Windows 11 OpenVPN

[suschi (sascha sascha)]

Hi guys,

I have my OpenVPN server running on the IpFire machine and can connect to some Windows 10 clients via OpenVPN. It works well.

I got it working with you here back then:

Now a VPN project

So dear people, now further in the program I now have 2 Ipfire’s at the start and they work as expected. Email, firewall rules, proxy, everything is top notch. Now comes the last big order/project. As can be seen in the picture, all computers are in the blue network, both private and business. The two servers should now synchronize as a backup. According to this guide: https://www.youtube.com/watch?v=VAgrJ-tm1OI I tried it. The connection is also there. But I …

Now I have a Windows 11 machine and use the same Client.zip from the Ipfire machine and the same OpenVPN client for Windows, so everything is the same.

The Windows 11 machine does not connect, however, and aborts after a while with the following error message:
TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
TLS Error: TLS handshake failed

I have no idea what could be causing this.

[suschi (sascha sascha)]

no one has an idea ?

[jon]

must not be many Windows 11 users…

[jon]

Maybe this might help?

Openvpn config file works on windows 10, not windows 11 (does not accept password)

Has anyone else encountered this? I set up a roadwarrior config for a new Win11 system and when testing it, it says the password is incorrect when connecting. I took the same config, installed it on a Win10 system, and the password works. Any help appreciated.

[dark0ipfire (Martin Bell)]

Did you use the current client version 2.6.11, download at https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.11-I001-amd64.msi ?

Then you must set providers option to deal with OpenSSL 1.1 on server side as stated in New OpenVPN 2.6.0 Client (Windows 10 64bit) fails to connect - #3 by dark0ipfire

[dark0ipfire (Martin Bell)]

Did you check all hints in https://openvpn.net/faq/tls-error-tls-key-negotiation-failed-to-occur-within-60-seconds-check-your-network-connectivity/ ?

[raffe (R R)]

I run several Win 11 with OpenVPN 2.6.10 and newer to a IPFire 2.29 (x86_64) - Core-Update 186 without any problems. Do you use the latest OpenVPN? I use Community Downloads - Open Source VPN | OpenVPN

[suschi (sascha sascha)]

Hi guys,
sorry couldn’t answer earlier.
So I’m using OpenVPN version 2.6.11 and have set everything up in the links above and it doesn’t work.
I don’t understand it…
Why doesn’t it work under Windows 11 but under Windows 10?

[alain (Alain Stucki)]

I run Win11 and use OpenVPN 2.5.9 to connect roadwarrions to OpenVPN server on IPFire. Runs great and I have an absolute steady connection.

[suschi (sascha sascha)]

Then I don’t know what I’m doing wrong.
It works on all Windows 10 computers with the configuration shown in the screenshot

The green connection status is because I had to access it with a Windows 10 machine for the screenshots

[tphz (iptom)]

I hope the following links will be helpful

Troubleshooting OpenVPN

Fixing TLS Error: TLS Handshake Failed on OpenVPN Client | Baeldung on Linux

Regards

[alain (Alain Stucki)]

I have the almost the same settings. The only differences:

• TLS-Kanalabsicherung is checked
• Clients run 2.5.9 or 2.5.10 (not version 2.6.x)

[suschi (sascha sascha)]

So thank you first of all for your time and help,

I have installed version 2.5.9 (also on the Windows 10 machine) and have activated:

TLS channel security is checked.

Now the Windows 10 machine won’t connect, and the Windows 11 machine won’t connect either.

I’ll try the other help above this evening

[suschi (sascha sascha)]

I just saw that a new error has occurred:
OpenSSL provider functionality is not available
OpenSSL provider functionality is not available

[suschi (sascha sascha)]

I found a new error.
A user also has the same problem after a backup on a new machine.

VPN not working after restore

Hi all, I had a backup (IPF) from a working machine. VPN was configured with OpenVPN and I could access / dial in from my mobile phone. After a hardware failure I reinstalled 158 again from scratch and restored my IPF. It’s showing the same configuration as I had before but it’s not working. Can it be that any one of the certificates is now wrong because the Box generated a set of new keys upon the first start? How can I debug that? Thanks a lot in advance, Thomas

I also used new hardware and installed a backup, but it still worked afterwards.
But here’s the error:
in /var/log/messages the following:
192.168.0.201:60758 VERIFY ERROR: depth=0, error=CRL has expired: C=DE, O=Zentrale, CN=SurfaceaufPTPraxis, serial=6

How can I fix this?

[bonnietwin (Adolf Belka)]

The message that you have is that the CRL has expired.

Presuming that you are running with CU186, there is a bug in that version.

Follow the instructions in this post and the CRL updater will work again.

https://community.ipfire.org/t/log-summary-openvpn-no-crl-update/11816/7

Make the green change shown in the link at the end of that post on the file /etc/fcron.daily/openvpn-crl-updater and then run that script with the command

/etc/fcron.daily/openvpn-crl-updater

and it will run that script and update your crl and the connection will work again.

[suschi (sascha sascha)]

Thank you for your time.

I think I’m being too stupid

The error still exists:
192.168.0.201:60758 VERIFY ERROR: depth=0, error=CRL has expired: C=DE, O=Zentrale, CN=SurfaceaufPTPraxis, serial=6

[bonnietwin (Adolf Belka)]

@suschi

The error still exists:
192.168.0.201:60758 VERIFY ERROR: depth=0, error=CRL has expired: C=DE, O=Zentrale, CN=SurfaceaufPTPraxis, serial=6

That error message still occurs after you ran the command

/etc/fcron.daily/openvpn-crl-updater

from the console or ssh terminal?

[suschi (sascha sascha)]

Sorry but Yes,

After entering:

/etc/fcron.daily/openvpn-crl-updater

nothing happens and the error remains after

grep “SurfaceaufPTPraxis” /var/log/messages

Do you have another idea ?

[bonnietwin (Adolf Belka)]

@suschi

Do you have another idea ?

No but maybe @ummeegge has some ideas.