OpenVPN timing out?

The_Great_Sephiroth · Posted: Fri Aug 17, 2018 3:52 pm Post subject: OpenVPN timing out?

I have an OpenVPN server setup at a client location and am trying to get it to work. I created the CA, server key, client key for me, etc. Server is running. However, whenever I attempt to connect I get the following.

szatox · Advocate Joined: 27 Aug 2013 Posts: 3136

The_Great_Sephiroth · Posted: Sun Aug 19, 2018 3:50 pm Post subject:

Not sure how to switch to TCP server-side. The host is a DD-WRT router. I have it running PPTP as well so I can work on it remotely. I'll look into switching it and see what I can come up with.
_________________
Ever picture systemd as what runs "The Borg"?

The_Great_Sephiroth · Posted: Mon Aug 20, 2018 11:22 pm Post subject:

OK, seems to be a bug in starting it. After a reboot the firewall rules showed up in iptables. Apparently simply saving then applying the changes does not add the rules. I will be testing the connection soon. Cannot do it just yet.
_________________
Ever picture systemd as what runs "The Borg"?

The_Great_Sephiroth · Posted: Thu Aug 23, 2018 4:40 am Post subject:

OK, I figured it out. The issue is with one of the pem files. My issue is that I cannot find a single guide for using this stupid easy-rsa script! It doesn't follow the guide on the actual OpenVPN site! They keep referencing "./build whatever" and there is no build script. I have one single script called "easy-rsa" and I am apparently using it incorrectly. Debian still has the ./build stuff but this version doesn't.

Where on earth can I find a guide to creating my certificates with this new script? I have been all over the OpenVPN site and cannot find ANYTHING about this script. Is this really so new that no documentation exists? Can I downgrade to something which works (the entire planet has a million guides for this, but none use this script!) so I can at least get myself up and running? I've blown almost two weeks on this and I am finally throwing in the towel and asking for help. It's incredibly frustrating that a million guides exist and none teach you how to use this crappy script!
_________________
Ever picture systemd as what runs "The Borg"?

The_Great_Sephiroth · Posted: Thu Aug 23, 2018 3:01 pm Post subject:

OK, I found a guide. I had to search for "easy-rsa 3". The problem with this guide is that it expects you to have one machine for the CA, various servers, and then clients. Why is this so difficult? One guide that uses one machine to generate ALL certificates is all I am asking for! Now I have to try to piece this one together. Seriously, they expect you to create certificates across three separate machines? Maybe this is too convoluted for commercial use.
_________________
Ever picture systemd as what runs "The Borg"?

eccerr0r · Posted: Thu Aug 23, 2018 3:20 pm Post subject:

easy-rsa worked for me a while ago when I was building keys, and I made all keys (CA, server, client) on just one machine...

I've forgotten but was able to sign a key using the key generated with easy-rsa as well, it's openssl wrappers.

I doubt key generation is the root of the problem you're seeing however. I thought that it would report bad keys explicitly if they don't match what's expected? Not sure.

(This may have been easy-rsa v2, it's been a long time...)
_________________
Intel Core i7 2700K/Radeon R7 250/24GB DDR3/256GB SSD
What am I supposed watching?

The_Great_Sephiroth · Posted: Thu Aug 23, 2018 7:25 pm Post subject:

I used easy-rsa 2 a while back without a hitch due to virtually every guide being aimed at using it and one computer to generate everything. I have no clue who was smoking the good stuff when the version 3 guide was written, but they seriously expect you to generate a request on each client machine, which is impossible for me. That would require me to go to hundreds of individuals homes, install this crap, then generate the request there. It makes absolutely no sense how this guide was written. I need to generate certificates and keys, then distribute them at the place of work to all employees who have VPN access.

*EDIT*

The guide is linked below and is utterly ridiculous. It literally instructs you to go to each client machine (can we say months of travel?), generate a request, ferry those to the CA machine, sign them, then ferry them back, and then use the VPN. Yeah, VPN setup is supposed to take a year or more now. Great...

The fundamentally flawed v3 guide

*EDIT*

OK, I found one that shows how to do this from a single machine. Much better.

The correct method which doesn't require 50,000gal of fuel to accomplish!
_________________
Ever picture systemd as what runs "The Borg"?

szatox · Advocate Joined: 27 Aug 2013 Posts: 3136

Hu · Moderator Joined: 06 Mar 2007 Posts: 21633

joanandk · Apprentice Joined: 12 Feb 2017 Posts: 169

eccerr0r · Posted: Fri Aug 24, 2018 1:25 pm Post subject:

I think that the hate for UDP is not necessarily the VPN implementer but rather the network infrastructure. As UDP is stateless, the problem is for NAT routers that despite UDP being stateless, needs to still keep state for them and would rather drop them to keep things simple.

I was trying to use OpenVPN to connect back to my home network, however found that many hotspots filter simply filter UDP, so I was forced to implement TCP tunneling. UDP works so much better ... except when they get filtered.
_________________
Intel Core i7 2700K/Radeon R7 250/24GB DDR3/256GB SSD
What am I supposed watching?

The_Great_Sephiroth · Posted: Fri Aug 24, 2018 4:00 pm Post subject:

Hu, the network is at a clients office. The "remote systems" are Windows 7, 8, 8.1, and 10 at people's homes. SSH is out. Hell, almost everything is out due to this being home users using the network remotely. I literally need to do this on-site at the office and give each user their certificate and key on USB stick. No real way around it.
_________________
Ever picture systemd as what runs "The Borg"?

szatox · Advocate Joined: 27 Aug 2013 Posts: 3136

Hu · Moderator Joined: 06 Mar 2007 Posts: 21633

The_Great_Sephiroth · Posted: Sun Aug 26, 2018 3:05 am Post subject:

I found a guide that details how to do it on a single PC. It is then up to me to secure the certificates and such, which I can easily do. The script isn't the issue, it was that the "official" guide was literally asking me to burn hundred of gallons of fuel in that it asked me to go to every users' PC and generate the requests, run to the server, accept them, and then run around again. Not happening. I am good now though.

I also don't know what the issue with UDP is. I do a LOT with UDP including gaming. Never had any issues.
_________________
Ever picture systemd as what runs "The Borg"?

Hu · Moderator Joined: 06 Mar 2007 Posts: 21633

The original guide told you how to do it properly: private keys kept private by not copying them anywhere, ever. It implicitly assumed that every system is just an ssh away from your console. If your environment isn't that convenient, then that guide is not a good fit for you.

eccerr0r · Posted: Sun Aug 26, 2018 10:51 pm Post subject:

Supposedly the original guide should have told the remote people to generate a key and send you a CSR (with public key) -- without their private key.

You should then sign the CSR and send the certificate back to them. They should now use their private key and certificate to sign into your VPN.

This way it should be secure as long as you trust the CSR coming to you, and you don't need to drive to the remote sites.

You can give them keys too as you're doing now, this also requires that the key does not get disclosed over the network.
_________________
Intel Core i7 2700K/Radeon R7 250/24GB DDR3/256GB SSD
What am I supposed watching?

szatox · Advocate Joined: 27 Aug 2013 Posts: 3136

The_Great_Sephiroth · Posted: Tue Aug 28, 2018 10:40 pm Post subject:

Yes, the OS on the router needs an upgrade. The OpenVPN server does not like the shiny, new keys and certificates generated here in Gentoo. I am hoping to go on-site tomorrow to upgrade it and report back that I am good.

Eccerr0r, you actually believe a commoner who struggles to turnt he PC on can type ANYTHING? If I showed them instructions for downloading that crap the first stop would be "I click it but it don't do nuffin'!". Then after getting it installed, it would be "You mean I gotta' type sumfin'?!" followed by "I type it right but it no work" while clearly they're not typing it correctly. Seriously, average users in Windows are almost as brain-dead as Mac users these days. If you can't click on it with the mouse and have the whole damn process done, they cannot handle it.

I have actually been told by my boss I talk down to people by using words like "cable modem" and "router" instead of "Internet box" and "other box". He doesn't care, but I have people complain that that type of lingo is too technical. Seriously, either I do this or it would NEVER get done.
_________________
Ever picture systemd as what runs "The Borg"?

Hu · Moderator Joined: 06 Mar 2007 Posts: 21633

Users may come into the business with no skill, but letting them remain unskilled is a disservice to them (not that they know it) and to everyone forced to deal with them. Educating them on proper terminology is not easy, but is a worthwhile task, in my opinion.

The_Great_Sephiroth · Posted: Wed Aug 29, 2018 4:32 pm Post subject:

I agree, but remember, everybody is a snowflake now. You try to teach a term and you get blasted for "talking down to them" or "talking so I cannot understand". It's non-sense. I hate the area I live in and want to move out west to Texas.
_________________
Ever picture systemd as what runs "The Borg"?