☰

OpenVPN TLS 与 Linux 服务器/Windows 客户端握手失败

tag-icon • tag-icon 16.04 vpn windows-10 openvpn tls
OpenVPN TLS 与 Linux 服务器/Windows 客户端握手失败

我最近买了一台搭载 Ubuntu 16.04 操作系统的 Odroid C2。我安装了 OpenVPN，以便能够从任何地方访问我的家庭网络。我有 Samba 共享文件夹...

我遵循了本教程：https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-ubuntu-16-04

当我尝试使用适用于 Windows 的 OpenVPN GUI 将我的 Windows 10 客户端连接到服务器时，遇到了 TLS 问题。

TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
TLS Error: TLS handshake failed

OpenVPN GUI 日志：

Fri Jun 10 22:56:35 2016 OpenVPN 2.3.11 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on May 10 2016
Fri Jun 10 22:56:35 2016 Windows version 6.2 (Windows 8 or greater) 64bit
Fri Jun 10 22:56:35 2016 library versions: OpenSSL 1.0.1t  3 May 2016, LZO 2.09
Fri Jun 10 22:56:35 2016 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Fri Jun 10 22:56:35 2016 Need hold release from management interface, waiting...
Fri Jun 10 22:56:36 2016 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Fri Jun 10 22:56:36 2016 MANAGEMENT: CMD 'state on'
Fri Jun 10 22:56:36 2016 MANAGEMENT: CMD 'log all on'
Fri Jun 10 22:56:36 2016 MANAGEMENT: CMD 'hold off'
Fri Jun 10 22:56:36 2016 MANAGEMENT: CMD 'hold release'
Fri Jun 10 22:56:36 2016 Control Channel Authentication: tls-auth using INLINE static key file
Fri Jun 10 22:56:36 2016 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Jun 10 22:56:36 2016 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Jun 10 22:56:36 2016 Socket Buffers: R=[65536->65536] S=[65536->65536]
Fri Jun 10 22:56:36 2016 UDPv4 link local: [undef]
Fri Jun 10 22:56:36 2016 UDPv4 link remote: [AF_INET](My address IP):1194
Fri Jun 10 22:56:36 2016 MANAGEMENT: >STATE:1465613796,WAIT,,,
Fri Jun 10 22:57:36 2016 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Fri Jun 10 22:57:36 2016 TLS Error: TLS handshake failed
Fri Jun 10 22:57:36 2016 SIGUSR1[soft,tls-error] received, process restarting
Fri Jun 10 22:57:36 2016 MANAGEMENT: >STATE:1465613856,RECONNECTING,tls-error,,
Fri Jun 10 22:57:36 2016 Restart pause, 2 second(s)
Fri Jun 10 22:57:38 2016 Socket Buffers: R=[65536->65536] S=[65536->65536]
Fri Jun 10 22:57:38 2016 UDPv4 link local: [undef]
Fri Jun 10 22:57:38 2016 UDPv4 link remote: [AF_INET] (My address IP):1194
Fri Jun 10 22:57:38 2016 MANAGEMENT: >STATE:1465613858,WAIT,,,

我的客户端配置（.ovpn 文件）没有注释中的文本：

client
dev tun
proto udp
remote (My address IP) 1194
resolv-retry infinite
nobind
persist-tun
remote-cert-tls server
comp-lzo
verb 3
key-direction 1

(The ca.crt, the client.crt and the client.key files are include in the ovpn file)

我的服务器配置（server.conf）中没有注释文字：

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 10 120
tls-auth ta.key 0
key-direction 0
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3

在我的路由器上，我使用 Odroid IP 地址设置了 1194 端口的端口转发： 看图片

我也尝试了 TCP 协议，但它每 5 秒重试一次连接。

你能帮我吗！ ：）

答案1

如果您确定连接到的是正确的公共 IP 地址，则 Ubuntu 防火墙可能会阻止该连接。OpenVPN 适用于以下规则：

iptables -A INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 1194 -j ACCEPT
iptables -A INPUT -i tun+ -j ACCEPT
iptables -A OUTPUT -o tun+ -j ACCEPT

当然，还需要保存规则。Iptables-persistent 是一个很好的工具：

sudo apt-get install iptables-persistent

安装后，您可以随时保存/重新加载 iptables 规则：

sudo /etc/init.d/iptables-persistent save 
sudo /etc/init.d/iptables-persistent reload

为了进一步排除故障，您可以从服务器端监视流量，以查看是否有任何东西到达端口 1194：

sudo apt-get-install ngrep
ngrep port 1194

祝你好运

相关内容