBC
authentication method: PKI
custom options: engine cryptodev

i pasted in the CA Cert, Server cert, Server key, and DH params. i am using a netgate firewall with dual alix.2d3 boards (with CARP) so that is why i added 'engine cryptodev'

i added a UDP firewall rule, allow any to single host (CARP shared WAN address), dest port range matches VPN port.

when i try to initiate the connection from my debian client using NetworkManager, i can see in the pfsense firewall log that the connection was allowed. but, in the openvpn logs i see "TLS handshake failed". in NetworkManager / VPN properties, i made sure to match the cipher (AES-128-CBC).

i think that's about it… what else can i check? thanks

scar

ah cool… i figured it out!

i think i just had to add the option 'local <wan carp="" ip="">' to the VPN's custom options in addition to the 'engine cryptodev'

i also added an AON rule before trying this, which didn't help, but maybe it was needed too? i made the rule for source <new 24="" subnet="">:* to : with NAT address<wan carp="" ip=""></wan></new></wan>