在OpenVPN客户端修复“TLS错误：TLS握手失败”

我正在Arch Linux服务器上configurationOpenVPN 2.3.6-1，以便通过公共InternetencryptionSMBstream量。 当我在我的一个Linux虚拟机客户端上testing安装时，出现以下错误： TLS Error: TLS handshake failed 。

我快速阅读（ OpenVPN的OpenVZ TLS错误：TLS握手失败（谷歌build议的解决scheme不帮助） ），并尝试从默认的UDP切换到TCP，但只是导致客户端反复报告连接超时。 我也尝试禁用密码和TLS身份validation，但导致服务器失败， Assertion failed at crypto_openssl.c:523 。 在这两种情况下，都需要对客户端和服务器configuration进行更改。

我一直按照（ https://wiki.archlinux.org/index.php/OpenVPN ）上的说明设置OpenVPN，并在（ https://wiki.archlinux.org/index.php/Create_a_Public_Key_Infrastructure_Using_the_easy-rsa_Scripts ）创build密钥和证书。 我从这些说明中唯一的偏差是指定了我自己的计算机的名称和相应的密钥/证书文件名。

另请参阅我通过Internet保护SMBstream量的原始问题:( 简单encryptionSamba共享 ）

• OpenVPN性能低下。 我有MTU问题吗？ 在里面转储
• OpenVPN使redirect网关可选
• OpenVPN easy-rsa构build密钥自动化？
• shell脚本能等待文件改变并采取行动吗？
• 非常低的TCP OpenVPN吞吐量（100Mbit端口，CPU利用率低）

任何人都可以解释我如何解决这个问题？

细节：

服务器：Arch Linux（最新）通过以太网电缆直接连接到网关。 没有iptables。

客户端：在VirtualBox 4.3.28r100309 Windows 8.1主机，桥接networking适配器上的Arch Linux（最新）虚拟机。 没有iptables。 已禁用Windows防火墙。

网关：启用端口1194的端口转发，没有防火墙限制。

以下是服务器和客户端上的configuration文件。 我根据Arch Wiki上的说明创build了这些内容。

/etc/openvpn/server.conf （仅限非注释行）：

 port 1194 proto udp dev tun ca /etc/openvpn/ca.crt cert /etc/openvpn/server-name.crt key /etc/openvpn/server-name.key dh /etc/openvpn/dh2048.pem server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt keepalive 10 120 tls-auth /etc/openvpn/ta.key 0 comp-lzo user nobody group nobody persist-key persist-tun status openvpn-status.log verb 3 

/etc/openvpn/client.conf （仅限非注释行）：

 client dev tun proto udp remote [my public IP here] 1194 resolv-retry infinite nobind user nobody group nobody persist-key persist-tun ca /etc/openvpn/ca.crt cert /etc/openvpn/client-name.crt key /etc/openvpn/client-name.key remote-cert-tls server tls-auth /etc/openvpn/ta.key 1 comp-lzo verb 3 

这里是在上面configuration的机器上运行openvpn的输出。 我首先启动服务器，然后是客户端。

服务器上openvpn /etc/openvpn/server.conf的输出：

 Thu Jul 30 17:02:53 2015 OpenVPN 2.3.6 x86_64-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Dec 2 2014 Thu Jul 30 17:02:53 2015 library versions: OpenSSL 1.0.2d 9 Jul 2015, LZO 2.09 Thu Jul 30 17:02:53 2015 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet. Thu Jul 30 17:02:53 2015 Diffie-Hellman initialized with 2048 bit key Thu Jul 30 17:02:53 2015 Control Channel Authentication: using '/etc/openvpn/ta.key' as a OpenVPN static key file Thu Jul 30 17:02:53 2015 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication Thu Jul 30 17:02:53 2015 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication Thu Jul 30 17:02:53 2015 Socket Buffers: R=[212992->131072] S=[212992->131072] Thu Jul 30 17:02:53 2015 ROUTE_GATEWAY 192.168.0.1/255.255.255.0 IFACE=enp5s0 HWADDR=##:##:##:##:##:## Thu Jul 30 17:02:53 2015 TUN/TAP device tun0 opened Thu Jul 30 17:02:53 2015 TUN/TAP TX queue length set to 100 Thu Jul 30 17:02:53 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0 Thu Jul 30 17:02:53 2015 /usr/bin/ip link set dev tun0 up mtu 1500 Thu Jul 30 17:02:53 2015 /usr/bin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2 Thu Jul 30 17:02:53 2015 /usr/bin/ip route add 10.8.0.0/24 via 10.8.0.2 Thu Jul 30 17:02:53 2015 GID set to nobody Thu Jul 30 17:02:53 2015 UID set to nobody Thu Jul 30 17:02:53 2015 UDPv4 link local (bound): [undef] Thu Jul 30 17:02:53 2015 UDPv4 link remote: [undef] Thu Jul 30 17:02:53 2015 MULTI: multi_init called, r=256 v=256 Thu Jul 30 17:02:53 2015 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0 Thu Jul 30 17:02:53 2015 IFCONFIG POOL LIST Thu Jul 30 17:02:53 2015 Initialization Sequence Completed 

客户端上openvpn /etc/openvpn/client.conf的输出：

 Thu Jul 30 21:03:02 2015 OpenVPN 2.3.6 x86_64-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Dec 2 2014 Thu Jul 30 21:03:02 2015 library versions: OpenSSL 1.0.2d 9 Jul 2015, LZO 2.09 Thu Jul 30 21:03:02 2015 WARNING: file '/etc/openvpn/client-name.key' is group or others accessible Thu Jul 30 21:03:02 2015 WARNING: file '/etc/openvpn/ta.key' is group or others accessible Thu Jul 30 21:03:02 2015 Control Channel Authentication: using '/etc/openvpn/ta.key' as a OpenVPN static key file Thu Jul 30 21:03:02 2015 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication Thu Jul 30 21:03:02 2015 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication Thu Jul 30 21:03:02 2015 Socket Buffers: R=[212992->131072] S=[212992->131072] Thu Jul 30 21:03:02 2015 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay Thu Jul 30 21:03:02 2015 UDPv4 link local: [undef] Thu Jul 30 21:03:02 2015 UDPv4 link remote: [AF_INET][my public IP here]:1194 Thu Jul 30 21:04:02 2015 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) Thu Jul 30 21:04:02 2015 TLS Error: TLS handshake failed Thu Jul 30 21:04:02 2015 SIGUSR1[soft,tls-error] received, process restarting Thu Jul 30 21:04:02 2015 Restart pause, 2 second(s) 

 local <ip anchor> 

 sudo ufw disable sudo ufw enable