1

I'm setting OpenVPN for the first time [on a derivative of pfSense OPNSense]

I see in my OpenVPN logs the message: "... TLS Error: TLS key negotiation failed ..."

Research has showed me that this is the most common error encountered by new implementers of OpenVPN. The error apparently stems from incorrect configuration of the firewall rules. I've been trying to troubleshoot these without much success. What (as a novice) I've noticed is that I've not found a comprehensive trouble shooting procedure which one can follow.

Would appreciate any points to such a troubleshooting resource.

Limit
  • 3,276
  • 1
  • 17
  • 36
user1172468
  • 111
  • 3
  • 1
    a comprehensive trouble shooting procedure Writing one for all people is impossible. There are many firewalls with many UIs, and many possible network layouts and related steps. – deviantfan Dec 18 '16 at 08:08

1 Answers1

1

According to https://openvpn.net/index.php/open-source/faq/79-client/253-tls-error-tls-key-negotiation-failed-to-occur-within-60-seconds-check-your-network-connectivity.html, this message not only occurs if the key negotiation failed because of some crypto-related reasons or whatever, but also if getting any network connection to the other host failed.

Can you ping the other host and/or get a connection on any other port where a server is running?

Yes: All relevant firewalls need to allow connection on UDP 1194 too, eg. firewalls in network hardware and/or installed on your computer (eg. the Windows builtin one).
How it is configured depends very much on the used firewall.

No: Depending on your network structure, it may be necessary to add NAT port forwarding rules and/or static routes. Or maybe a cable is not plugged in...
In this case, it's necessary to get your network layout to tell you more.

deviantfan
  • 3,854
  • 22
  • 22