Connection refused - VPN - Urgente!

rensantos
(usa Ubuntu)

Enviado em 16/03/2015 - 09:44h

Bom dia pessoal,

Estou com um problema urgentíssimo.
Troquei de servidor nesse final de semana e fiz os testes no domingo, com um ip, mas agora quando subo a vpn não está dando certo, as filiais estão todas fora, sem conseguir acessar o sistema aqui na matriz, alguém pode me dar uma ajuda, por favor?

As configurações do meu servidor:

##Protocolo de conexão

#proto tcp / proto udp

proto udp

# Porta do servico (padrao openvpn)

port 51001

# Drive da interface

dev tun

# Seguranca na VPN

script-security 2

# Configura o IP do Tunel

ifconfig 172.32.1.1 172.32.1.2

# Acrescenta rotas aos clientes, informações da rede local

push "route 192.168.1.0 255.255.255.0"

# Compactacao lib LZO

comp-lzo

# Pinga a cada 10 segundos e derruba a conexao apos 120 segundos

keepalive 10 120

float

#ifconfig-pool-persist ipp.txt

max-clients 1

persist-key

persist-tun

log-append /var/log/openvpn.log

verb 3

# Servidor TLS

tls-server

# Chaves necessarias

dh /etc/openvpn/keys/dh1024.pem

ca /etc/openvpn/keys/ca.crt

cert /etc/openvpn/keys/matriz.crt

key /etc/openvpn/keys/matriz.key

# Chave secreta do servidor

#tls-auth /etc/openvpn/keys/chave.key

status /var/log/openvpn.stats

# Executa scripts

up /etc/openvpn/scripts/filial1.sh

 

E da filial:

client

dev tun

proto udp

remote x.x.x.x --> o ip está certo

port 51001

pull

comp-lzo

keepalive 10 120

float

tls-client

persist-tun

persist-key

dh /etc/openvpn/keys/dh1024.pem

ca /etc/openvpn/keys/ca.crt

cert /etc/openvpn/keys/filial1.crt

key /etc/openvpn/keys/filial1.key

tls-auth /etc/openvpn/keys/chave.key

route-method exe

route-delay 2

script-security 2

remote-cert-tls server

ifconfig 172.32.1.2 172.32.1.1

log /etc/openvpn/filial1.log

 

Deixei essas regras nos 2 firewalls:

 /sbin/iptables -A INPUT -p udp --dport 51001 -j ACCEPT

 /sbin/iptables -A FORWARD -p udp --dport 51001 -j ACCEPT

 /sbin/iptables -A OUTPUT -p udp --dport 51001 -j ACCEPT

 /sbin/iptables -A INPUT -p udp --sport 51001 -j ACCEPT

 /sbin/iptables -A FORWARD -p udp --sport 51001 -j ACCEPT

 /sbin/iptables -A OUTPUT -p udp --sport 51001 -j ACCEPT

 

E na filial1 não sobe a interface da vpn (tun0)

Esse e o log na filial:

Mon Mar 16 09:42:09 2015 OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Dec  1 2014

Mon Mar 16 09:42:09 2015 WARNING: using --pull/--client and --ifconfig together is probably not what you want

Mon Mar 16 09:42:09 2015 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts

Mon Mar 16 09:42:09 2015 Control Channel Authentication: using '/etc/openvpn/keys/chave.key' as a OpenVPN static key file

Mon Mar 16 09:42:09 2015 LZO compression initialized

Mon Mar 16 09:42:09 2015 UDPv4 link local (bound): [undef]

Mon Mar 16 09:42:09 2015 UDPv4 link remote: [AF_INET]x.x.x.x:51001

Mon Mar 16 09:42:09 2015 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)

Mon Mar 16 09:42:11 2015 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)

Mon Mar 16 09:42:15 2015 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)

Mon Mar 16 09:42:23 2015 TLS Error: cannot locate HMAC in incoming packet from [AF_INET]x.x.x.x:51001

Mon Mar 16 09:42:25 2015 TLS Error: cannot locate HMAC in incoming packet from [AF_INET]x.x.x.x:51001

Mon Mar 16 09:42:29 2015 TLS Error: cannot locate HMAC in incoming packet from [AF_INET]x.x.x.x:51001

Mon Mar 16 09:42:37 2015 TLS Error: cannot locate HMAC in incoming packet from [AF_INET]x.x.x.x:51001

 

Obs.: o x.x.x.x é o ip da matriz

E aqui o log no servidor:

Tue Jan  1 20:20:05 2002 Socket Buffers: R=[229376->131072] S=[229376->131072]

Tue Jan  1 20:20:05 2002 Preserving previous TUN/TAP instance: tun0

Tue Jan  1 20:20:05 2002 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]

Tue Jan  1 20:20:05 2002 Local Options hash (VER=V4): '09ead35e'

Tue Jan  1 20:20:05 2002 Expected Remote Options hash (VER=V4): '32ab9cc9'

Tue Jan  1 20:20:05 2002 UDPv4 link local (bound): [undef]

Tue Jan  1 20:20:05 2002 UDPv4 link remote: [undef]

Tue Jan  1 20:20:05 2002 TLS: Initial packet from [AF_INET]y.y.y.y:51001, sid=03acb6bb b6cac87c

Tue Jan  1 20:20:05 2002 TLS Error: reading acknowledgement record from packet

Tue Jan  1 20:20:21 2002 TLS Error: reading acknowledgement record from packet

Tue Jan  1 20:20:53 2002 TLS: new session incoming connection from [AF_INET]y.y.y.y:51001

Tue Jan  1 20:20:53 2002 TLS Error: reading acknowledgement record from packet

Tue Jan  1 20:20:55 2002 TLS Error: reading acknowledgement record from packet

Tue Jan  1 20:20:59 2002 TLS Error: reading acknowledgement record from packet

 

Obs.: o y.y.y.y é o ip da filial1
O que estou fazendo de errado?

rensantos
(usa Ubuntu)

Enviado em 16/03/2015 - 10:02h

Olha o que eu já achei de errado (o que a pressa faz com uma pessoa):
Descomentei a segunda linha abaixo, na matriz, que estava comentada e tinha na filial:

# Chave secreta do servidor

tls-auth /etc/openvpn/keys/chave.key

 

Agora o log da matriz:

Tue Jan  1 20:38:48 2002 Socket Buffers: R=[229376->131072] S=[229376->131072]

Tue Jan  1 20:38:48 2002 Preserving previous TUN/TAP instance: tun0

Tue Jan  1 20:38:48 2002 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]

Tue Jan  1 20:38:48 2002 Local Options hash (VER=V4): '7b726282'

Tue Jan  1 20:38:48 2002 Expected Remote Options hash (VER=V4): 'ebe38598'

Tue Jan  1 20:38:48 2002 UDPv4 link local (bound): [undef]

Tue Jan  1 20:38:48 2002 UDPv4 link remote: [undef]

Tue Jan  1 20:38:48 2002 TLS Error: Unroutable control packet received from [AF_INET]y.y.y.y:51001 (si=3 op=P_CONTROL_V1)

Tue Jan  1 20:38:49 2002 TLS Error: Unroutable control packet received from [AF_INET]y.y.y.y:51001 (si=3 op=P_CONTROL_V1)

Tue Jan  1 20:38:50 2002 TLS Error: Unroutable control packet received from [AF_INET]y.y.y.y:51001 (si=3 op=P_CONTROL_V1)

Tue Jan  1 20:38:51 2002 TLS Error: Unroutable control packet received from [AF_INET]y.y.y.y:51001 (si=3 op=P_CONTROL_V1)

Tue Jan  1 20:38:52 2002 TLS Error: Unroutable control packet received from [AF_INET]y.y.y.y:51001 (si=3 op=P_CONTROL_V1)

Tue Jan  1 20:38:53 2002 TLS Error: Unroutable control packet received from [AF_INET]y.y.y.y:51001 (si=3 op=P_CONTROL_V1)

Tue Jan  1 20:38:54 2002 TLS Error: Unroutable control packet received from [AF_INET]y.y.y.y:51001 (si=3 op=P_CONTROL_V1)



 

E da filial:

Mon Mar 16 10:00:25 2015 OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Dec  1 2014

Mon Mar 16 10:00:25 2015 WARNING: using --pull/--client and --ifconfig together is probably not what you want

Mon Mar 16 10:00:25 2015 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts

Mon Mar 16 10:00:25 2015 Control Channel Authentication: using '/etc/openvpn/keys/chave.key' as a OpenVPN static key file

Mon Mar 16 10:00:25 2015 LZO compression initialized

Mon Mar 16 10:00:25 2015 UDPv4 link local (bound): [undef]

Mon Mar 16 10:00:25 2015 UDPv4 link remote: [AF_INET]x.x.x.x:51001

Mon Mar 16 10:00:27 2015 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)

 

Ainda assim não conecta, na matriz sobe a tun0, mas na filial não.

jcoli
(usa Debian)

Enviado em 16/03/2015 - 10:17h

Eu tive esse problema.

Troquei o protocolo para tcp. Resolveu.


Jeferson Coli
---------------------
www.tecnocoli.com.br

rensantos
(usa Ubuntu)

Enviado em 16/03/2015 - 10:33h

Oi Jeferson, troquei como você falou, agora na matriz o log está atualizando assim:

Tue Jan  1 21:08:11 2002 TCP connection established with [AF_INET]y.y.y.y:46416

Tue Jan  1 21:08:11 2002 TCPv4_SERVER link local (bound): [undef]

Tue Jan  1 21:08:11 2002 TCPv4_SERVER link remote: [AF_INET]y.y.y.y:46416

Tue Jan  1 21:08:11 2002 TLS: Initial packet from [AF_INET]y.y.y.y:46416, sid=d29d6e59 9204e8a7

Tue Jan  1 21:08:11 2002 VERIFY ERROR: depth=1, error=certificate is not yet valid: /C=BR/ST=PR/L=Cidade/O=Empresa/OU=changeme/CN=changeme/name=changeme/emailAddress=mail@host.domain

Tue Jan  1 21:08:11 2002 TLS_ERROR: BIO read tls_read_plaintext error: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned

Tue Jan  1 21:08:11 2002 TLS Error: TLS object -> incoming plaintext read error

Tue Jan  1 21:08:11 2002 TLS Error: TLS handshake failed

Tue Jan  1 21:08:11 2002 Fatal TLS error (check_tls_errors_co), restarting

Tue Jan  1 21:08:11 2002 TCP/UDP: Closing socket

Tue Jan  1 21:08:11 2002 SIGUSR1[soft,tls-error] received, process restarting

Tue Jan  1 21:08:11 2002 Restart pause, 1 second(s)

Tue Jan  1 21:08:12 2002 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts

Tue Jan  1 21:08:12 2002 Re-using SSL/TLS context

Tue Jan  1 21:08:12 2002 LZO compression initialized

Tue Jan  1 21:08:12 2002 Control Channel MTU parms [ L:1544 D:168 EF:68 EB:0 ET:0 EL:0 ]

Tue Jan  1 21:08:12 2002 Socket Buffers: R=[87380->131072] S=[16384->131072]

Tue Jan  1 21:08:12 2002 Preserving previous TUN/TAP instance: tun0

Tue Jan  1 21:08:12 2002 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]

Tue Jan  1 21:08:12 2002 Local Options hash (VER=V4): 'd595669d'

Tue Jan  1 21:08:12 2002 Expected Remote Options hash (VER=V4): 'fa5b43c2'

Tue Jan  1 21:08:12 2002 Listening for incoming TCP connection on [undef]

 

E na filial, assim:

Mon Mar 16 10:33:27 2015 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts

Mon Mar 16 10:33:27 2015 Re-using SSL/TLS context

Mon Mar 16 10:33:27 2015 LZO compression initialized

Mon Mar 16 10:33:27 2015 Attempting to establish TCP connection with [AF_INET]x.x.x.x:51001 [nonblock]

Mon Mar 16 10:33:28 2015 TCP connection established with [AF_INET]x.x.x.x:51001

Mon Mar 16 10:33:28 2015 TCPv4_CLIENT link local: [undef]

Mon Mar 16 10:33:28 2015 TCPv4_CLIENT link remote: [AF_INET]x.x.x.x:51001

Mon Mar 16 10:33:28 2015 Connection reset, restarting [0]

Mon Mar 16 10:33:28 2015 SIGUSR1[soft,connection-reset] received, process restarting

 

E ainda não subiu a tun0 na filial.
Esse do certificado, na matriz, o que pode ser? Eu conferi, os arquivos estão certos tb.

jcoli
(usa Debian)

Enviado em 16/03/2015 - 11:09h

Agora parece erro de certificado mesmo.


Só para esclarecer, eu montei a VPN para uma empresa usando o UDP. Eles mudaram de local e a internet não ficou lá essas coisas.
Não era 100% das vezes, mas esta sempre com esse erro.

Mudei para tcp, acabou o problema. Eu acho que como a internet é ruim, há muita perda de pacote.

Eu utilizo para conexões remotas de usuários, mas não muda quase nada.

meus scripts:
server:
port 1194
proto tcp
mssfix 1400
dev tun
tls-server

ca certs/ca.crt
cert certs/server.crt
key keys/server.key
dh keys/dh2048.pem

# Rede usada pelo tunel openvpn
server 10.254.0.0 255.255.255.0

# define o arquivo onde sera guardados os ips que os clientes obtiverem na conexao, assim os mesmos sempre irao pegar os
# mesmos ips
ifconfig-pool-persist ipp.txt

# Define a rota para a rede da filial poder enxergar a rede da matriz
push "route-delay 2 600"
push "route 192.168.0.0 255.255.255.0"
ping-timer-rem
keepalive 10 120

# Tipo de criptografia usada
cipher DES-EDE3-CBC

# habilita compressão no link VPN
comp-lzo

# Numero maximo de clientes (filiais)
max-clients 10

# usuário e grupo sob o qual o openvpn ira rodar
#user nobody
#group nogroup

script-security 2
username-as-common-name
client-cert-not-required
plugin /usr/lib/openvpn/openvpn-auth-ldap.so /etc/openvpn/auth/ldap.conf

# Permite um restart sem fechar a conexão e re-ler as chaves
persist-key
persist-tun

# Log de status das conexoes
status /var/log/openvpn/status.log

# define um arquivo de log, pois o default é o /var/log/syslog
log /var/log/openvpn/openvpn.log
log-append /var/log/openvpn/openvpn.log

verb 6

# desabilita mensagens repetitivas, ou seja, erros ou conexoes em sequencia
# acima de 20, ele dropa.
mute 20

client:

float
port 1194
dev tun
proto tcp
comp-lzo
cipher DES-EDE3-CBC
remote sai-br.no-ip.biz
ping 10
persist-tun
persist-key
ca [inline]
auth-user-pass
client
verb 4
<ca>
-----BEGIN CERTIFICATE-----
MIIEvTCCA6WgAwIBAgIJAMfm8JKaR6XyMA0GCSqGSIb3DQEBBQUAMIGaMQswCQYD
dlaksjhlkashfkashfdjhgj........................................................................................................
-----END CERTIFICATE-----
</ca>

Jeferson Coli
---------------------
www.tecnocoli.com.br

rensantos
(usa Ubuntu)

Enviado em 16/03/2015 - 12:02h

Oi Jeferson, já copiei de novo o mesmo certificado (que estava funcionando no domingo quando testei) e continua a mesma coisa, será que tem alguma outra coisa que eu possa fazer?
Ou o certo seria refazer todo certificado? Neste caso as configurações estão certas?

jcoli
(usa Debian)

Enviado em 22/03/2015 - 05:57h

Tenho um manual aqui que usei pela primeira vez.
Me passa o seu email que lhe envio.

Abraços


Jeferson Coli
---------------------
www.tecnocoli.com.br