Routine OpenVPN Test Unsuccessful Today

My computer ‘Phoenix’ does not just act as my Web-server. It also hosts a secure VPN which I own on my own LAN, and that uses the OpenVPN protocol.

Because certain software receives updates from time to time, I also test this VPN from outside my LAN from time to time. To do that, I have typically walked to a certain WiFi Hot-Spot and tested it from there.

However, when I tried this today, I was not able to establish a secure connection to my OpenVPN server at home. The message which I was getting, on my client, was

‘‘

Which finally led to the message

‘‘

And in my server log the messages were:

 


Mon Jan 30 13:16:38 2017 70.24.177.137:61346 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Mon Jan 30 13:16:38 2017 70.24.177.137:61346 TLS Error: TLS handshake failed


 

I understand what these error messages mean. When certain Internet traffic is being routed or -ed, it is routine that the return address of individual packets is changed. However, in this case it means that the router policies of the WiFi Hot-Spot I have been able to use in the past has changed, so that I will no longer be allowed to connect to my home VPN in this way.

I find this to be a shame.

(Edit 01/31/2017 : As of the next day, I was able to turn this result into a full success. )

This does not mean that anything is necessarily wrong with the IP address subnet of the VPN I have created on my LAN, because while connecting to the server from outside, the client never gets to create a virtual ‘‘ device, which might have an unsupported subnet if it was created. The process just never passes the -phase, which is meant to create a secure connection between the client and server.

(Edit 01/31/2017 : Since the latest news states that I was able to access my VPN and its member computers, this confirms instead, that the IP Address Subnet of the is fully functional, that remaining 192.168.2.129 / 255.255.255.192 . )

So in the future, I will not be using this WiFi Hot-Spot anymore, especially since their policy could be altered further, into telling the client that a secure connection exists, with properly-routed packets, but a Man-In-The-Middle Attack could be unleashed. And in that case, it would be unfortunate if the client did not possess the logic to conclude, that a secure connection was not established.

Dirk

BTW: When somebody mounts a man-In-The-Middle Attack against a connection secured via Public-Key Cryptography, the latter being based on the premise that any public key which was signed by an arbitrary Certificate Authority, must be a valid key, one trick which does get used, is to respond to a connecting client by mimicking a known public key that is already in-use. So an MiM attack method that is known, will effectively throw the packets back at the client seeking to connect, which some client has already proven, must have legitimate keys. Only, the trick would be to modify the packets somewhat, so that instead of only talking to himself, the client unknowingly ends up talking to the attacker – in a way the attacker can decipher.

 

Setting Up Torbirdy

In This Earlier Posting, I wrote that I was setting up an old, garbage-grade laptop, to connect entirely through Tor. And one of my motivations has to do with the USB-stick, in that I am trying to establish that this USB-stick cannot really be of such immense benefit to whoever is using it, as is claimed, and that therefore, Edward Snowden cannot also have gotten much use out of .

Further, I think we can see that in recent years, the way in which PCs react to inserted, ‘ USB-sticks’ has also changed, so that our chances of finding a host machine which will boot from such a pen-drive, but without the consent or knowledge of its owner, are also quite slim. An actual laptop bypasses that problem.

What I think I found, was that most of the services which we could connect to – including IRC Servers – detect that we are connecting to them from a remote IP address that belongs to a Tor gateway – a so-called “Exit-Node” – and if we are authenticated, bans the user, or otherwise just blocks the user.

What I had written though, was that in addition to being able to use the Web-browser, I wanted my own laptop to be able to perform one additional task. And so I had found that a mailbox service exists called , and that it runs its own Tor Exit-Node internally, for which reason we could send and receive email with them, once we have set up and paid for an account.

What I discovered, is that this not only works in theory, but actually does in practice. We need to install an ‘‘ extension named “” to get that to work, but it does finally work.

Continue reading Setting Up Torbirdy