0

I have OpenVPN servers set in 4G remote routers (Teltonika RUT955) and I have the computer of the office that can connect to them succesfully as client.

Now I'm working remotely in another computer where I have pasted the configuration of the office computer and I'm not able to connect to the servers. The office computer is still able to connect, then I disconnect it and try to connect the home computer and it fails.

The OpenVPN handshake gets stuck repeating this line:

UDP WRITE [14] to [AF_INET]XXX.XXX.XXX.XXX:1194: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0

I have found some information on the internet saying that this kind of messages could be due to the server being unable to come back to the client, but I have no idea...

The configuration of the server is (It's configured through web interface):

 config webui 'webui'
    option _auth 'tls'

 config openvpn '7365727665725F4F70656E56504E'
    option persist_key '1'
    option port '1194'
    option keepalive '10 120'
    option persist_tun '1'
    option status '/tmp/openvpn-status_server_OpenVPN.log'
    option verb '5'
    option proto 'udp'
    option dev 'tun_s_OpenVPN'
    option _auth 'tls'
    option _tls_cipher 'all'
    option cipher 'AES-256-CBC'
    option client_to_client '1'
    option enable '1'
    option ca '/lib/uci/upload/cbid.openvpn.server_OpenVPN.ca'
    option cert '/lib/uci/upload/cbid.openvpn.server_OpenVPN.cert'
    option key '/lib/uci/upload/cbid.openvpn.server_OpenVPN.key'
    option dh '/lib/uci/upload/cbid.openvpn.server_OpenVPN.dh'
    option server '10.0.1.0 255.255.255.0'
    option name_is_hexed '1'
    list push 'route 192.168.3.0 255.255.255.0'
    option duplicate_cn '1'
    option auth 'sha1'
    option _tls_auth 'none'
    option client_config_dir '/etc/openvpn/ccd'

The configuration file of the clients is:

 client
 dev tun
 proto UDP
 remote xxxxxxxxxxx 1194
 resolv-retry infinte
 nobind
 persist-key
 persist-tun
 remote-cert-tls server
 cipher AES-256-CBC

In both computers I have a TAP-Windows Adapter V9 for the VPN. For me both clients are identical, but the one in the office is able to connect, meanwhile the one home isn't.

What can cause this behaviour?

Thanks for your time,

Héctor

EDIT:

logs:

Tell me if I have forgoted to anonymate something

12
  • 1
    Please don't add content to configs - copy & paste as is (configs are unusable due to the added content). To troubleshoot: add verb 5 to the client config & verb 4 to the server, restart the server, connect w/ client, and review both the server's & client's OpenVPN logs. General FYIs: EC TLS ciphers are recommended, as they're more efficient than SSL; Encryption over AES128 is unnecessary, as it's uncrackable until at least 2030; SHA1 is not secure - use SHA512 if OS is x64, else SHA256 (tuned config example)
    – JW0914
    Commented Apr 30, 2021 at 12:17
  • First of all sorry for the inconvinience. I will edit the question and put the plain config for the client, but it's going difficult for me to the the same for the server because it's configured through a web interface and I don't believe I have access to the raw config file. Also, thanks for the general FYIs, I'm not an expert and they are useful for me. In the last place, I can't taste VPN again until monday. I will try again then with the new verbosity levels.
    – Héctor
    Commented Apr 30, 2021 at 15:26
  • Throughout the day I think I'm going to be able to test again the connection with the new verbosity values, and checking the server logs. Tomorrow at the latest. The router is Teltonika Rut955 that has RutOS (OpenWrt based Linux OS) as OS. I have not found how to change the verbosity of the server log.
    – Héctor
    Commented May 3, 2021 at 9:32
  • I think your link is for Stunnel, not for OVPN. I don't see any option in the WebUI to change OVPN server verbosity. I'm a novice with VPN's, that's why I have configured it via WebUI instead from SSH. With the current verbosity level, the server doesn't show any log register when the home PC tries to connect, but it does when the office PC connects. For the client side, it was already at verbosity 6. So, there isn't more info from this side, unless you want me to paste the output of verbosity 8, that gives extra information.
    – Héctor
    Commented May 3, 2021 at 14:51
  • Okey, so the only way to add the verb 4 option to the server config is to completely discard WebUI configuration and substitute it with an standard configuration by file? That, in the other hand, is what you are recommending to me.
    – Héctor
    Commented May 3, 2021 at 20:57

0

You must log in to answer this question.

Browse other questions tagged .