Dobrý den,

chtěl bych vás požádat o radu, jak zprovoznit komunikaci mezi openVPN serverem na Synology a windows klientem.

Na synology jsem nainstaloval a nakonfiguroval VPN server, stáhnul jsem konfigurační balíček s certifikátem do pc. V hlavním routeru nastavím směrování portu pro VPN server.

První klienta instaluji na iOS nahraju konfigurační balíček a vše funguje jak ve vnitřní síti, tak z venku. Komunikace funguje paráda.

Klientem pro windows 10 už to tak slavné není. Po konfiguraci se na server ani za boha nepřipojí. Připojení skončí s chybou:

Fri May 29 17:51:52 2020 OpenVPN 2.4.9 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Apr 16 2020

Fri May 29 17:51:52 2020 Windows version 6.2 (Windows 8 or greater) 64bit

Fri May 29 17:51:52 2020 library versions: OpenSSL 1.1.1f  31 Mar 2020, LZO 2.10

Enter Management Password:

Fri May 29 17:52:00 2020 WARNING: No server certificate verification method has been enabled.  See  http://openvpn.net/howto.html#mitm  for more info.

Fri May 29 17:52:00 2020 TCP/UDP: Preserving recently used remote address: [AF_INET]109.81.189.58:1194

Fri May 29 17:52:00 2020 UDP link local (bound): [AF_INET][undef]:1194

Fri May 29 17:52:00 2020 UDP link remote: [AF_INET]------------------------:1194

Fri May 29 17:52:00 2020 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this

Fri May 29 17:52:01 2020 VERIFY ERROR: depth=2, error=unable to get issuer certificate: C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust RSA Certification Authority

Fri May 29 17:52:01 2020 OpenSSL: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed

Fri May 29 17:52:01 2020 TLS_ERROR: BIO read tls_read_plaintext error

Fri May 29 17:52:01 2020 TLS Error: TLS object -> incoming plaintext read error

Fri May 29 17:52:01 2020 TLS Error: TLS handshake failed

Fri May 29 17:52:01 2020 SIGUSR1[soft,tls-error] received, process restarting

Fri May 29 17:52:06 2020 WARNING: No server certificate verification method has been enabled.  See  http://openvpn.net/howto.html#mitm  for more info.

Fri May 29 17:52:06 2020 TCP/UDP: Preserving recently used remote address: [AF_INET]------------------------------------------------:1194

Fri May 29 17:52:06 2020 UDP link local (bound): [AF_INET][undef]:1194

Fri May 29 17:52:06 2020 UDP link remote: [AF_INET]----------------------:1194

Fri May 29 17:52:06 2020 VERIFY ERROR: depth=2, error=unable to get issuer certificate: C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust RSA Certification Authority

Fri May 29 17:52:06 2020 OpenSSL: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed

Fri May 29 17:52:06 2020 TLS_ERROR: BIO read tls_read_plaintext error

Fri May 29 17:52:06 2020 TLS Error: TLS object -> incoming plaintext read error

Fri May 29 17:52:06 2020 TLS Error: TLS handshake failed

Fri May 29 17:52:06 2020 SIGUSR1[soft,tls-error] received, process restarting

Fri May 29 17:52:10 2020 SIGTERM[hard,init_instance] received, process exiting   

Konfigurační soubor vypadá takto:

dev tun

client

remote vnitřní ip serveru 1194

# The "float" tells OpenVPN to accept authenticated packets from any address,

# not only the address which was specified in the --remote option.

# This is useful when you are connecting to a peer which holds a dynamic address

# such as a dial-in user or DHCP client.

# (Please refer to the manual of OpenVPN for more information.)


#float


# If redirect-gateway is enabled, the client will redirect it's

# default network gateway through the VPN.

# It means the VPN connection will firstly connect to the VPN Server

# and then to the internet.

# (Please refer to the manual of OpenVPN for more information.)


redirect-gateway def1


# dhcp-option DNS: To set primary domain name server address.

# Repeat this option to set secondary DNS server addresses.


#dhcp-option DNS DNS_IP_ADDRESS


pull


# If you want to connect by Server's IPv6 address, you should use

# "proto udp6" in UDP mode or "proto tcp6-client" in TCP mode

proto udp


script-security 2


comp-lzo


reneg-sec 0


cipher AES-256-CBC


auth SHA512


auth-user-pass

<ca>

-----BEGIN CERTIFICATE-----

----------------------

-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----

------

-----END CERTIFICATE-----

</ca>

Nevím, co dělám špatně. Podle všeho to vypadá na problém s certifikáty. Zkoušel jsem vše možné nastavení, které jsem našel na google, vypnul jsem firewall a nic. Fakt už nevím, co dělám špatně. Z iphonu to funguje tak usuzuji, že chyba bude na straně pc windowsu.

Našel by se tu někdo znalý, který openVPN rozumí a byl ochotný mi poradit? Předem moc děkuji