Dotaz: OpenVPN vypisuje mi chybu

[trezor]

Na klientovi mi to vypisuje:

OpenVPN 2.0.9 Win32-MinGW [SSL] [LZO] built on Oct 1 2006 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info. LZO compression initialized Control Channel MTU parms [ L:1574 D:138 EF:38 EB:0 ET:0 EL:0 ] Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ] Local Options hash (VER=V4): 'd3a7571a' Expected Remote Options hash (VER=V4): '5b1533a2' UDPv4 link local (bound): [undef]:port UDPv4 link remote: ip:port write UDPv4: No Route to Host (WSAEHOSTUNREACH) (code=10065) TLS: Initial packet from ip:port, sid=a8c460a1 e0caf1d9 VERIFY ERROR: depth=1, error=certificate has expired: TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed TLS Error: TLS object -> incoming plaintext read error TLS Error: TLS handshake failed TCP/UDP: Closing socket SIGUSR1[soft,tls-error] received, process restarting Restart pause, 2 second(s) WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info. LZO compression initialized Control Channel MTU parms [ L:1574 D:138 EF:38 EB:0 ET:0 EL:0 ] Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ] Local Options hash (VER=V4): 'd3a7571a' Expected Remote Options hash (VER=V4): '5b1533a2' UDPv4 link local (bound): [undef]:port UDPv4 link remote: IP:port TLS Error: Unroutable control packet received from ip:port (si=3 op=P_CONTROL_V1)

kde by mohla byt chyba? Doteraz všetko šlapalo OK.

Dik

Odpovědi

[hates]

vypada to ze to neoveri certifikat. nemas nahodou vyprsene certifikaty ??? Hod te vypis do pre tagu. takhle se v tom ani prase nevyzna.

[hates]

vypada to ze to neoveri certifikat. nemas nahodou vyprsene certifikaty ??? VERIFY ERROR: depth=1, error=certificate has expired tomu napovida.

[trezor]

Tak tu to je

Fri Jan 19 13:29:36 2007 OpenVPN 2.0.9 Win32-MinGW [SSL] [LZO] built on Oct  1 2006
Fri Jan 19 13:29:36 2007 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Fri Jan 19 13:29:36 2007 LZO compression initialized
Fri Jan 19 13:29:36 2007 Control Channel MTU parms [ L:1574 D:138 EF:38 EB:0 ET:0 EL:0 ]
Fri Jan 19 13:29:36 2007 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Fri Jan 19 13:29:36 2007 Local Options hash (VER=V4): 'd3a7571a'
Fri Jan 19 13:29:36 2007 Expected Remote Options hash (VER=V4): '5b1533a2'
Fri Jan 19 13:29:36 2007 UDPv4 link local (bound): [undef]:port
Fri Jan 19 13:29:36 2007 UDPv4 link remote: ip:port
Fri Jan 19 13:29:36 2007 TLS Error: Unroutable control packet received from ip:port (si=3 op=P_ACK_V1)

Ako zistim ci nevyprsala platnost certifikatov?

[hates]

pokud si editujete klientsky certifikat tak je tam 7 radek Validity a pod nim jsou data vytvoreni certifikatu a expirace certifikatu. podivejte se do nej jestli neni to druhe datum jiz prosle. pokud ano musite si vygenerovat novy klientsky cetifikat

[m$ lipo $m]

este si over zda mas dobre nastaven cas pokud je cert platnej

[trezor]

Certifikat ma platnost do 2017 takze v tom to problem by nemal byt.

Ale cas na serveri som si vsimol je posunuty o 22 minut voci klientovi a skutocnosti. Skusil som casi vyrovnat na klientovi a na servere som nechal zly, ale ani to nepomohlo. Mam nastavit dobry cas na servery? Ak ano ako sa to robi lebo som lama v Linuxe tak trochu. Dik

[hates]

cas si nastav treba pomoci ntpdate.
jeste me napadlo ze u me na lince to dela obcas taky. OpenVPN je celkem haklive na kvalitu linky. muze to bejt napriklad i tim.

[trezor]

Ale predtym mi to islo bez problemov a ako nastavim pomocou ntpdate ?

[Jirka]

Dejte sem konfiguracni soubory serveru i klienta. V čase IMHO problém není. Spíš bych to viděl na ten poslední řádek z logu. Jaký "dev" používáte?

[trezor]

Aky dev?

tun0

preco ten posledny riadok ?

Inak to behalo uplne v pohode skoro rok. A v konfigurakoch som nic nemenil. Tak tam by som to nehladal. Na servery este vypisuje read UDPv4 [ENCONNREFUSED]: Connection refused (code=111)

a nakoniec v logu je TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) TLS handshake failed

napada Vas teraz nieco?

[trezor]

Este tu je zopar zaujimavých veci, co by mohlo napovedať.

Ja uz naozaj neviem kde moze byt chyba

VERIFY ERROR: depth=1, error=certificate has expired: /C=SK/ST=Slovakia/L=Nieco/O=podobne/OU=iii/CN=gertu
 TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
 TLS Error: TLS object -> incoming plaintext read error
 TLS Error: TLS handshake failed
 TCP/UDP: Closing socket
 SIGUSR1[soft,tls-error] received, process restarting
 Restart pause, 2 second(s)

[Jirka]

No podle toho to opravdu vypadá, že vypršela platnost certifikátu. Zkuste znovu vygenerovat serverové i klientské certifikáty.

[trezor]

A ako sa generujú serverové certifikaty ? Ja som to neinstaloval len som generoval klientske certifikaty, a klientskeho som uz skusil vygenerovat a nic nepomohlo. Este by som skusil teda server hoci tam je platnost do 2016 roku tak neviem.

[Jirka]

Když jsem openvpn zprovozňoval já, tak jsem si sepsal postup pro vytvoření kompletní CA. Mrkněte sem http://www.stud.fit.vutbr.cz/~xpagac02/.

[trezor]

Uz som na to prisiel bola neplatna CA

[dejf]

Dobry den, narazil jsem na obdobny problem, server je za HW ADSL modemem, kde mam presmerovany port na koncovy server, kdyz se pripojim na vpn uvnitr site na 192.168.x.x je vse O.K. pokod se snazim pripojit z venku na venkovni IP spojeni neprobehne a vypis u klienta je nasledujici.

Tue Feb 20 23:24:45 2007 OpenVPN 2.0.9 Win32-MinGW [SSL] [LZO] built on Oct 1 2006 Tue Feb 20 23:24:45 2007 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA. OpenVPN 2.0-beta16 and earlier used 5000 as the default port.
Tue Feb 20 23:24:45 2007 LZO compression initialized
Tue Feb 20 23:24:45 2007 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Tue Feb 20 23:24:45 2007 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Feb 20 23:24:45 2007 Local Options hash (VER=V4): '69109d17'
Tue Feb 20 23:24:45 2007 Expected Remote Options hash (VER=V4): 'c0103fa8'
Tue Feb 20 23:24:45 2007 Attempting to establish TCP connection with 194.xxx.yyy.zzz:1723
Tue Feb 20 23:24:45 2007 TCP connection established with 194.xxx.yyy.zzz:1723
Tue Feb 20 23:24:45 2007 TCPv4_CLIENT link local: [undef]
Tue Feb 20 23:24:45 2007 TCPv4_CLIENT link remote: 194.xxx.yyy.zzz:1723
Tue Feb 20 23:25:46 2007 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Tue Feb 20 23:25:46 2007 TLS Error: TLS handshake failed
Tue Feb 20 23:25:46 2007 Fatal TLS error (check_tls_errors_co), restarting
Tue Feb 20 23:25:46 2007 TCP/UDP: Closing socket
Tue Feb 20 23:25:46 2007 SIGUSR1[soft,tls-error] received, process restarting
Tue Feb 20 23:25:46 2007 Restart pause, 5 second(s)
Tue Feb 20 23:25:51 2007 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA. OpenVPN 2.0-beta16 and earlier used 5000 as the default port.
Tue Feb 20 23:25:51 2007 Re-using SSL/TLS context
Tue Feb 20 23:25:51 2007 LZO compression initialized
Tue Feb 20 23:25:51 2007 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Tue Feb 20 23:25:51 2007 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Feb 20 23:25:51 2007 Local Options hash (VER=V4): '69109d17'
Tue Feb 20 23:25:51 2007 Expected Remote Options hash (VER=V4): 'c0103fa8'
Tue Feb 20 23:25:51 2007 Attempting to establish TCP connection with 194.xxx.yyy.zzz:1723
Tue Feb 20 23:25:51 2007 TCP connection established with 194.xxx.yyy.zzz:1723
Tue Feb 20 23:25:51 2007 TCPv4_CLIENT link local: [undef]
Tue Feb 20 23:25:51 2007 TCPv4_CLIENT link remote: 194.xxx.yyy.zzz:1723
Tue Feb 20 23:26:51 2007 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Tue Feb 20 23:26:51 2007 TLS Error: TLS handshake failed
Tue Feb 20 23:26:51 2007 Fatal TLS error (check_tls_errors_co), restarting
Tue Feb 20 23:26:51 2007 TCP/UDP: Closing socket
Tue Feb 20 23:26:51 2007 SIGUSR1[soft,tls-error] received, process restarting
Tue Feb 20 23:26:51 2007 Restart pause, 5 second(s)
Tue Feb 20 23:26:56 2007 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA. OpenVPN 2.0-beta16 and earlier used 5000 as the default port.
Tue Feb 20 23:26:56 2007 Re-using SSL/TLS context
Tue Feb 20 23:26:56 2007 LZO compression initialized
Tue Feb 20 23:26:56 2007 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Tue Feb 20 23:26:56 2007 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Feb 20 23:26:56 2007 Local Options hash (VER=V4): '69109d17'
Tue Feb 20 23:26:56 2007 Expected Remote Options hash (VER=V4): 'c0103fa8'
Tue Feb 20 23:26:56 2007 Attempting to establish TCP connection with 194.xxx.yyy.zzz:1723
Tue Feb 20 23:26:56 2007 TCP connection established with 194.xxx.yyy.zzz:1723
Tue Feb 20 23:26:56 2007 TCPv4_CLIENT link local: [undef]
Tue Feb 20 23:26:56 2007 TCPv4_CLIENT link remote: 194.xxx.yyy.zzz:1723
Tue Feb 20 23:27:54 2007 TCP/UDP: Closing socket
Tue Feb 20 23:27:54 2007 SIGTERM[hard,] received, process exiting

Na serveru leze:

[root@PRAGA keys]# tail -F /var/log/openvpn.log
Tue Feb 20 23:24:51 2007 Re-using SSL/TLS context
Tue Feb 20 23:24:51 2007 LZO compression initialized
Tue Feb 20 23:24:51 2007 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET: 0 EL:0 ]
Tue Feb 20 23:24:51 2007 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET: 0 EL:0 AF:3/1 ]
Tue Feb 20 23:24:51 2007 Local Options hash (VER=V4): 'c0103fa8'
Tue Feb 20 23:24:51 2007 Expected Remote Options hash (VER=V4): '69109d17'
Tue Feb 20 23:24:51 2007 TCP connection established with 82.142.74.125:1884
Tue Feb 20 23:24:51 2007 TCPv4_SERVER link local: [undef]
Tue Feb 20 23:24:51 2007 TCPv4_SERVER link remote: 82.142.74.125:1884
Tue Feb 20 23:24:51 2007 82.142.74.125:1884 TLS: Initial packet from 82.142.74.1 25:1884, sid=dbe95364 aba465d8
Tue Feb 20 23:25:51 2007 82.142.74.125:1884 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Tue Feb 20 23:25:51 2007 82.142.74.125:1884 TLS Error: TLS handshake failed
Tue Feb 20 23:25:51 2007 82.142.74.125:1884 Fatal TLS error (check_tls_errors_co), restarting
Tue Feb 20 23:25:51 2007 82.142.74.125:1884 SIGUSR1[soft,tls-error] received, client-instance restarting
Tue Feb 20 23:25:51 2007 TCP/UDP: Closing socket
Tue Feb 20 23:25:57 2007 MULTI: multi_create_instance called
Tue Feb 20 23:25:57 2007 Re-using SSL/TLS context
Tue Feb 20 23:25:57 2007 LZO compression initialized
Tue Feb 20 23:25:57 2007 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Tue Feb 20 23:25:57 2007 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Feb 20 23:25:57 2007 Local Options hash (VER=V4): 'c0103fa8'
Tue Feb 20 23:25:57 2007 Expected Remote Options hash (VER=V4): '69109d17'
Tue Feb 20 23:25:57 2007 TCP connection established with 82.142.74.125:1889
Tue Feb 20 23:25:57 2007 TCPv4_SERVER link local: [undef]
Tue Feb 20 23:25:57 2007 TCPv4_SERVER link remote: 82.142.74.125:1889
Tue Feb 20 23:25:57 2007 82.142.74.125:1889 TLS: Initial packet from 82.142.74.125:1889, sid=5535254e 71e6b26f
Tue Feb 20 23:26:57 2007 82.142.74.125:1889 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Tue Feb 20 23:26:57 2007 82.142.74.125:1889 TLS Error: TLS handshake failed
Tue Feb 20 23:26:57 2007 82.142.74.125:1889 Fatal TLS error (check_tls_errors_co), restarting
Tue Feb 20 23:26:57 2007 82.142.74.125:1889 SIGUSR1[soft,tls-error] received, client-instance restarting
Tue Feb 20 23:26:57 2007 TCP/UDP: Closing socket
Tue Feb 20 23:27:02 2007 MULTI: multi_create_instance called
Tue Feb 20 23:27:02 2007 Re-using SSL/TLS context
Tue Feb 20 23:27:02 2007 LZO compression initialized
Tue Feb 20 23:27:02 2007 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Tue Feb 20 23:27:02 2007 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Feb 20 23:27:02 2007 Local Options hash (VER=V4): 'c0103fa8'
Tue Feb 20 23:27:02 2007 Expected Remote Options hash (VER=V4): '69109d17'
Tue Feb 20 23:27:02 2007 TCP connection established with 82.142.74.125:1900
Tue Feb 20 23:27:02 2007 TCPv4_SERVER link local: [undef]
Tue Feb 20 23:27:02 2007 TCPv4_SERVER link remote: 82.142.74.125:1900
Tue Feb 20 23:27:02 2007 82.142.74.125:1900 TLS: Initial packet from 82.142.74.125:1900, sid=1fd2ce2a 4f3b58c1
Tue Feb 20 23:28:00 2007 82.142.74.125:1900 Connection reset, restarting [-1]
Tue Feb 20 23:28:00 2007 82.142.74.125:1900 SIGUSR1[soft,connection-reset] received, client-instance restarting
Tue Feb 20 23:28:00 2007 TCP/UDP: Closing socket
to cele se neuspesne opakuje nema nekdo nejake voditko...

[Víťa]

Ahoj, mám obdobný problém, komunikace z routeru (3com) je pomocí dmz přesměrována na server prostě je-li klient v lokální síti vše šlape a certifikáty se ověří a ping na adresu serveru jede, jakmile se připojím z druhé strany, tj z internetu modemem, tak to dopadne takhle:

klient:

Mon Feb 26 16:00:53 2007 TLS: Initial packet from (routerIP):1194, sid=d2ebeb78 41e56961 Mon Feb 26 16:01:53 2007 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) Mon Feb 26 16:01:53 2007 TLS Error: TLS handshake failed Mon Feb 26 16:01:53 2007 TCP/UDP: Closing socket

server:

Mon Feb 26 15:59:19 2007 62.177.66.68:3447 TLS: Initial packet from 62.177.66.68:3447, sid=acce34bb c2d7eee3 Mon Feb 26 16:00:19 2007 62.177.66.68:3447 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) Mon Feb 26 16:00:19 2007 62.177.66.68:3447 TLS Error: TLS handshake failed Mon Feb 26 16:00:19 2007 62.177.66.68:3447 SIGUSR1[soft,tls-error] received, client-instance restarting

Poraďte prosím, kterým směrem se vydat pro vyřešení problému. Dík.

[Víťa]

Tak se mi podařilo se připojit i zvenčí, ale přes protokol tcp. Je mi sice záhadou, proč to přes udp nejede, prolezl jsem krabičku i firewall na serveru, ale snad to bude stačit. V každém případě stále uvítám jakýkoliv námět na toto téma, ona zase ta konfigurace openvpn tak jednoduchá není (alespoň ne pro lamy jako já )

[svaca]

Jsi si jisty, ze kdyz na serveru pouzivas directivu: comp-lzo, tak, zeji mas i v nastaveni klienta ??? Dale ten klient je ve windows ???

Jestli ano , zkontruluj virtualni zarizeni + mu dej uninstall a znova install.

[dejf]

Tak v mem pripade se nakonec zjistilo, ze problem zpusoboval ADSL router, po vymene vse funguje.

Vsem dekuju