<div class="bbWrapper">Hi, I faced a similar issue a few months ago. Try to remove the comments in the openvpn.conf and restart the service. Other than that, your config seems correct. That guide is a bit tricky though and quite old. Oh, and I hope you are not keeping your keys in the server or the jail. Good luck, let me know if there's some improvement.</div>
<div class="bbWrapper"><blockquote data-attributes="member: 61840" data-quote="Gabi" data-source="post: 435444"
class="bbCodeBlock bbCodeBlock--expandable bbCodeBlock--quote js-expandWatch">
<div class="bbCodeBlock-title">
<a href="/community/goto/post?id=435444"
class="bbCodeBlock-sourceJump"
rel="nofollow"
data-xf-click="attribution"
data-content-selector="#post-435444">Gabi said:</a>
</div>
<div class="bbCodeBlock-content">
<div class="bbCodeBlock-expandContent js-expandContent ">
Hi, I faced a similar issue a few months ago. Try to remove the comments in the openvpn.conf and restart the service. Other than that, your config seems correct. That guide is a bit tricky though and quite old. Oh, and I hope you are not keeping your keys in the server or the jail. Good luck, let me know if there's some improvement.
</div>
<div class="bbCodeBlock-expandLink js-expandLink"><a role="button" tabindex="0">Click to expand...</a></div>
</div>
</blockquote>The first problem was that I have to specify the keys directory. Now I have to do this in openvpn.conf<br />
<div class="bbCodeBlock bbCodeCode"><div class="type">Code:</div><pre>
...
ca /mnt/keys/ca.crt
cert /mnt/keys/openvpn-server.crt #Server public key
key /mnt/keys/openvpn-server.key #Server private key
dh /mnt/keys/dh.pem #Diffie-Hellman parameters
...
tls-auth /mnt/keys/ta.key 0
</pre></div><br />
<br />
"I hope you are not keeping your keys in the server or the jail" you mean the personal keys? Or other?</div>
<div class="bbWrapper"><blockquote data-attributes="member: 82275" data-quote="Xaint" data-source="post: 436115"
class="bbCodeBlock bbCodeBlock--expandable bbCodeBlock--quote js-expandWatch">
<div class="bbCodeBlock-title">
<a href="/community/goto/post?id=436115"
class="bbCodeBlock-sourceJump"
rel="nofollow"
data-xf-click="attribution"
data-content-selector="#post-436115">Xaint said:</a>
</div>
<div class="bbCodeBlock-content">
<div class="bbCodeBlock-expandContent js-expandContent ">
The first problem was that I have to specify the keys directory. Now I have to do this in openvpn.conf<br />
<div class="bbCodeBlock bbCodeCode"><div class="type">Code:</div><pre>
...
ca /mnt/keys/ca.crt
cert /mnt/keys/openvpn-server.crt #Server public key
key /mnt/keys/openvpn-server.key #Server private key
dh /mnt/keys/dh.pem #Diffie-Hellman parameters
...
tls-auth /mnt/keys/ta.key 0
</pre></div><br />
<br />
"I hope you are not keeping your keys in the server or the jail" you mean the personal keys? Or other?
</div>
<div class="bbCodeBlock-expandLink js-expandLink"><a role="button" tabindex="0">Click to expand...</a></div>
</div>
</blockquote><br />
<br />
Found this on the wiki.archlinux.org OpenVPN website last night. I haven't had a chance to try it, but you might give these two items a try:<br />
1) "tls-crypt ta.key" replaces "tls-auth ta.key 0" (make sure you replace it in both the server and client)<br />
2) Due to a bug in OpenVPN 2.4.0, "persist-tun" should NOT be used.<br />
<br />
I won't be able to get to my server work until late tonight. If you get a chance to try it, let me know if it works!!!</div>
<div class="bbWrapper">Did you rebooted your FreeNAS server after configuring everything? I struggled to get OpenVPN running in a jail, but after a reboot it all worked fine.</div>
<div class="bbWrapper">I would suggest to use SoftEther, VPN speed is a lot faster and it is much easier to set up. You can even serve OpenVPN through it if you would prefer.</div>
<div class="bbWrapper">Found this new post by Bibi40k. It worked perfectly:<br />
<br />
<a href="https://forums.freenas.org/index.php?posts/440783/" target="_blank" class="link link--external" rel="nofollow ugc noopener">https://forums.freenas.org/index.php?posts/440783/</a></div>
<div class="bbWrapper">i'm having the same problem as OP. gettng the TLS-auth timeout. <br />
<br />
i followed the guides in both previous posts with no solution. <br />
<br />
current setup: <br />
<br />
I have a Netgear router. LAN address is 192.168.1.0, router at 192.168.1.1<br />
PiHole VM running on FreeNAS at 192.168.1.250, PiHole getting DNS from 1.1.1.1 and 1.0.0.1<br />
Netgear router getting DNS from PiHole at 192.168.1.250, with a backup of 1.1.1.1 (this gives me whole home ad blocking)<br />
Netgear router forwarding internal and external port 1194 to 192.168.1.117 (im not sure why this guide has different ports between server/client, other guides have them the same, can someone explain why?)<br />
OpenVPN jail running at 192.168.1.117<br />
<br />
openvpn server config "openvpn.conf @ /usr/local/etc/openvpn/":<br />
<div class="bbCodeBlock bbCodeCode"><div class="type">Code:</div><pre>
local 192.168.1.117
port 1194
proto udp
dev tun
ca /usr/local/etc/openvpn/keys/ca.crt
cert /usr/local/etc/openvpn/keys/openvpn-server.crt
key /usr/local/etc/openvpn/keys/openvpn-server.key
dh /usr/local/etc/openvpn/keys/dh.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.1.0 255.255.255.0"
push "dhcp-option DNS 192.168.1.250" #do i need this line? i thought since pihole is my DNS that i would, please advise
;push "dhcp-option DNS 1.1.1.1"
keepalive 10 120
tls-auth /usr/local/etc/openvpn/keys/ta.key 0
remote-cert-tls client
cipher AES-256-CBC
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
verb 3
explicit-exit-notify 1
</pre></div><br />
<br />
rc.conf @ /etc/<br />
<div class="bbCodeBlock bbCodeCode"><div class="type">Code:</div><pre>
portmap_enable="NO"
sshd_enable="NO"
sendmail_enable="NO"
sendmail_submit_enable="NO"
sendmail_outbound_enable="NO"
sendmail_msp_queue_enable="NO"
hostname="OpenVPN"
devfs_enable="YES"
devfs_system_ruleset="devfsrules_common"
inet6_enable="YES"
ip6addrctl_enable="YES"
openvpn_enable="YES"
openvpn_if="tun"
openvpn_configfile="/usr/local/etc/openvpn/openvpn.conf"
openvpn_dir="/usr/local/etc/openvpn/"
cloned_interfaces="tun"
gateway_enable="YES"
firewall_enable="YES"
firewall_script="/usr/local/etc/ipfw.rules"
</pre></div><br />
<br />
ipfw.rules @ /usr/local/etc/<br />
<div class="bbCodeBlock bbCodeCode"><div class="type">Code:</div><pre>
#!/bin/sh
ipfw -q -f flush
ipfw -q nat 1 config if epair2b
ipfw -q add nat 1 all from 10.8.0.0/24 to any out via epair2b
ipfw -q add nat 1 all from any to any in via epair2b
TUN=$(/sbin/ifconfig -l | tr " " "/n" | /usr/bin/grep tun)
ifconfig ${TUN} name tun0
</pre></div><br />
<br />
output of command "/sbin/ifconfig -l | tr " " "/n" | /usr/bin/grep tun"<br />
<div class="bbCodeBlock bbCodeCode"><div class="type">Code:</div><pre> # /sbin/ifconfig -l | tr " " "/n" | /usr/bin/grep tun
lo0/epair2b/tun5
</pre></div><br />
<br />
output of command "ipfw list"<br />
<div class="bbCodeBlock bbCodeCode"><div class="type">Code:</div><pre>
# ipfw list
00100 nat 1 ip from 10.8.0.0/24 to any out via epair2b
00200 nat 1 ip from any to any in via epair2b
65535 allow ip from any to any
</pre></div><br />
<br />
output of command "sockstat -4 -l"<br />
<div class="bbCodeBlock bbCodeCode"><div class="type">Code:</div><pre>
# sockstat -4 -l
USER COMMAND PID FD PROTO LOCAL ADDRESS FOREIGN ADDRESS
root syslogd 25305 7 udp4 *:514 *:*
</pre></div><br />
it does not show openvpn here. but i do not know why. <br />
<br />
Client config on Windows 10 machine "Xinyi.conf @ C:\Users\Ian\OpenVPN\config\client"<br />
ca.crt, ta.key, Xinyi.crt, Xinyi.key are also in this directory<br />
<div class="bbCodeBlock bbCodeCode"><div class="type">Code:</div><pre>
client
dev tun
proto udp
remote 192.168.1.117 1194 # i know this is the local IP, i was trying to connect from within the network as a test, still doesnt work with the outside IP added here
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert Xinyi.crt
key Xinyi.key
remote-cert-tls server
tls-auth ta.key 1
cipher AES-256-CBC
comp-lzo
verb 3
</pre></div></div>
