OpenVPN connection from a Linux client [OMV running the openVPN server]

ice.man · 28. Oktober 2015

I've been using OMV with the openVPN plugin since OMV 0.5
Now I'm with the latest 2.1
Everything has always worked fine whenever I tried to connect from a Windows client (using the config files downloaded from the web-gui)
Now I'd like to connect from a Linux client running Ubuntu 14.04
Thus I'm using the very same files (config and certs) that are running with no issue on the very same laptop (when I boot in Windows) I keep on failing

Same error message both if I copy the config files to the /etc/openvpn/ directory or I import them via the network manager
googling this error message was no use
here is the error message I get

Code

root@HP840-LIN:/etc/openvpn# openvpn --client --config omv_ufficio-client.ovpn --ca omv_ufficio-ca.crt --auth-retry interact
Wed Oct 28 16:43:25 2015 us=303095 Current Parameter Settings:
Wed Oct 28 16:43:25 2015 us=303222   config = 'omv_ufficio-client.ovpn'
Wed Oct 28 16:43:25 2015 us=303267   mode = 0
Wed Oct 28 16:43:25 2015 us=303307   persist_config = DISABLED
Wed Oct 28 16:43:25 2015 us=303343   persist_mode = 1
Wed Oct 28 16:43:25 2015 us=303378   show_ciphers = DISABLED
Wed Oct 28 16:43:25 2015 us=303414   show_digests = DISABLED
Wed Oct 28 16:43:25 2015 us=303451   show_engines = DISABLED
Wed Oct 28 16:43:25 2015 us=303486   genkey = DISABLED
Wed Oct 28 16:43:25 2015 us=303521   key_pass_file = '[UNDEF]'
Wed Oct 28 16:43:25 2015 us=303556 NOTE: --mute triggered...
Wed Oct 28 16:43:25 2015 us=303611 265 variation(s) on previous 10 message(s) suppressed by --mute
Wed Oct 28 16:43:25 2015 us=303662 OpenVPN 2.3.2 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Dec  1 2014
Wed Oct 28 16:43:25 2015 us=304687 WARNING: file 'omv_ufficio-client.key' is group or others accessible
Wed Oct 28 16:43:25 2015 us=305076 LZO compression initialized
Wed Oct 28 16:43:25 2015 us=305250 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Wed Oct 28 16:43:25 2015 us=305355 Socket Buffers: R=[87380->131072] S=[16384->131072]
Wed Oct 28 16:43:25 2015 us=310020 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Oct 28 16:43:25 2015 us=310097 Local Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Wed Oct 28 16:43:25 2015 us=310122 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Wed Oct 28 16:43:25 2015 us=310168 Local Options hash (VER=V4): '69109d17'
Wed Oct 28 16:43:25 2015 us=310206 Expected Remote Options hash (VER=V4): 'c0103fa8'
Wed Oct 28 16:43:25 2015 us=310242 Attempting to establish TCP connection with [AF_INET]MyPublic_IP:port [nonblock]
Wed Oct 28 16:43:26 2015 us=310498 TCP connection established with [AF_INET]MyPublic_IP:port
Wed Oct 28 16:43:26 2015 us=310541 TCPv4_CLIENT link local: [undef]
Wed Oct 28 16:43:26 2015 us=310554 TCPv4_CLIENT link remote: [AF_INET]MyPublic_IP:port
Wed Oct 28 16:43:26 2015 us=310598 TCPv4_CLIENT WRITE [14] to [AF_INET]MyPublic_IP:port: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
Wed Oct 28 16:43:26 2015 us=348716 TCPv4_CLIENT READ [26] from [AF_INET]MyPublic_IP:port: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 [ 0 ] pid=0 DATA len=0
Wed Oct 28 16:43:26 2015 us=348757 TLS: Initial packet from [AF_INET]MyPublic_IP:port, sid=047a9f4a a40af6a8
Wed Oct 28 16:43:26 2015 us=348801 TCPv4_CLIENT WRITE [22] to [AF_INET]MyPublic_IP:port: P_ACK_V1 kid=0 [ 0 ]
Wed Oct 28 16:43:26 2015 us=348872 TCPv4_CLIENT WRITE [114] to [AF_INET]MyPublic_IP:port: P_CONTROL_V1 kid=0 [ ] pid=1 DATA len=100
Wed Oct 28 16:43:26 2015 us=348893 TCPv4_CLIENT WRITE [114] to [AF_INET]MyPublic_IP:port: P_CONTROL_V1 kid=0 [ ] pid=2 DATA len=100
Wed Oct 28 16:43:26 2015 us=348910 TCPv4_CLIENT WRITE [17] to [AF_INET]MyPublic_IP:port: P_CONTROL_V1 kid=0 [ ] pid=3 DATA len=3
Wed Oct 28 16:43:26 2015 us=462216 TCPv4_CLIENT READ [22] from [AF_INET]MyPublic_IP:port: P_ACK_V1 kid=0 [ 1 ]
Wed Oct 28 16:43:26 2015 us=536650 TCPv4_CLIENT READ [22] from [AF_INET]MyPublic_IP:port: P_ACK_V1 kid=0 [ 2 ]
Wed Oct 28 16:43:26 2015 us=536749 TCPv4_CLIENT READ [126] from [AF_INET]MyPublic_IP:port: P_CONTROL_V1 kid=0 [ 3 ] pid=1 DATA len=100
Wed Oct 28 16:43:26 2015 us=536828 TCPv4_CLIENT READ [114] from [AF_INET]MyPublic_IP:port: P_CONTROL_V1 kid=0 [ ] pid=2 DATA len=100
Wed Oct 28 16:43:26 2015 us=536858 TCPv4_CLIENT READ [114] from [AF_INET]MyPublic_IP:port: P_CONTROL_V1 kid=0 [ ] pid=3 DATA len=100
Wed Oct 28 16:43:26 2015 us=536883 TCPv4_CLIENT READ [114] from [AF_INET]MyPublic_IP:port: P_CONTROL_V1 kid=0 [ ] pid=4 DATA len=100
Wed Oct 28 16:43:26 2015 us=536907 NOTE: --mute triggered...
Wed Oct 28 16:43:27 2015 us=167965 45 variation(s) on previous 10 message(s) suppressed by --mute
Wed Oct 28 16:43:27 2015 us=168024 VERIFY ERROR: depth=1, error=self signed certificate in certificate chain: C=IT, ST=MO, L=Modena, O=ufficio, OU=viabonacini, CN=ufficio, name=server, emailAddress=ice@attutta.com
Wed Oct 28 16:43:27 2015 us=168143 TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
Wed Oct 28 16:43:27 2015 us=168160 TLS Error: TLS object -> incoming plaintext read error
Wed Oct 28 16:43:27 2015 us=168171 TLS Error: TLS handshake failed
Wed Oct 28 16:43:27 2015 us=168257 Fatal TLS error (check_tls_errors_co), restarting
Wed Oct 28 16:43:27 2015 us=168317 TCP/UDP: Closing socket
Wed Oct 28 16:43:27 2015 us=168399 SIGUSR1[soft,tls-error] received, process restarting
Wed Oct 28 16:43:27 2015 us=168421 Restart pause, 5 second(s)

Alles anzeigen

subzero79 · 28. Oktober 2015

Restart the openvpn server and start the client.
Paste here in pastebin link , logs of the server verb4 and client simultaneously.

subzero79 · 28. Oktober 2015

I rarely see a server configured in tcp, are this ok? Server and client in tcp? And a fwd nat rule also in tcp?

ice.man · 29. Oktober 2015

the server is running on 1194 TCP, but I have a port fw rule on the router.
Actually the public IP is responding on port 443
I need to do this because most of public Wi-Fi providers (Hotels, Airports, etc) just let you go ONLY through port 80 (default http) and 443(default https)
As I wrote, not issue since 3 years connecting from a Windows client
same configuration

subzero79 · 29. Oktober 2015

As requested then , logs server an client simultaneously so they show the error at server and client.
Also check the certificates are not expired.

ice.man · 30. Oktober 2015

problem solved
I created a new certificate. Thus the previous one is still working from the windows client.....how come?!?!

OpenVPN connection from a Linux client [OMV running the openVPN server]

Jetzt mitmachen!

Tags