search

rajannpatel / Pi-Hole-PiVPN-on-Google-Compute-Engine-Free-Tier-with-Full-Tunnel-and-Split-Tunnel-OpenVPN-Configs

Run your own privacy-first ad blocking service in the cloud for free on Google Cloud Services.
MIT License
1.31k stars 111 forks source link

Use `tls-auth` if you get `TLS handshake failed` #52

Closed sinistance closed 5 years ago

sinistance commented 5 years ago

Today I found out that my Asus DSL-AC52U always failing to connect to the openvpn server because of TLS handshake failed and I tried to change the tls configuration from using tls-crypt to tls-auth both in server and client-side and it worked!.

What I did was:

  1. on the server configuration (server.conf & server_tcp443.conf), I replaced tls-crypt /etc/openvpn/easy-rsa/pki/ta.key to tls-auth /etc/openvpn/easy-rsa/pki/ta.key
  2. on the .ovpn client file, I replaced <tls-crypt> ... </tls-crypt> to <tls-auth> ... </tls-auth>

Hopefully, this will help anyone who gets the same problem with me.

johnson-ha commented 5 years ago

I have the same issue on the Asus RT-AC68U running Merlin. Changing tls-crypt to tls-auth didn't solve my issue.

I'm able to successfully connect to the VPN using OpenVPN on my desktop (on both UDP and TCP), but it doesn't seem to work on my router. Does anyone have any ideas?

sinistance commented 5 years ago

Have you read the router system log? There should be some error messages saying why it won't connect.

johnson-ha commented 5 years ago

I have resolved the issues I was having. It turns out when I rebooted my router it reset the date/time and couldn't update it because the DNS was set to 10.8.0.1. Once the time was updated the certificate was valid again and I could connect with no problems.

However, Pi Hole wasn't blocking any queries. I had to change "Forward local domain queries to upstream DNS" in the WAN settings to "Yes". In adddition, I had to disable ipv6 on the router since the ipv4 DNS was being bypassed.

rajannpatel commented 5 years ago

Feel free to re-open with an output from the router system log if things don't seem right going forward