|
|
On Wed, 22 Sep 2004, Maciek Mikrut wrote: > Hello, > We have an openvpn setup connecting multiple sites plus a couple of roaming > users. We run openvpn in multi-client server mode using TCP protocol > in order for roaming users to reach the openvpn server from behind NAT > firewall. We have a strange problem with tls-auth option on roaming > user's machines. When tls-auth is enabled, it takes many re-tries > (and sometime not at all) for them to connect to vpn. > Did anyone have a similar problem? Any help? Please cc email to me > on mmikrut@xxxxxxxxxxxxxxx :) Thanks ! > > Attached are config files and sample of error messages I wasn't able to reproduce problems with TCP mode + tls-auth. Have you tried the connection without tls-auth? Have you tried UDP rather than TCP? I would expect to see the error "TLS Error: cannot locate HMAC in incoming packet from <ip>:5000" when tls-auth is used in the local config but is absent in the remote config. It would help to see some "verb 9" debugging info immediately before the error occurs. James > ############## SERVER CONFIG ############### > local <server_ip_address> > port 5000 > proto tcp > dev tun > ca cert/ca.crt > cert cert/server.crt > key cert/server.key # This file is secret > dh cert/dh1024.pem > server 192.168.0.128 255.255.255.192 > client-config-dir ccd > client-to-client > keepalive 10 60 > tls-auth cert/ta.key 0 # This file is secret > comp-lzo > status /var/log/openvpn-server-status.log > verb 4 > > > ############# CLIENT CONFIG ################### > client > dev tun > proto tcp > remote <remote_server_ip> 5000 > resolv-retry infinite > ca cert/ca.crt > cert cert/client.crt > key cert/client.key > tls-auth cert/ta.key 1 > comp-lzo > verb 4 > > > ###### SAMPLE ERROR MESSAGE ON SERVER ############ > Sep 22 10:51:03 border1 openvpn[18775]: Local Options hash (VER=V4): > 'bd577cd1' > Sep 22 10:51:03 border1 openvpn[18775]: Expected Remote Options hash > (VER=V4): 'ee93268d' > Sep 22 10:51:03 border1 openvpn[18775]: TCP connection established with > 203.199.89.102:61198 > Sep 22 10:51:03 border1 openvpn[18775]: Socket Buffers: R=[131072->131072] > S=[131072->131072] > Sep 22 10:51:03 border1 openvpn[18775]: TCPv4_SERVER link local: [undef] > Sep 22 10:51:03 border1 openvpn[18775]: TCPv4_SERVER link remote: > 203.199.89.102:61198 > Sep 22 10:51:03 border1 openvpn[18775]: 203.199.89.102:61198 TLS: Initial > packet from 203.199.89.10 > 2:61198, sid=5657fa76 094215e8 > Sep 22 10:51:16 border1 openvpn[18775]: 203.199.89.102:61198 VERIFY OK: > depth=1, /C=AU/ST=ACT/L=Can > berra/O=CyberOne.Pty.Ltd/OU=Servers/CN=border1.cyberone.com.au/ > emailAddress=sysadm@xxxxxxxxxxxxxxx > Sep 22 10:51:16 border1 openvpn[18775]: 203.199.89.102:61198 VERIFY OK: > depth=0, /C=AU/ST=ACT/O=Cyb > erOne.Pty.Ltd/OU=Manila.Division/CN=manila.cyberone.com.au/ > emailAddress=sysadm@xxxxxxxxxxxxxxx > Sep 22 10:51:17 border1 openvpn[18775]: MULTI: multi_close_instance called > Sep 22 10:51:17 border1 openvpn[18775]: TCP/UDP: Closing socket > > > #### SAMPLE ERROR MESSAGE ON CLIENT ########## > > syslog: > Sep 22 10:31:30 aileen openvpn[1798]: Fatal decryption error > (check_tls_errors_dowork), restarting > Sep 22 10:31:36 aileen openvpn[1798]: TLS Error: cannot locate HMAC in > incoming packet from <ip>:5000 > > messages: > Sep 22 09:28:13 aileen openvpn[1702]: TCP connection established with > <ip>:5000 > Sep 22 09:28:13 aileen openvpn[1702]: Socket Buffers: R=[87380->131072] > S=[16384->131072] > Sep 22 09:28:13 aileen openvpn[1702]: TCPv4_CLIENT link local: [undef] > Sep 22 09:28:13 aileen openvpn[1702]: TCPv4_CLIENT link remote: <ip>:5000 > Sep 22 09:28:14 aileen openvpn[1702]: TLS: Initial packet from <ip>:5000, > sid=ea843077 c9a > 62f79 > Sep 22 09:28:20 aileen openvpn[1702]: VERIFY OK: > depth=1, /C=AU/ST=ACT/L=Canberra/O=CyberOne.Pty.Lt > d/OU=Servers/CN=border1.cyberone.com.au/emailAddress=sysadm@xxxxxxxxxxxxxxx > Sep 22 09:28:20 aileen openvpn[1702]: VERIFY OK: > depth=0, /C=AU/ST=ACT/O=CyberOne.Pty.Ltd/OU=System > s/CN=border1.cyberone.com.au/emailAddress=sysadm@xxxxxxxxxxxxxxx > Sep 22 09:28:27 aileen openvpn[1702]: TCP/UDP: Closing socket > Sep 22 09:28:27 aileen openvpn[1702]: SIGUSR1[soft,connection-reset] received, > process restarting > > > > > > ------------------------------------------------------- > This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170 > Project Admins to receive an Apple iPod Mini FREE for your judgement on > who ports your project to Linux PPC the best. Sponsored by IBM. > Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php > _______________________________________________ > Openvpn-users mailing list > Openvpn-users@xxxxxxxxxxxxxxxxxxxxx > https://lists.sourceforge.net/lists/listinfo/openvpn-users > ____________________________________________ Openvpn-users mailing list Openvpn-users@xxxxxxxxxxxxxxxxxxxxx https://lists.sourceforge.net/lists/listinfo/openvpn-users |