3

I'm using the free FrootVPN service (works flawlessly on Windows). However on Linux I can't manage to get it to work. FrootVPN's support webpage is broken so I can't message their support.

I know it's a server related board, but I haven't found any decent client related one, and I can't get in touch with FrootVPN support, so I'll post my topic here, hoping that it is allowed.

The error that I get is:

TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
TLS Error: TLS handshake failed

I tried everything:

  • adding nameserver 80.67.0.2 to /etc/resolv.conf (as their guide page suggests)
  • protecting /etc/resolv.conf from overwriting
  • checking that IPV6 is enabled
  • reinstalling openvpn
  • forwarding port 1194
  • separating "ca", "cert" and "key" from the config
  • not using cert and key at all (which doesn't affect connectivity to this server)
  • using the update-resolv-conf script
  • changing various settings in the config file

No matter what I do, this error perseveres. My ISP doesn't block anything, I'm 100% sure in it.

Moreover, in 1 case out of 10 I can successfully connnect to the server, and then I get the following message almost every second: 

Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings

In case of successful connection, the vpn works, but I get bombarded with these messages. But in most cases, like I said, in 9 cases out of 10, it just won't connect with the above mentioned tls error.

Log example:

# openvpn '/etc/openvpn/frootvpn.ovpn'
Wed Jan 21 21:35:06 2015 OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Dec  1 2014
Enter Auth Username:COOLak
Enter Auth Password:
Wed Jan 21 21:35:18 2015 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Jan 21 21:35:18 2015 Control Channel MTU parms [ L:1541 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed Jan 21 21:35:18 2015 Socket Buffers: R=[212992->131072] S=[212992->131072]
Wed Jan 21 21:35:18 2015 RESOLVE: NOTE: se-openvpn.frootvpn.com resolves to 8 addresses
Wed Jan 21 21:35:18 2015 Data Channel MTU parms [ L:1541 D:1450 EF:41 EB:4 ET:0 EL:0 ]
Wed Jan 21 21:35:18 2015 Local Options hash (VER=V4): '3514370b'
Wed Jan 21 21:35:18 2015 Expected Remote Options hash (VER=V4): '239669a8'
Wed Jan 21 21:35:18 2015 UDPv4 link local: [undef]
Wed Jan 21 21:35:18 2015 UDPv4 link remote: [AF_INET]178.73.212.198:1198
Wed Jan 21 21:36:18 2015 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Wed Jan 21 21:36:18 2015 TLS Error: TLS handshake failed
Wed Jan 21 21:36:18 2015 TCP/UDP: Closing socket
Wed Jan 21 21:36:18 2015 SIGUSR1[soft,tls-error] received, process restarting
Wed Jan 21 21:36:18 2015 Restart pause, 2 second(s)
Wed Jan 21 21:36:20 2015 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Jan 21 21:36:20 2015 Re-using SSL/TLS context
Wed Jan 21 21:36:20 2015 Control Channel MTU parms [ L:1541 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed Jan 21 21:36:20 2015 Socket Buffers: R=[212992->131072] S=[212992->131072]
Wed Jan 21 21:36:20 2015 RESOLVE: NOTE: se-openvpn.frootvpn.com resolves to 8 addresses
Wed Jan 21 21:36:20 2015 Data Channel MTU parms [ L:1541 D:1450 EF:41 EB:4 ET:0 EL:0 ]
Wed Jan 21 21:36:20 2015 Local Options hash (VER=V4): '3514370b'
Wed Jan 21 21:36:20 2015 Expected Remote Options hash (VER=V4): '239669a8'
Wed Jan 21 21:36:20 2015 UDPv4 link local: [undef]
Wed Jan 21 21:36:20 2015 UDPv4 link remote: [AF_INET]178.73.212.205:1206
Wed Jan 21 21:37:20 2015 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Wed Jan 21 21:37:20 2015 TLS Error: TLS handshake failed
Wed Jan 21 21:37:20 2015 TCP/UDP: Closing socket
Wed Jan 21 21:37:20 2015 SIGUSR1[soft,tls-error] received, process restarting
Wed Jan 21 21:37:20 2015 Restart pause, 2 second(s)
Wed Jan 21 21:37:22 2015 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Jan 21 21:37:22 2015 Re-using SSL/TLS context
Wed Jan 21 21:37:22 2015 Control Channel MTU parms [ L:1541 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed Jan 21 21:37:22 2015 Socket Buffers: R=[212992->131072] S=[212992->131072]
Wed Jan 21 21:37:22 2015 RESOLVE: NOTE: se-openvpn.frootvpn.com resolves to 8 addresses
Wed Jan 21 21:37:22 2015 Data Channel MTU parms [ L:1541 D:1450 EF:41 EB:4 ET:0 EL:0 ]
Wed Jan 21 21:37:22 2015 Local Options hash (VER=V4): '3514370b'
Wed Jan 21 21:37:22 2015 Expected Remote Options hash (VER=V4): '239669a8'
Wed Jan 21 21:37:22 2015 UDPv4 link local: [undef]
Wed Jan 21 21:37:22 2015 UDPv4 link remote: [AF_INET]178.73.212.200:1202
Wed Jan 21 21:38:22 2015 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Wed Jan 21 21:38:22 2015 TLS Error: TLS handshake failed
Wed Jan 21 21:38:22 2015 TCP/UDP: Closing socket
Wed Jan 21 21:38:22 2015 SIGUSR1[soft,tls-error] received, process restarting
Wed Jan 21 21:38:22 2015 Restart pause, 2 second(s)

In case of successful connection (which occurs VERY rarely), here's another log example:

Wed Jan 21 21:38:24 2015 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Jan 21 21:38:24 2015 Re-using SSL/TLS context
Wed Jan 21 21:38:24 2015 Control Channel MTU parms [ L:1541 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed Jan 21 21:38:24 2015 Socket Buffers: R=[212992->131072] S=[212992->131072]
Wed Jan 21 21:38:24 2015 RESOLVE: NOTE: se-openvpn.frootvpn.com resolves to 8 addresses
Wed Jan 21 21:38:24 2015 Data Channel MTU parms [ L:1541 D:1450 EF:41 EB:4 ET:0 EL:0 ]
Wed Jan 21 21:38:24 2015 Local Options hash (VER=V4): '3514370b'
Wed Jan 21 21:38:24 2015 Expected Remote Options hash (VER=V4): '239669a8'
Wed Jan 21 21:38:24 2015 UDPv4 link local: [undef]
Wed Jan 21 21:38:24 2015 UDPv4 link remote: [AF_INET]178.73.212.201:1194
Wed Jan 21 21:38:24 2015 TLS: Initial packet from [AF_INET]178.73.212.201:1194, sid=7db519ba bd8492df
Wed Jan 21 21:38:24 2015 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Wed Jan 21 21:38:24 2015 VERIFY OK: depth=1, /C=SE/ST=QQ/L=FrootTown/O=FrootOrg/OU=changeme/CN=changeme/name=changeme/[email protected]
Wed Jan 21 21:38:24 2015 VERIFY OK: nsCertType=SERVER
Wed Jan 21 21:38:24 2015 VERIFY OK: depth=0, /C=SE/ST=QQ/L=FrootTown/O=FrootOrg/OU=changeme/CN=server/name=changeme/[email protected]
Wed Jan 21 21:38:25 2015 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Jan 21 21:38:25 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Jan 21 21:38:25 2015 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Jan 21 21:38:25 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Jan 21 21:38:25 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Wed Jan 21 21:38:25 2015 [server] Peer Connection Initiated with [AF_INET]178.73.212.201:1194
Wed Jan 21 21:38:25 2015 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Wed Jan 21 21:38:25 2015 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #2 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Wed Jan 21 21:38:26 2015 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #3 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Wed Jan 21 21:38:26 2015 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #4 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Wed Jan 21 21:38:27 2015 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Wed Jan 21 21:38:27 2015 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #5 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Wed Jan 21 21:38:27 2015 PUSH: Received control message: 'PUSH_REPLY,ifconfig-ipv6 2a00:1a28:1167::1011/64 2a00:1a28:1167::1,dhcp-option DNS 80.67.0.2,dhcp-option DNS 91.213.246.2,redirect-gateway def1,route-ipv6 2000::/3,tun-ipv6,route-gateway 178.73.192.1,topology subnet,ping 10,ping-restart 160,ifconfig 178.73.192.19 255.255.255.224'
Wed Jan 21 21:38:27 2015 OPTIONS IMPORT: timers and/or timeouts modified
Wed Jan 21 21:38:27 2015 OPTIONS IMPORT: --ifconfig/up options modified
Wed Jan 21 21:38:27 2015 OPTIONS IMPORT: route options modified
Wed Jan 21 21:38:27 2015 OPTIONS IMPORT: route-related options modified
Wed Jan 21 21:38:27 2015 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Wed Jan 21 21:38:27 2015 ROUTE default_gateway=192.168.1.1
Wed Jan 21 21:38:27 2015 ROUTE6: default_gateway=UNDEF
Wed Jan 21 21:38:27 2015 TUN/TAP device tun0 opened
Wed Jan 21 21:38:27 2015 TUN/TAP TX queue length set to 100
Wed Jan 21 21:38:27 2015 do_ifconfig, tt->ipv6=1, tt->did_ifconfig_ipv6_setup=1
Wed Jan 21 21:38:27 2015 /sbin/ifconfig tun0 178.73.192.19 netmask 255.255.255.224 mtu 1500 broadcast 178.73.192.31
Wed Jan 21 21:38:27 2015 /sbin/ifconfig tun0 inet6 add 2a00:1a28:1167::1011/64
Wed Jan 21 21:38:27 2015 /sbin/route add -net 178.73.212.201 netmask 255.255.255.255 gw 192.168.1.1
Wed Jan 21 21:38:27 2015 /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw 178.73.192.1
Wed Jan 21 21:38:27 2015 /sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw 178.73.192.1
Wed Jan 21 21:38:27 2015 add_route_ipv6(2000::/3 -> 2a00:1a28:1167::1 metric 0) dev tun0
Wed Jan 21 21:38:27 2015 /sbin/route -A inet6 add 2000::/3 dev tun0
Wed Jan 21 21:38:27 2015 Initialization Sequence Completed
Wed Jan 21 21:38:27 2015 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #6 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Wed Jan 21 21:38:27 2015 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #7 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Wed Jan 21 21:38:28 2015 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #8 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Wed Jan 21 21:38:28 2015 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #9 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Wed Jan 21 21:38:28 2015 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #10 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Wed Jan 21 21:38:28 2015 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #11 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Wed Jan 21 21:38:28 2015 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #12 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Wed Jan 21 21:38:28 2015 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #13 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Wed Jan 21 21:38:28 2015 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #14 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Wed Jan 21 21:38:28 2015 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #15 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings

[and so on forever]

Provided that it works perfectly on Windows, and that many users on the internet reported it working flawlessly on Linux as well, I presume that it's my local problem, and not a server's one. I'm using Kali Linux 3.14 (x64). Their .ovpn file: https://www.frootvpn.com/files/frootvpn.ovpn, if it helps.

I spent the whole day trying to figure it, but unfortunately the solution of this issue is beyond my knowledge. Any help would be much appreciated. Thanks a lot in advance. P.S. I'm going to be offline for several hours after creating this topic.

UPD: I forgot to mention that I also tried specifying just one server IP, and it still only connects sometimes, while in most cases it doesn't. The peer choice doesn't matter: whether it's 178.73.212.201:1194 or whetever else on the list, the problem stays the same. The reason why there's many peers is because that's what they provide in their .ovpn file to reduce the load on their servers. Each IP is actually working, but it connects successfully only in rare ocassions.

Improve this question

2 Answers 2

Reset to default
1

When you copy the certificate and key files from windows your Linux system may have corrupted the files by using the wrong line endings. Try downloading the FrootVPN Config file using your Linux system directly.

Improve this answer
0

Since I don't think there is enough info here to definitively resolve this, this answer is more of a list of things to try which will either resolve it or provide more info. I'm also not sure why is marked as an active question, but I had already written out most of my response when I noticed it was 1.5 years old.

ovpn file

The link to the config (.ovpn) file you provided is dead. Does this link contain an identical ovpn to the one that you are using? Since (i just now realized) you posted this a long time ago, it's likely the link just changed, but just in case, check this out. https://www.frootvpn.com/files/se.openvpn.frootvpn.ovpn

Firewall

One thing that jumped out at me was that they use a range of ports (typically you only use a single one, usually 1194, for udp with openvpn). This is usually the issue when having a VPN connection problem, but with a firewall induced issue it is usually a binary problem - it either works or it doesn't. But it is possible in this case that you have 1194 properly passing through but other ports are blocked. Just to rule things out, you should disable your firewall on your machine, and ensure that that port range is forwarded to your machine (udp ports 1194 through 1209 inclusive per the .ovpn file). Depending on your router make/model it's likely you can do a range with a single setting.

I have no experience with Kali, but it's a debian derivative so it is likely using 'straight' iptables for it's firewall. iptables is a bit of a pain to disable, here are some very clear directions on how to do it:

First make sure it's installed:

dpkg -l | grep iptables

If it's not installed then unless you have another firewall app you can just configure the port forwarding and start testing the VPN connection; otherwise:

run all commands as sudo or in a root shell. This will save your current firewall settings, then setup a fully transparent firewall (equiv. to no firewall).

iptables-save > ~/iptables-rules
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

Once you are done testing with no firewall, you can re-enable it with:

iptables-restore < ~/iptables-rules

Make sure you have both disabled the firewall and forwarded the port range and try connecting to the VPN.

Less likely but still possible

If you are using the correct .ovpn (pretty likely) and it's not related to the firewall / port forwarding, then here are some other things to try and data points to provide that will make it easier for people to assist:

  1. Add this argument to your openvpn call: --verb 11 This turns the debug output up to, well, 11. There will be a wall of text - if you can't make sense of it, paste it into a pastebin website and post the link here. Don't paste the text here directly

  2. Clock skew - if your local PC clock is not set accurately, or is just not accurate - jumps around, etc - you will get failures just like this. Make sure it is set correctly (or configure an NTP server connection).

  3. Do you have a high latency internet connection (e.g. satellite, really bad DSL, or gasp dial-up)? These will cause encryption related failures.

  4. What type of router do you have (make/model)? Have you ever updated it's firmware?

  5. Do you have an older, CPU starved computer? Encryption / Decryption can bring an old computer to it's knees and cause these issues. It would have to be a reallly old one for this to apply, but it happens with routers configured as openvpn clients quite often - their tiny aircooled CPUs sometimes can't keep up.

  6. What do the logs look like from the openvpn client on the windows machine? Do you see any of the same errors / warnings?

  7. This probably isn't it, but I had a tough time getting openvpn running as a client on fedora last week, and was due to the encryption of the key using md5, which has been deprecated in most linux distros. The debug output will tell us if that is happening. To clarify- the same config files worked on windows with openvpn but not in Linux, same behavior as you are / were / seeing.

Edit to add one more thing:

  1. Try using pptp instead of openvpn. Make sure VPN passthrough is enabled on your router ( it uses an usual packet type called GRE that the router has to pass through unmolested). It is much less secure but will be a good test. Depending on how secure you need the VPN to be, it may be sufficient. Try it, if it works, research the very real security concerns.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .