pi-hole/docs
1
0
Fork 0
mirror of https://github.com/pi-hole/docs.git synced 2024-12-06 19:27:12 +01:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

Add troubleshooting section for OpenVPN. It is likely that more and more users will update to OpenVPN 2.4 these days as it is available since Oct 2018 and already the default for new OpenVPN installations

Browse Source 
Signed-off-by: DL6ER <dl6er@dl6er.de>
This commit is contained in:
DL6ER
2019-04-24 12:21:19 +02:00
parent 5e2678d0f8
commit ffe7c2f1ce
3 changed files with 34 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/guides/vpn/Android-Transport-Error.png
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 18 KiB

docs/guides/vpn/troubleshooting.md
+33
View File
@@ -0,0 +1,33 @@
### CRL expired
OpenVPN 2.4 and newer check the validity of the Certificate Revocation List (CRL). This can result in a sudden malfunction of `openvpn` after an update even though no configuration files have changed. This error manifests in the following, not very helpful, error on the client side:
```
Wed Apr 24 11:19:07 2019 VERIFY OK: depth=0, CN=server
Wed Apr 24 11:19:07 2019 Connection reset, restarting [0]
Wed Apr 24 11:19:07 2019 SIGUSR1[soft,connection-reset] received, process restarting
Wed Apr 24 11:19:07 2019 Restart pause, 5 second(s)
```
Android clients simply report: "Transport error, trying to reconnect..."
> ![](Android-Transport-Error.png)
On the OpenVPN server, the following messages are logged:
```
Wed Apr 24 11:19:07 2019 aaa.bbb.ccc.ddd:pppp TLS: Initial packet from [AF_INET]aaa.bbb.ccc.ddd:pppp, sid=57719cb8 77945ae9
Wed Apr 24 11:19:07 2019 aaa.bbb.ccc.ddd:pppp VERIFY ERROR: depth=0, error=CRL has expired: CN=client1
Wed Apr 24 11:19:07 2019 aaa.bbb.ccc.ddd:pppp OpenSSL: error:11089086:SSL routines:ssl3_get_client_certificate:certificate verify failed
Wed Apr 24 11:19:07 2019 aaa.bbb.ccc.ddd:pppp TLS_ERROR: BIO read tls_read_plaintext error
Wed Apr 24 11:19:07 2019 aaa.bbb.ccc.ddd:pppp TLS Error: TLS object -> incoming plaintext read error
Wed Apr 24 11:19:07 2019 aaa.bbb.ccc.ddd:pppp TLS Error: TLS handshake failed
Wed Apr 24 11:19:07 2019 aaa.bbb.ccc.ddd:pppp Fatal TLS error (check_tls_errors_co), restarting
Wed Apr 24 11:19:07 2019 aaa.bbb.ccc.ddd:pppp SIGUSR1[soft,tls-error] received, client-instance restarting
```
The error is `CRL has expired` and can be solved using the following commands:
```
sudo -s
cd /etc/openvpn
mv crl.pem crl.pem_old
cd easy-rsa
./easyrsa gen-crl
cp pki/crl.pem ../
service openvpn restart
exit
```
mkdocs.yml
+1
View File
@@ -96,6 +96,7 @@ nav:
- 'Optional: Dual operation: LAN & VPN at the same time': guides/vpn/dual-operation.md
- 'Optional: Full and DNS-only': guides/vpn/dual-VPN.md
- 'Optional: Dynamic DNS': guides/vpn/dynDNS.md
- 'Troubleshooting': guides/vpn/troubleshooting.md
- 'TOR & Pi-hole':
- 'Overview': guides/tor/overview.md
- 'Basic Setup': guides/tor/setup.md