Yesterday I installed Debian 9 and OpenVPN on a server at home and everything was working flawlessly (I followed this guide). However, this morning, OpenVPN was working (client side) and suddenly nothing was loading anymore. I tried reconnecting to the VPN and it worked for 5 or 10 minutes and then nothing.
I did a few researches and I checked the status of the OpenVPN server with the command
systemctl status openvpn@server and I saw the message:
TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) TLS Error: TLS handshake failed SIGUSR1[soft,tls-error] received, client-instance restarting
Again, I looked up this error on internet but nothing solved the problem. In the mean time, 2 other errors came up:
TLS Error: local/remote TLS keys are out of sync
Authenticate/Decrypt packet error: cipher final failed
It seems obvious that this has something to do with TLS right? I have the file
ta.key generated with
openvpn --genkey --secret ta.key in both
/etc/openvpn/ on the server and in the config folder on the client (windows).
I tried disabling ufw but it doesn't solve the problem so I doubt it is a firewall thing. Here is the result of
ufw status anyway:
Status: active To Action From -- ------ ---- 22/tcp ALLOW Anywhere 1194/udp ALLOW Anywhere 22/tcp (v6) ALLOW Anywhere (v6) 1194/udp (v6) ALLOW Anywhere (v6)
Here's what I added to
*nat :POSTROUTING ACCEPT [0.0] -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE COMMIT
server.conf (without comments):
port 1194 proto udp4 dev tun ca ca.crt cert server.crt key server.key # This file should be kept secret dh dh2048.pem server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "redirect-gateway def1 bypass-dhcp" push "dhcp-option DNS 188.8.131.52" push "dhcp-option DNS 184.108.40.206" keepalive 10 120 tls-auth ta.key 0 # This file is secret cipher AES-256-CBC max-clients 10 user nobody group nogroup persist-key persist-tun status openvpn-status.log verb 3 explicit-exit-notify 1
And finally the
client.ovpn (without comments and certificates):
client dev tun proto udp4 remote [server-ip] 1194 resolv-retry infinite nobind user nobody group nogroup persist-key persist-tun remote-cert-tls server tls-auth ta.key 1 cipher AES-256-CBC verb 3 <ca> -----BEGIN CERTIFICATE----- (...) -----END CERTIFICATE----- </ca> <cert> Certificate: (...) -----BEGIN CERTIFICATE----- (...) -----END CERTIFICATE----- </cert> <key> -----BEGIN PRIVATE KEY----- (...) -----END PRIVATE KEY----- </key>
Any suggestions are welcomed, thank you!