Score:0

OpenVPN TLS handshake fails, no log messages

cn flag

I have set up an OpenVPN server (version 2.5.9) on CentOS (Stream 9) and several clients. Unfortunately, clients always log this error message:

2023-04-14 09:24:21 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
2023-04-14 09:24:21 TLS Error: TLS handshake failed

On the server I have set the logging verbosity to 9 and verified with tcpdump that UDP packets for negotiation are properly received by the clients. I have verified, that the SE Linux status on the server is set to permissive. However, the problem persists and there is no useful error message in the server logs.

How can I identify the source of the error?

Update: The tcpdump on the server indeed shows that packets are NOT sent from the server, only received by the server. However, I don't know why that is the case. SELinux mode is set to "permissive", and iptables -L does not show any blocking rules. traceroute (which, according to my understanding uses UDP packets) works fine from the clients.

Update 2: Ok, I figured it out. The firewall-cmd did not have the service enabled. Everything works fine after adding that one!

user1686 avatar
fr flag
Did you verify both that packets sent by server are received by tcpdump on client, and that packets sent by client are shown in tcpdump on server? Do the clients have any firewall rules (iptables or nftables) that would drop the packets before the usual "established accept"?
user8472 avatar
cn flag
@user1686 Good catch! I have, in fact, only verified one way (client -> server). I'll check the other direction and then report back.
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.