1

I have such topology:

enter image description here

I want to make a VPN connection from client in subnet 192.x.x.x to my OpenVPN server. But still getting such messages:

Mon Mar 10 16:24:00 2014 Initialization Sequence Completed
Mon Mar 10 16:26:00 2014 [OpenVPNServerTEST] Inactivity timeout (--ping-restart), restarting
Mon Mar 10 16:26:00 2014 TCP/UDP: Closing socket
Mon Mar 10 16:26:00 2014 SIGUSR1[soft,ping-restart] received, process restarting
Mon Mar 10 16:26:00 2014 Restart pause, 2 second(s)
Mon Mar 10 16:26:02 2014 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Mon Mar 10 16:26:02 2014 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon Mar 10 16:26:02 2014 Re-using SSL/TLS context
Mon Mar 10 16:26:02 2014 LZO compression initialized
Mon Mar 10 16:26:02 2014 Control Channel MTU parms [ L:1558 D:166 EF:66 EB:0 ET:0 EL:0 ]
Mon Mar 10 16:26:02 2014 Socket Buffers: R=[229376->131072] S=[229376->131072]
Mon Mar 10 16:26:02 2014 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Mar 10 16:26:02 2014 Local Options hash (VER=V4): '9e7066d2'
Mon Mar 10 16:26:02 2014 Expected Remote Options hash (VER=V4): '162b04de'
Mon Mar 10 16:26:02 2014 UDPv4 link local: [undef]
Mon Mar 10 16:26:02 2014 UDPv4 link remote: [AF_INET]172.16.1.111:1194
Mon Mar 10 16:27:02 2014 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Mon Mar 10 16:27:02 2014 TLS Error: TLS handshake failed
Mon Mar 10 16:27:02 2014 TCP/UDP: Closing socket
Mon Mar 10 16:27:02 2014 SIGUSR1[soft,tls-error] received, process restarting
Mon Mar 10 16:27:02 2014 Restart pause, 2 second(s)
Mon Mar 10 16:27:04 2014 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Mon Mar 10 16:27:04 2014 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon Mar 10 16:27:04 2014 Re-using SSL/TLS context
Mon Mar 10 16:27:04 2014 LZO compression initialized
Mon Mar 10 16:27:04 2014 Control Channel MTU parms [ L:1558 D:166 EF:66 EB:0 ET:0 EL:0 ]
Mon Mar 10 16:27:04 2014 Socket Buffers: R=[229376->131072] S=[229376->131072]
Mon Mar 10 16:27:04 2014 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Mar 10 16:27:04 2014 Local Options hash (VER=V4): '9e7066d2'
Mon Mar 10 16:27:04 2014 Expected Remote Options hash (VER=V4): '162b04de'
Mon Mar 10 16:27:04 2014 UDPv4 link local: [undef]
Mon Mar 10 16:27:04 2014 UDPv4 link remote: [AF_INET]172.16.1.111:1194
^C (CTRL+C)
Mon Mar 10 16:27:20 2014 event_wait : Interrupted system call (code=4)
Mon Mar 10 16:27:20 2014 TCP/UDP: Closing socket
Mon Mar 10 16:27:20 2014 /sbin/route del -net 10.8.0.1 netmask 255.255.255.255
Mon Mar 10 16:27:20 2014 /sbin/route del -net 172.16.1.0 netmask 255.255.255.0
Mon Mar 10 16:27:20 2014 /sbin/route del -net 172.16.254.0 netmask 255.255.255.0
Mon Mar 10 16:27:20 2014 Closing TUN/TAP interface
Mon Mar 10 16:27:20 2014 /sbin/ifconfig tun0 0.0.0.0

My clients (all of them) are Xubuntu 13.10 with iptables rules:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination       
ACCEPT     udp  --  anywhere             anywhere             state NEW udp dpt:openvpn
ACCEPT     all  --  anywhere             anywhere           

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination       
ACCEPT     all  --  anywhere             anywhere           
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination       
ACCEPT     all  --  anywhere             anywhere
  1. My client from the subnet 192.x.x.x is client3 - it cant connect to vpn server
  2. Clients from subnet 172.x.x.x are client1 and client2 - they can connect with OpenVPN server with no problems.
  3. My router is JSRX 210 H with out of the box configuration - without VPN client3 (192.x.x.x) can ping client1, client2 and server from subnet 172.x.x.x. (everyone can ping everyone without vpn = full connectivity)

My client3 (192.x.x.x) config file:

client
dev tun0
proto udp
remote 172.16.1.111 1194
resolv-retry infinite
nobind
# Downgrade privileges after initialization (non-Windows only)
;user nobody
;group nobody
persist-key
persist-tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/client3test.crt
key /etc/openvpn/client3test.key
tls-auth /etc/openvpn/ta.key 1
cipher AES-256-CBC
keepalive 10 120
comp-lzo
verb 3

Config files for client1 and client2 are the same (despite the tun, client1 uses tun0, client2 uses tun1), my every client uses its own key and certificate.

My server config file:

port 1194
proto udp
dev tun0
ca ca.crt
cert OpenVPNServerTEST.crt
key OpenVPNServerTEST.key 
dh dh.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 172.16.254.0 255.255.255.0"
push "route 172.16.1.0 255.255.255.0"
keepalive 10 120
tls-auth ta.key 0
cipher AES-256-CBC   # AES
comp-lzo
;user nobody
;group nobody
persist-key
persist-tun
status openvpn-status.log
log         openvpn.log
log-append  openvpn.log
verb 3

JSRX config file: http://pastie.org/private/gcnclsztzwnbglzvcalhla

  • You're tagging this question with juniper-srx but AFAICT the juniper isn't terminating the vpn. Why did you tag this question with juniper-srx? – Mike Pennington Mar 10 '14 at 20:18
  • @MikePennington♦ because I thought that its the JSRX issue, if not - whats wrong? Added JSRX config – mazix Mar 10 '14 at 20:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.