Community discussions

MikroTik App
 
jsuch
just joined
Topic Author
Posts: 1
Joined: Tue Jun 04, 2024 3:28 pm

OpenVPN (client mode) TLS-handshake error

Tue Jun 04, 2024 4:03 pm

Hello,

I would like to connect a MT router (ROS 7.14.3) to remote OVPN server. My .ovpn config looks like this:
client
proto udp
explicit-exit-notify
remote AAA.AAA.AAA.AAA PPPP
dev tun
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
verify-x509-name XYZ name
auth SHA256
auth-nocache
cipher AES-128-GCM
tls-client
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
ignore-unknown-option block-outside-dns
setenv opt block-outside-dns # Prevent Windows 10 DNS leak
verb 3
<ca>
-----BEGIN CERTIFICATE-----
..........
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
..........
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
..........
-----END PRIVATE KEY-----
</key>
key-direction 1
<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
..........
-----END OpenVPN Static key V1-----
</tls-auth>

It was imported by WinBox successful (i.e. it did not report any errors). Nevertheless, 30 seconds (timeout?) after enabling the interface I see error:
 terminating... - TLS error: handshake timed out (6)

The same config works great on Linux OVPN client on my laptop (especially tested it) so one can rule out an issue on the server's side.
 
gheorghe
just joined
Posts: 2
Joined: Tue Jun 04, 2024 3:56 am

Re: OpenVPN (client mode) TLS-handshake error

Tue Jun 04, 2024 6:12 pm

I use ROS 7.15.
In my case, although is not as safe (but I hope to be safe enough), the solution was to remove this part from the config:
key-direction 1
<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
..........
-----END OpenVPN Static key V1-----
</tls-auth>
and disable tls on the server side also.

In other words, I rely on certificate/private_key+password for authentication and encryption. I am not absolutely sure but I hope to be safe enough. In my case, although I tried to make it work with cert+pass+tls, it didn't worked no matter how much I tried, so I had to use only cert/key+pass.
As I understood, tls is just a supplementary layer of security (it seems that was recently added but not fully functional). Tls-auth strengthens the pre-authentication and negotiation phase, but encryption based on the cert/key+pass hope to be safe enough anyway. Please note that only key/cert won't work since mikrotik asks for cert+pass for security reasons.


You can disable tls in order to make it work and have a starting point. At least you will know what part of the config causes the error. You can then try to add tls and try to make it work with tls also.
Maybe an update will fix this in the near future.
 
User avatar
abbio90
Member
Member
Posts: 447
Joined: Fri Aug 27, 2021 9:16 pm
Location: Oristano
Contact:

Re: OpenVPN (client mode) TLS-handshake error

Tue Jun 04, 2024 11:12 pm

it could be an mtu problem. test by decreasing the mtu.