Hi everyone, new 44Net list member here. I'm trying to setup the OpenVPN connection to the OH7LZB VPN server. I'm primarily using this link ( http://wiki.ampr.org/wiki/AMPRNet_VPN), but I am planning to update it once I get my connection working. Looking thru the archives, it seems a number of us have had challenges with the setup. If someone has successfully configured it recently, maybe you can help me out with my setup? The encryption and auth seems to not negotiate, the connection never sets up. Per Hessu's response to my email (below),

it has to do with the newer version / algorithms trying to get along with the server version. Thanks in advance for any assist. - Matt / KM4EXS -------- Forwarded message ------- From: "Heikki Hannikainen" <hessu(a)hes.iki.fi (mailto:hessu@hes.iki.fi)> To: matthew(a)alberti.us (mailto:matthew@alberti.us) Sent: August 18, 2019 12:13 PM Subject: Re: 44Net VPN Setup Hi, I generally prefer to have these discussions on a mailing list so that

answers are archived publicly, and others can look for existing answers from the archive instead of asking the same question again. I run aprs.fi so I get a lot of questions and emails. The log, at this verbosity level, doesn't actually say what went wrong in the negotiation. I think there was a thread on the 44list before where someone resolved this

something to do with new versions of openvpn openssl refusing to use the older algorithms

configured on the VPN server. https://mailman.ampr.org/mailman/private/44net ( https://mailman.ampr.org/mailman/private/44net) On Sat, 17 Aug 2019, matthew(a)alberti.us (mailto:matthew@alberti.us)

Hi Hessu, I pulled your e-mail address off the 44net mailman list. Didn't want to spam it, as I think I am missing something easy. I'm trying to setup an OpenVPN connection to your server, so that I can

an AMPRNet IP. I have followed the instructions at http://wiki.ampr.org/wiki/AMPRNet_VPN ( http://wiki.ampr.org/wiki/AMPRNet_VPN). It looks like I'm stuck after

CA is verified, but before the data channel encryption/auth is negotiated. Below are my logs. I was hoping you could take a look at the server side, my public IP is 184.82.197.68. I think I'm probably using the wrong client settings. I'm trying to set this up on a pfSense router.... so I have to enter all the settings manually. I am trying to use BF-CBC and SHA1...

also tried a few other combos. No luck. Thanks in advance! - Matt Alberti / KM4EXS Aug 17 16:47:52 openvpn 18908 SIGUSR1[soft,tls-error] received, process restarting Aug 17 16:47:52 openvpn 18908 Restart pause, 5 second(s) Aug 17 16:47:57 openvpn 18908 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm (http://openvpn.net/howto.html#mitm) for more info. Aug 17 16:47:57 openvpn 18908 NOTE: the current --script-security setting may allow this configuration

call user-defined scripts Aug 17 16:47:57 openvpn 18908 TCP/UDP: Preserving recently used remote address: [AF_INET] 85.188.1.118:1773 Aug 17 16:47:57 openvpn 18908 Socket Buffers: R=[42080->42080] S=[57344->57344] Aug 17 16:47:57 openvpn 18908 UDP link local (bound): [AF_INET][undef]:0 Aug 17 16:47:57 openvpn 18908 UDP link remote: [AF_INET]85.188.1.118:1773 Aug 17 16:47:57 openvpn 18908 TLS: Initial packet from [AF_INET]85.188.1.118:1773 (via [AF_INET]184.82.197.68%), sid=368827b7 79c57373 Aug 17 16:47:59 openvpn 18908 VERIFY OK: depth=1, O=AMPRnet, CN=OH7LZB VPN service CA Aug 17 16:47:59 openvpn 18908 VERIFY OK: depth=0, CN=ampr-gw.he.fi Aug 17 16:48:57 openvpn 18908 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) Aug 17 16:48:57 openvpn 18908 TLS Error: TLS handshake failed - Hessu _________________________________________ 44Net mailing list 44Net(a)mailman.ampr.org https://mailman.ampr.org/mailman/listinfo/44net

I'm connecting after adding the tls-cipher line as suggested by Scott. I also had to clean up my key file to contain the last (active / not deleted) key with only the part between and including "-----BEGIN PUBLIC KEY-----" and "-----END ENCRYPTED PRIVATE KEY-----", which differs slightly from the description in the instructions. I also added "askpass" to the config file to prompt me for my key password. Also, on Windows OpenVPN 2.4.7 the config file is imported to "C:\Users\%USERPROFILE%\OpenVPN\config\amprnet-vpn", so key and other files are manually copied there as well. I have not yet tried to connect from my Linux systems, but expect it should work there as well. David M. WD5M On Sun, Aug 18, 2019 at 8:23 PM KM4EXS via 44Net <44net(a)mailman.ampr.org> wrote: perhaps the issue, currently wrote: get the but to _________________________________________ 44Net mailing list 44Net(a)mailman.ampr.org https://mailman.ampr.org/mailman/listinfo/44net

El 3 sept 2019, a las 6:56, Steve L via 44Net <44net(a)mailman.ampr.org> escribió: Have you tried adding this to the client.conf file?: tls-version-min 1.0 On Sat, Aug 31, 2019 at 5:32 AM Marcel Neupauer via 44Net <44net(a)mailman.ampr.org> wrote: I'm connecting after adding the tls-cipher line as suggested by Scott. I also had to clean up my key file to contain the last (active / not deleted) key with only the part between and including "-----BEGIN PUBLIC KEY-----" and "-----END ENCRYPTED PRIVATE KEY-----", which differs slightly from the description in the instructions. I also added "askpass" to the config file to prompt me for my key password. Also, on Windows OpenVPN 2.4.7 the config file is imported to "C:\Users\%USERPROFILE%\OpenVPN\config\amprnet-vpn", so key and other files are manually copied there as well. I have not yet tried to connect from my Linux systems, but expect it should work there as well. David M. WD5M On Sun, Aug 18, 2019 at 8:23 PM KM4EXS via 44Net <44net(a)mailman.ampr.org> wrote: Hi everyone, new 44Net list member here. I'm trying to setup the OpenVPN connection to the OH7LZB VPN server. I'm primarily using this link ( http://wiki.ampr.org/wiki/AMPRNet_VPN), but I am planning to update it once I get my connection working. Looking thru the archives, it seems a number of us have had challenges with the setup. If someone has successfully configured it recently, maybe you can help me out with my setup? The encryption and auth seems to not negotiate, the connection never sets up. Per Hessu's response to my email (below), perhaps it has to do with the newer version / algorithms trying to get along with the server version. Thanks in advance for any assist. - Matt / KM4EXS -------- Forwarded message ------- From: "Heikki Hannikainen" <hessu(a)hes.iki.fi (hessu(a)hes.iki.fi)> To: matthew(a)alberti.us (matthew(a)alberti.us) Sent: August 18, 2019 12:13 PM Subject: Re: 44Net VPN Setup Hi, I generally prefer to have these discussions on a mailing list so that the answers are archived publicly, and others can look for existing answers from the archive instead of asking the same question again. I run aprs.fi so I get a lot of questions and emails. The log, at this verbosity level, doesn't actually say what went wrong in the negotiation. I think there was a thread on the 44list before where someone resolved this issue, something to do with new versions of openvpn openssl refusing to use the older algorithms currently configured on the VPN server. https://mailman.ampr.org/mailman/private/44net ( https://mailman.ampr.org/mailman/private/44net) On Sat, 17 Aug 2019, matthew(a)alberti.us (matthew(a)alberti.us) wrote: Hi Hessu, I pulled your e-mail address off the 44net mailman list. Didn't want to spam it, as I think I am missing something easy. I'm trying to setup an OpenVPN connection to your server, so that I can get an AMPRNet IP. I have followed the instructions at http://wiki.ampr.org/wiki/AMPRNet_VPN ( http://wiki.ampr.org/wiki/AMPRNet_VPN). It looks like I'm stuck after the CA is verified, but before the data channel encryption/auth is negotiated. Below are my logs. I was hoping you could take a look at the server side, my public IP is 184.82.197.68. I think I'm probably using the wrong client settings. I'm trying to set this up on a pfSense router.... so I have to enter all the settings manually. I am trying to use BF-CBC and SHA1... but also tried a few other combos. No luck. Thanks in advance! - Matt Alberti / KM4EXS Aug 17 16:47:52 openvpn 18908 SIGUSR1[soft,tls-error] received, process restarting Aug 17 16:47:52 openvpn 18908 Restart pause, 5 second(s) Aug 17 16:47:57 openvpn 18908 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm (http://openvpn.net/howto.html#mitm) for more info. Aug 17 16:47:57 openvpn 18908 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts Aug 17 16:47:57 openvpn 18908 TCP/UDP: Preserving recently used remote address: [AF_INET] 85.188.1.118:1773 Aug 17 16:47:57 openvpn 18908 Socket Buffers: R=[42080->42080] S=[57344->57344] Aug 17 16:47:57 openvpn 18908 UDP link local (bound): [AF_INET][undef]:0 Aug 17 16:47:57 openvpn 18908 UDP link remote: [AF_INET]85.188.1.118:1773 Aug 17 16:47:57 openvpn 18908 TLS: Initial packet from [AF_INET]85.188.1.118:1773 (via [AF_INET]184.82.197.68%), sid=368827b7 79c57373 Aug 17 16:47:59 openvpn 18908 VERIFY OK: depth=1, O=AMPRnet, CN=OH7LZB VPN service CA Aug 17 16:47:59 openvpn 18908 VERIFY OK: depth=0, CN=ampr-gw.he.fi Aug 17 16:48:57 openvpn 18908 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) Aug 17 16:48:57 openvpn 18908 TLS Error: TLS handshake failed - Hessu _________________________________________ 44Net mailing list 44Net(a)mailman.ampr.org https://mailman.ampr.org/mailman/listinfo/44net _________________________________________ 44Net mailing list 44Net(a)mailman.ampr.org https://mailman.ampr.org/mailman/listinfo/44net _________________________________________ 44Net mailing list 44Net(a)mailman.ampr.org https://mailman.ampr.org/mailman/listinfo/44net