[SOLVED] OpenVPN

[Tripple_Delta]

Hi,

I've setup OpenVPN on my OPNsense box a while ago. Updated the system whenever available.

I can always connect to my OPNsense box. But at work, the last month or so, I'm no longer able to. Not with Windows, IOS or Linux. The logfile shows all sorts of errors.

Here are some:
Sep 27 14:00:59 firewall openvpn[26241]: WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1558', remote='link-mtu 1542'
Sep 27 14:00:59 firewall openvpn[26241]: WARNING: 'cipher' is used inconsistently, local='cipher AES-128-CBC', remote='cipher BF-CBC'
Sep 27 14:00:59 firewall openvpn[26241]: Peer Connection Initiated with [AF_INET]
Sep 27 14:00:59 firewall openvpn[26241]: MULTI_sva: pool returned IPv4=192.168.10.6, IPv6=(Not enabled)
Sep 27 14:01:01 firewall openvpn[26241]: Authenticate/Decrypt packet error: cipher final failed
Sep 27 14:01:02 firewall openvpn[26241]: Authenticate/Decrypt packet error: cipher final failed

Where do I have to start? At work or on my OPNsense box?

[bartjsmit]

download the VPN config for your user again and compare the cipher lines. I reckon that's what stops the connection being established.

Bart...

[Tripple_Delta]

When using Wireshark I see this happen:

OpenVPN  MessageType: P_CONTROL_HARD_RESET_CLIENT_V2

Followed by:
ICMP  Destination unreachable (Port unreachable)

So I guess the NAT router is blocking incoming UDP traffic in some way.

[bartjsmit]

If OPNsense is behind another firewall, you'll need to ensure that the OpenVPN traffic can get through. By default this is UDP 1194.

It is preferred to have OPNsense as the peripheral firewall, perhaps with a PPPoE connection to a DSL modem.

Bart...

[Tripple_Delta]

I guess it relies on the other side, the router at the company I try to connect from.
Nothing to do with OPNsense.

Not solved yet, but one step further. :-)

[bartjsmit]

You could use one of the commonly allowed ports, such as TCP 443 or UDP 53 instead of the default, although it's usually best to speak to the firewall administrator on the other end.

Bart...

[Tripple_Delta]

Fixed  :)

Some strange behavior on the USG60 router NAT settings.
This is why I love OPNsense  ;)