Jump to content
Not connected, Your IP: 18.191.14.104
Sign in to follow this  
marcos.machado

tls error: tls handshake failed

Recommended Posts

Hi,

I have the asus XT9 that supports VPN. In my desktop I can connect to the VPN using the eddie-UI. When I try to connect using the router, it doesn`t work. It did work using WireGuard configuration.
I did a check and the router from the telecom company (virgin media) doesn`t have the firewall enabled. I saw on internet some people saying to unblock a specific port but from the posts I saw that didn`t fix the issue.

Anyone has any idea what i can do to try make the openvpn work? are the openvpn client version and opensll version ok?
 

Jan 18 20:52:02 rc_service: httpd 7515:notify_rc restart_vpnc
Jan 18 20:52:04 vpnclient5[14780]: OpenVPN 2.4.12 arm-buildroot-linux-gnueabi [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on May  6 2023
Jan 18 20:52:04 vpnclient5[14780]: library versions: OpenSSL 1.1.1n  15 Mar 2022, LZO 2.10
Jan 18 20:52:04 vpnclient5[14781]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Jan 18 20:52:04 vpnclient5[14781]: TCP/UDP: Preserving recently used remote address: [AF_INET]37.46.117.92:443
Jan 18 20:52:04 vpnclient5[14781]: Socket Buffers: R=[524288->524288] S=[524288->524288]
Jan 18 20:52:04 vpnclient5[14781]: UDP link local: (not bound)
Jan 18 20:52:04 vpnclient5[14781]: UDP link remote: [AF_INET]xxx.xxx.xxx.xxx:443
Jan 18 20:53:04 vpnclient5[14781]: TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Jan 18 20:53:04 vpnclient5[14781]: TLS Error: TLS handshake failed
Jan 18 20:53:04 vpnclient5[14781]: SIGUSR1[soft,tls-error] received, process restarting
Jan 18 20:53:04 vpnclient5[14781]: Restart pause, 5 second(s)
Jan 18 20:53:09 vpnclient5[14781]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Jan 18 20:53:09 vpnclient5[14781]: TCP/UDP: Preserving recently used remote address: [AF_INET]134.19.179.133:443
Jan 18 20:53:09 vpnclient5[14781]: Socket Buffers: R=[524288->524288] S=[524288->524288]
Jan 18 20:53:09 vpnclient5[14781]: UDP link local: (not bound)
Jan 18 20:53:09 vpnclient5[14781]: UDP link remote: [AF_INET]xxx.xxx.xxx.xxx:443
Jan 18 20:54:10 vpnclient5[14781]: TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Jan 18 20:54:10 vpnclient5[14781]: TLS Error: TLS handshake failed
Jan 18 20:54:10 vpnclient5[14781]: SIGUSR1[soft,tls-error] received, process restarting
Jan 18 20:54:10 vpnclient5[14781]: Restart pause, 5 second(s)
Jan 18 20:54:15 vpnclient5[14781]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Jan 18 20:54:15 vpnclient5[14781]: TCP/UDP: Preserving recently used remote address: [AF_INET]134.19.179.133:443
Jan 18 20:54:15 vpnclient5[14781]: Socket Buffers: R=[524288->524288] S=[524288->524288]
Jan 18 20:54:15 vpnclient5[14781]: UDP link local: (not bound)
Jan 18 20:54:15 vpnclient5[14781]: UDP link remote: [AF_INET]xxx.xxx.xxx.xxx:443
Jan 18 20:55:15 vpnclient5[14781]: TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Jan 18 20:55:15 vpnclient5[14781]: TLS Error: TLS handshake failed
Jan 18 20:55:15 vpnclient5[14781]: SIGUSR1[soft,tls-error] received, process restarting
Jan 18 20:55:15 vpnclient5[14781]: Restart pause, 5 second(s)
Jan 18 20:55:20 vpnclient5[14781]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Jan 18 20:55:20 vpnclient5[14781]: TCP/UDP: Preserving recently used remote address: [AF_INET]134.19.179.133:443
Jan 18 20:55:20 vpnclient5[14781]: Socket Buffers: R=[524288->524288] S=[524288->524288]
Jan 18 20:55:20 vpnclient5[14781]: UDP link local: (not bound)
Jan 18 20:55:20 vpnclient5[14781]: UDP link remote: [AF_INET]xxx.xxx.xxx.xxx:443
Jan 18 20:56:20 vpnclient5[14781]: TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Jan 18 20:56:20 vpnclient5[14781]: TLS Error: TLS handshake failed
Jan 18 20:56:20 vpnclient5[14781]: SIGUSR1[soft,tls-error] received, process restarting
Jan 18 20:56:20 vpnclient5[14781]: Restart pause, 5 second(s)
Jan 18 20:56:25 vpnclient5[14781]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Jan 18 20:56:25 vpnclient5[14781]: TCP/UDP: Preserving recently used remote address: [AF_INET]134.19.179.133:443
Jan 18 20:56:25 vpnclient5[14781]: Socket Buffers: R=[524288->524288] S=[524288->524288]
Jan 18 20:56:25 vpnclient5[14781]: UDP link local: (not bound)
Jan 18 20:56:25 vpnclient5[14781]: UDP link remote: [AF_INET]xxx.xxx.xxx.xxx:443

 

Share this post


Link to post
@marcos.machado

Hello!

Assuming that there is indeed no block at all against OpenVPN or UDP in the network, a possible cause of the problem is a mismatched TLS key. For entry-IP address 1 you need tls-auth key while for entry-IP address 3 you need TLS Crypt key. You deleted the IP address of the server so we can't tell which key you need. Since tls-auth and tls-crypt are mutually incompatible and OpenVPN server can start either in tls-auth or in tls-crypt mode we have been forced to make this distinction on different entry-IP addresses. Your OpenVPN version is also quite old, so consider an upgrade if possible.

The Configuration Generator generates the proper key according to the connection mode you have picked. If you need split files (i.e. certificates and keys not embedded in the ovpn file) you can enable "Advanced" mode and then check "Separate certs/keys from ovpn files" option. In this case, the CG names the tls-auth and tls-crypt keys respectively ta.key and tls-crypt.key. You will also need to select "2.4" in the "OpenVPN profile" combo box, because OpenVPN 2.5 and newer versions support directives which are unknown to OpenVPN 2.4.

Kind regards
 

Share this post


Link to post
3 hours ago, Staff said:
@marcos.machado

Hello!

Assuming that there is indeed no block at all against OpenVPN or UDP in the network, a possible cause of the problem is a mismatched TLS key. For entry-IP address 1 you need tls-auth key while for entry-IP address 3 you need TLS Crypt key. You deleted the IP address of the server so we can't tell which key you need. Since tls-auth and tls-crypt are mutually incompatible and OpenVPN server can start either in tls-auth or in tls-crypt mode we have been forced to make this distinction on different entry-IP addresses. Your OpenVPN version is also quite old, so consider an upgrade if possible.

The Configuration Generator generates the proper key according to the connection mode you have picked. If you need split files (i.e. certificates and keys not embedded in the ovpn file) you can enable "Advanced" mode and then check "Separate certs/keys from ovpn files" option. In this case, the CG names the tls-auth and tls-crypt keys respectively ta.key and tls-crypt.key. You will also need to select "2.4" in the "OpenVPN profile" combo box, because OpenVPN 2.5 and newer versions support directives which are unknown to OpenVPN 2.4.

Kind regards
 
thank you for the help.

the ip is 213.152.162.86

i have the certificates added manually, (ca.crt -> CA cert, user.crt -> client cert, user.key -> client key, tls-crypt.key -> static key )
 

Share this post


Link to post

Hello!

You have entered the TLS Crypt key for the correct entry-IP address (213.152.162.86 is an entry-IP address "three", where you have support for tls-crypt). Thus the problem is somewhere else.

On some firmware, the "static key" field is not the "TLS key" field. If that's the case you need to put the tls-auth.key content in the TLS field, while the static key field must be left empty (it's for an OpenVPN working mode without PFS which we do not support).

Also you should make sure that there's no block against UDP in the firewall rules.

Kind regards
 

Share this post


Link to post

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...
  • Security Check
    Play CAPTCHA Audio
    Refresh Image
Sign in to follow this  

×
×
  • Create New...