Fix VPN Connection Issues Between OpenVPN Connect and Access Server⁠

📝 Purpose⁠

Use this guide to diagnose and fix issues when OpenVPN Connect can't connect to your Access Server.

You'll learn where to find logs, how to identify common errors, and the steps to resolve them.

🌐 1. Check your environment⁠

Before troubleshooting:

Confirm the client device has internet access.
Ensure your Access Server is running and reachable.
Protocol
Port
Purpose
TCP
443
Web services & XML-RPC
TCP
943
Admin Web UI
UDP
1194
OpenVPN data channel
Download fresh connection profiles after reinstalling or upgrading Access Server.

Protocol	Port	Purpose
TCP	443	Web services & XML-RPC
TCP	943	Admin Web UI
UDP	1194	OpenVPN data channel

Check	Command/Action
Access Server service status	`sudo service openvpnas status`
Server IP / DNS resolves	`ping <your-server-hostname>`
Ports open (default 443 or 1194)	`sudo netstat -tuln`

📂 2. Review log files⁠

If the VPN connection fails, check logs on both the server and client.

System	Log Location	Notes
Access Server	`/var/log/openvpnas.log`	Contains connection attempts, auth errors, and TLS negotiation info.
OpenVPN Connect Windows app	`C:\Users\<Username>\AppData\Roaming\OpenVPN Connect\log`	Double click to open ovpn.log.
OpenVPN Connect macOS app	`/Users/<your username>/Library/Application Support/OpenVPN Connect/log/`	Use the Console app to open the ovpnagent.log.

If Access Server or its web services won't start properly, you can create a fresh log that only contains startup and shutdown details:

systemctl stop openvpnas
mv /var/log/openvpnas.log /var/log/openvpnas.log.old
systemctl start openvpnas
systemctl stop openvpnas

Then, analyze the clean log:

cat /var/log/openvpnas.log

Finally, restart Access Server:

systemctl start openvpnas

⚠️ 3. Common error messages and fixes⁠

Expand each section below to find causes and recommended resolutions.

Cause:

Client is using an outdated TLS version (e.g., TLS 1.0).
TLS level mismatch between client and server.
Firewall/ISP interference.

Fix:

Check the Access Server log file for lines like:
```
OpenSSL: error:140760FC: SSL routings:SSL23_GET_CLIENT_HELLO:unknown protocol
```
- This indicates an old client. Upgrade to the latest OpenVPN Connect.
If TLS settings were changed on the server, install a fresh connection profile to update client TLS parameters.
Verify ports (UDP 1194/TCP 443) aren't blocked by a firewall or ISP.

Cause: If session tokens are IP-locked for security, this message displays when the session token offered by the client was generated from a different IP. If your IP changes (e.g., switching networks), the old token becomes invalid.

Fix: You can disable session IP locking via CLI if needed:

./sacli --key "vpn.server.session_ip_lock" --value 'false' ConfigPut
./sacli start

Variant A: Generic failure⁠

Cause: Indicates a server-locked profile was used, but web services weren't reachable.

Fix:

Verify that Access Server web services run on the expected port.
Update or reinstall connection profiles if the port has changed.

Variant B: Other SSL errors, such as SSL23_READ ssl handshake failure⁠

Cause: Client connecting to wrong host or port.

Fix:

Verify that Access Server web services run on the expected port.
Update or reinstall connection profiles if the port has changed.

Variant C: ConnectionRefusedError: 10061⁠

Cause: Client connecting to the wrong host or port.

Fix:

Check the server hostname/IP in the Admin Web UI.
Ensure it's reachable from the internet.
Download new profiles.

Variant D: XML-RPC: TimeoutError⁠

Cause: XML-RPC interface is unreachable.

Fix:

Confirm the firewall allows traffic on port 443.
Use a user-locked or auto-login profile if the XML-RPC interface must remain closed.

Variant E: XML-RPC function GetSession may not be called at the configured relay level⁠

Cause: XML-RPC/REST API interface disabled.

Fix:

Sign in to the Admin Web UI.
Click Configuration > CWS Settings.
Under Configure XML-RPC/REST API, select:
- Enable limited API or
- Enable complete API.
Select Save Settings and Update Running Server.

🧪 4. Advanced diagnostics⁠

For deeper investigation:

Run packet capture:
```
sudo tcpdump -i eth0- port 1194 -nn
```
Check iptables/nftables rules for dropped packets:
```
sudo iptables -L -n
```
or
```
sudo nft list ruleset
```
Enable verbose logging in Access Server for detailed output:
```
./sacli --key "log_level" --value 7 ConfigPut
./sacli start
```

🧭 5. If you still can't connect⁠

Try these next steps:

Test with a fresh profile downloaded from the Client Web UI.
Try another network (mobile hotspot or home connection).
Temporarily disable the antivirus or local firewall to isolate the cause.
Review known issues in your version's release notes.
Reach out to our support team.

Can't find what you're looking for?

Our support team will be happy to assist you.

Contact Support Schedule a Demo

Fix VPN Connection Issues Between OpenVPN Connect and Access Server⁠

📝 Purpose⁠

🌐 1. Check your environment⁠

📂 2. Review log files⁠

⚠️ 3. Common error messages and fixes⁠

🧪 4. Advanced diagnostics⁠

🧭 5. If you still can't connect⁠

📚 Related Resources⁠

Was this information helpful?