1

I've been trying to set up openvpn with a vps and raspberry pi. The raspi is natted while the vps is public. I've tried connecting to the openvpn from mint laptop as well, but it's no use: Server config:

dev tun
tls-server
dh /etc/openvpn/dh2048.pem
ca /etc/openvpn/cacert.pem
cert /etc/openvpn/vpn.wilhelm.co.za.crt
key /etc/openvpn/vpn.wilhelm.co.za.key
server 10.8.0.0 255.255.255.0
client-to-client
duplicate-cn
cipher AES-128-CBC
status openvpn-status.log
log-append openvpn.log
comp-lzo
mute 20
port 20
proto udp
push "redirect-gateway"
client-config-dir ccd
route 10.0.0.0 255.255.255.0
push "route 10.0.0.0 255.255.255.0"

Client config:

client
dev tun
proto udp
remote vpn.wilhelm.co.za 20
resolv-retry infinite
nobind
persist-key
persist-tun
ca cacert.pem
cert client.crt
key client.key
comp-lzo
verb 3
mute 20

What I've done: Laptop:

my-lat wilhelm # openvpn --client --ca /cacert.pem --key erasmuswill.key --cert erasmuswill.crt --remote vpn.wilhelm.co.za 20 --dev tun --tls-client --verb 3
Thu Apr 16 21:00:14 2015 OpenVPN 2.3.2 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Dec  1 2014
Thu Apr 16 21:00:14 2015 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Enter Private Key Password:
Thu Apr 16 21:00:18 2015 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Thu Apr 16 21:00:18 2015 WARNING: file 'erasmuswill.key' is group or others accessible
Thu Apr 16 21:00:18 2015 Socket Buffers: R=[212992->131072] S=[212992->131072]
Thu Apr 16 21:00:18 2015 UDPv4 link local (bound): [undef]
Thu Apr 16 21:00:18 2015 UDPv4 link remote: [AF_INET]107.182.132.16:20
Thu Apr 16 21:00:19 2015 TLS: Initial packet from [AF_INET]107.182.132.16:20, sid=97c7f438 95342f30
Thu Apr 16 21:00:24 2015 VERIFY OK: depth=1, CN=LOLVE
Thu Apr 16 21:00:24 2015 VERIFY OK: depth=0, C=ZA, ST=Gauteng, L=Kenmare, O=LOLVE, OU=SSL, CN=vpn.wilhelm.co.za, emailAddress=vpn@wilhelm.co.za
Thu Apr 16 21:01:18 2015 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Thu Apr 16 21:01:18 2015 TLS Error: TLS handshake failed
Thu Apr 16 21:01:18 2015 SIGUSR1[soft,tls-error] received, process restarting
Thu Apr 16 21:01:18 2015 Restart pause, 2 second(s)
Thu Apr 16 21:01:20 2015 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Thu Apr 16 21:01:20 2015 WARNING: file 'erasmuswill.key' is group or others accessible
Thu Apr 16 21:01:20 2015 Socket Buffers: R=[212992->131072] S=[212992->131072]
Thu Apr 16 21:01:20 2015 UDPv4 link local (bound): [undef]
Thu Apr 16 21:01:20 2015 UDPv4 link remote: [AF_INET]107.182.132.16:20
Thu Apr 16 21:01:20 2015 TLS: Initial packet from [AF_INET]107.182.132.16:20, sid=0a42191c d09c3f10
Thu Apr 16 21:01:25 2015 VERIFY OK: depth=1, CN=LOLVE
Thu Apr 16 21:01:25 2015 VERIFY OK: depth=0, C=ZA, ST=Gauteng, L=Kenmare, O=LOLVE, OU=SSL, CN=vpn.wilhelm.co.za, emailAddress=vpn@wilhelm.co.za
^CThu Apr 16 21:02:00 2015 event_wait : Interrupted system call (code=4)
Thu Apr 16 21:02:00 2015 SIGINT[hard,] received, process exiting
my-lat wilhelm #

Server:

==> openvpn.log <==
Thu Apr 16 15:01:46 2015 105.210.95.124:1024 TLS_ERROR: BIO read tls_read_plaintext error: error:1408E098:SSL routines:SSL3_GET_MESSAGE:excessive message size
Thu Apr 16 15:01:46 2015 105.210.95.124:1024 TLS Error: TLS object -> incoming plaintext read error
Thu Apr 16 15:01:46 2015 105.210.95.124:1024 TLS Error: TLS handshake failed

My end goal is to have the pi connected to the vpn, bridging the local lan to the vpn, and then having the laptop connect to the vpn for both secure internet browsing via the vps(nat) and local lan access.

|improve this question

migrated from serverfault.com Apr 17 '15 at 9:22

This question came from our site for system and network administrators.

  • BTW end goals are not of great importance at the moment, I just need to get the tun interface up. tun interface is obviously not up after running the command on either pi or laptop. – Wilhelm Erasmus Apr 16 '15 at 19:09
  • What type, and how large (bits) of a key are you using? That message can be caused by using a key larger than OpenSSL likes (or possibly using an algorithm it doesn't support). – derobert Apr 17 '15 at 9:57
1

I've found the problem: my key sizes were way too large. I am now using 2048 bit successfully. Obviously 8192 bits is a bit too much for openvpn

|improve this answer
  • For RSA, 2048 bits is currently a reasonable size (the US and French government both allow this key size for data that needs to be protected until 2030). 8192 bits would be very slow even on a beefy PC if it was supported, and wouldn't provide more security in any practical terms. – Gilles Apr 17 '15 at 21:34
  • @Gilles I always like going extreme with security though :P – Wilhelm Erasmus Apr 18 '15 at 20:57
  • Increasing the number of bits in a key does not improve security, once you've reached the threshold where it's unbreakable. Crypto itself is almost never where breaches happen — it's key storage and distribution, access control, buggy software, etc. – Gilles Apr 18 '15 at 20:59
  • @Gilles i guess so, but I'm really paranoid anyway. With the power some governments, etc. have available, I'm not willing to take the chance. I know it is considered unbreakable, and is thus wasteful to use such a high size, but it allows for my certificates to be okay if some sudden advance should render rsa keys easier to brute-force. Future-proofing if you like.f – Wilhelm Erasmus Apr 18 '15 at 21:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.