Can't connect a roadwarrior to the VPN

Support
,
1

NethServer Version: 7.9
Module: OpenVPN
The connection is arriving at the server but it is not accepted

Sun Dec 31 15:54:38 2023 222.127.90.247:57883 TLS: Initial packet from [AF_INET]222.127.90.247:57883 (via [AF_INET]192.168.100.102%em2), sid=0ba85504 85864e24
Sun Dec 31 15:54:41 2023 read UDPv4 [CMSG=8|EHOSTUNREACH|CMSG=8|EHOSTUNREACH|CMSG=8|EHOSTUNREACH|CMSG=8|EHOSTUNREACH]: No route to host (code=113)
Sun Dec 31 15:54:45 2023 read UDPv4 [CMSG=8|EHOSTUNREACH|CMSG=8|EHOSTUNREACH|CMSG=8|EHOSTUNREACH]: No route to host (code=113)
Sun Dec 31 15:54:46 2023 MANAGEMENT: Client connected from /var/spool/openvpn/host-to-net
Sun Dec 31 15:54:46 2023 MANAGEMENT: CMD ‘status 3’
Sun Dec 31 15:54:46 2023 MANAGEMENT: Client disconnected
Sun Dec 31 15:54:46 2023 MANAGEMENT: Client connected from /var/spool/openvpn/host-to-net
Sun Dec 31 15:54:46 2023 MANAGEMENT: CMD ‘status 3’
Sun Dec 31 15:54:46 2023 MANAGEMENT: Client disconnected
Sun Dec 31 15:54:46 2023 MANAGEMENT: Client connected from /var/spool/openvpn/host-to-net
Sun Dec 31 15:54:46 2023 MANAGEMENT: CMD ‘status 3’
Sun Dec 31 15:54:46 2023 MANAGEMENT: Client disconnected
Sun Dec 31 15:54:48 2023 read UDPv4 [CMSG=8|EHOSTUNREACH|CMSG=8|EHOSTUNREACH|CMSG=8|EHOSTUNREACH]: No route to host (code=113)
Sun Dec 31 15:54:48 2023 222.127.90.247:57884 TLS: Initial packet from [AF_INET]222.127.90.247:57884 (via [AF_INET]192.168.100.102%em2), sid=325135ae f7d863c2
Sun Dec 31 15:54:51 2023 read UDPv4 [CMSG=8|EHOSTUNREACH|CMSG=8|EHOSTUNREACH|CMSG=8|EHOSTUNREACH|CMSG=8|EHOSTUNREACH]: No route to host (code=113)
Sun Dec 31 15:54:55 2023 read UDPv4 [CMSG=8|EHOSTUNREACH|CMSG=8|EHOSTUNREACH|CMSG=8|EHOSTUNREACH|CMSG=8|EHOSTUNREACH]: No route to host (code=113)
Sun Dec 31 15:54:58 2023 read UDPv4 [CMSG=8|EHOSTUNREACH|CMSG=8|EHOSTUNREACH|CMSG=8|EHOSTUNREACH]: No route to host (code=113)
Sun Dec 31 15:54:58 2023 222.127.90.247:57885 TLS: Initial packet from [AF_INET]222.127.90.247:57885 (via [AF_INET]192.168.100.102%em2), sid=7f193961 7994136a
Sun Dec 31 15:55:01 2023 read UDPv4 [CMSG=8|EHOSTUNREACH|CMSG=8|EHOSTUNREACH|CMSG=8|EHOSTUNREACH|CMSG=8|EHOSTUNREACH]: No route to host (code=113)
Sun Dec 31 15:55:05 2023 read UDPv4 [CMSG=8|EHOSTUNREACH|CMSG=8|EHOSTUNREACH|CMSG=8|EHOSTUNREACH|CMSG=8|EHOSTUNREACH]: No route to host (code=113)
Sun Dec 31 15:55:08 2023 read UDPv4 [CMSG=8|EHOSTUNREACH|CMSG=8|EHOSTUNREACH|CMSG=8|EHOSTUNREACH]: No route to host (code=113)
Sun Dec 31 15:55:11 2023 read UDPv4 [CMSG=8|EHOSTUNREACH]: No route to host (code=113)
Sun Dec 31 15:55:15 2023 read UDPv4 [CMSG=8|EHOSTUNREACH]: No route to host (code=113)
Sun Dec 31 15:55:22 2023 read UDPv4 [CMSG=8|EHOSTUNREACH]: No route to host (code=113)
Sun Dec 31 15:55:31 2023 read UDPv4 [CMSG=8|EHOSTUNREACH]: No route to host (code=113)
Sun Dec 31 15:55:38 2023 222.127.90.247:57883 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sun Dec 31 15:55:38 2023 222.127.90.247:57883 TLS Error: TLS handshake failed
Sun Dec 31 15:55:38 2023 222.127.90.247:57883 SIGUSR1[soft,tls-error] received, client-instance restarting
Sun Dec 31 15:55:48 2023 222.127.90.247:57884 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sun Dec 31 15:55:48 2023 222.127.90.247:57884 TLS Error: TLS handshake failed
Sun Dec 31 15:55:48 2023 222.127.90.247:57884 SIGUSR1[soft,tls-error] received, client-instance restarting
Sun Dec 31 15:55:57 2023 MANAGEMENT: Client connected from /var/spool/openvpn/host-to-net
Sun Dec 31 15:55:57 2023 MANAGEMENT: CMD ‘status 3’
Sun Dec 31 15:55:57 2023 MANAGEMENT: Client disconnected
Sun Dec 31 15:55:58 2023 MANAGEMENT: Client connected from /var/spool/openvpn/host-to-net
Sun Dec 31 15:55:58 2023 222.127.90.247:57885 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sun Dec 31 15:55:58 2023 222.127.90.247:57885 TLS Error: TLS handshake failed
Sun Dec 31 15:55:58 2023 222.127.90.247:57885 SIGUSR1[soft,tls-error] received, client-instance restarting
Sun Dec 31 15:55:58 2023 MANAGEMENT: CMD ‘status 3’
Sun Dec 31 15:55:58 2023 MANAGEMENT: Client disconnected
Sun Dec 31 15:55:58 2023 MANAGEMENT: Client connected from /var/spool/openvpn/host-to-net
Sun Dec 31 15:55:58 2023 MANAGEMENT: CMD ‘status 3’
Sun Dec 31 15:55:58 2023 MANAGEMENT: Client disconnected
Sun Dec 31 15:56:17 2023 MANAGEMENT: Client connected from /var/spool/openvpn/host-to-net
Sun Dec 31 15:56:17 2023 MANAGEMENT: CMD ‘status 3’
Sun Dec 31 15:56:17 2023 MANAGEMENT: Client disconnected

Any help is very much appriciated

Sepp

2

Your client does not know where is your vpn server

Problem of dns hostname bad set in your dns provider
Routing problem of the router in front of your vpn server

You should describe your infrastructure

1 Like
3

Dear Stéphane,

It is very simple.

Router/Modem connected to iSP

External IP 222.127.x.x

Port 1194 forwarded Nethserver RED interface

SERVER IP 192.168.1.90

Since I have a log entry on the server showing the connection it is finding the server, it should know.

I am confused about this

Sun Dec 31 15:55:11 2023 read UDPv4 [CMSG=8|EHOSTUNREACH]: No route to host (code=113)
Sun Dec 31 15:55:15 2023 read UDPv4 [CMSG=8|EHOSTUNREACH]: No route to host (code=113)

How do I route to host from the RED interface??

Many thanks

Sepp

4

In your ovpn configuration you set an IP to reach or a FQDN ?

Do you try to connect from the internal or the external

Can you connect from the external with a LTE/mobile broadband connexion ?

1 Like
5
  1. IP 222.127.x.x
  2. EXTERNAL

image
image1036×386 15.2 KB

2.INTERNAL

image
image1364×252 4.69 KB

CONNECTED

  1. THE EXTERNAL CONNECTION IS FROM A SECOND MODEM/ROUTER IP

image
image1082×432 15.6 KB

  1. CONNECT VIA MOBILE PHONE TO WORKSTATION

image
image1012×488 18.5 KB

Thank you very much

Sepp

6

You have two different issues

From internal : no route to host

From external : tls handshake failed and no route to hosts

Fun

7

Yes … lots of fun

Sepp

8

How did you install ns7 with only one NIC (green) or in a gateway with two NIC (red and green) ?

9

Who is the 192.168.100.102 ?

10

Defintively I do not understand your network like you can see the network does not are the same because we find your (supposed) client with 192.168.100.x/xx

11

Two RED & Green

Red is 192.166.100.102 the IP range of the Modem

Greens is 192.168.1.90 the iP range of my Fortinet router … who get its range from the modem 192.168.100.100

12

it is RED

13

Thank you
SEPP

14

Well so

Routeur 192.168.100.0/x
   |
   |_________red ns7 192.168.100.2
   |                  |
   |                  green 192.168.1.0/x
   |___CLIENt
15

What is the IP of the client ?

16

Maybe you have swapped the red and the green not in the good network ?

17

You should draw the map of your network you are targeting a complicated thing and without it we cannot help you

Maybe a simple plan with a ns7 with only a green interface could be more simple to make it. Just open the port 1194 to the ns7

18

Did you success to ping the IP of the NS7 red from your client ?

19

image001.png1524×1298 36.7 KB

1 Like
20

You cannot mix the green card of ns7 with the green card of your fortinet. In that case please use only one nic for ns7 and put it behind the fortinet

The modem does a dmz or open the 1194 udp port to the ns7 ?