Troubleshooting
Most OpenVPN problems announce themselves in one of two logs: the server's (journalctl -u openvpn-server@server) and the user's. Read both before changing anything. Every message in this table appeared in this lesson's lab.
| Symptom | Where to look, and what it says | Cause and fix |
|---|---|---|
| User times out: TLS key negotiation failed to occur within 60 seconds | Server log: tls-crypt unwrap error | The user's tls-crypt key is wrong or old: reissue their file |
| …the same timeout, and nothing in the server log | tcpdump -ni eth0 udp port 1194 on the server | UDP 1194 isn't reaching the server: firewall or wrong remote address |
| User rejected, server says certificate revoked | Server log | Working as intended: they were revoked |
| Everyone rejected: CRL: cannot read, or CRL not loaded | Server log | crl.pem unreadable by nobody: chmod 644. Or the CRL has expired: regenerate it |
| Connected, the server's tunnel address answers, nothing beyond it does | sysctl net.ipv4.ip_forward on the server; the forward chain's drop counter | Forwarding off (install the sysctl.d file), or no forward rule for that traffic |
| Connected, but office hosts don't answer | tcpdump on an office host: replies go to the office router, which says net unreachable | Missing return route for 10.8.0.0/24 on the office router |
| Users can't reach each other, or a branch LAN | nft list chain inet filter forward: drop counter climbing | Intended isolation. Add specific tun0→tun0 rules, or client-to-client |
| Branch LAN unreachable, branch user connected | Status file: no ROUTING_TABLE entry for the branch LAN | Missing iroute in that user's ccd file (or the route in server.conf) |
| Wrong address, or no per-user settings | Server log: no reading client specific options from: ccd/… | The ccd file name must match the certificate's common name exactly |
| Options error: Error opening configuration file | User's terminal | Wrong path to the .ovpn file |
Three habits make all of this faster:
- Watch both ends at once. The server log and the user's log tell different halves of the same story.
- Check the status file. It shows who the server thinks is connected, with which address, and which networks belong to whom.
- Follow the packet.
tcpdumpontun0, then on the LAN interface, then on the destination host shows exactly where it stops.