Configuration Iptables Openvpn Client

Sat Apr 9 16:59:39 2022 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sat Apr 9 16:59:39 2022 TLS Error: TLS handshake failed 

iptables -t filter -P INPUT DROP 
iptables -t filter -A INPUT -p tcp --dport 1194 -j ACCEPT
iptables -A INPUT -i ens3 -m state --state NEW -p udp --dport 1194 -j ACCEPT

iptables -t filter -X 
iptables -t nat -F 
iptables -t nat -X 
iptables -t mangle -F 
iptables -t mangle -X 
iptables -t filter -P INPUT DROP 
iptables -t filter -P FORWARD DROP 
iptables -t filter -P OUTPUT ACCEPT 
iptables -t filter -A INPUT -i lo -j ACCEPT 
iptables -t filter -A OUTPUT -o lo -j ACCEPT

#openvpn
   iptables -A INPUT -i ens3 -p tcp --dport 1194 -j ACCEPT
   iptables -A INPUT -i ens3 -p udp --dport 1194 -j ACCEPT
   iptables -A INPUT -i tun+ -j ACCEPT
   iptables -A FORWARD -i tun+ -j ACCEPT
   iptables -A FORWARD -i tun+ -o ens3 -m state --state RELATED,ESTABLISHED -j ACCEPT
   iptables -A FORWARD -i ens3 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT
   iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o ens3 -j MASQUERADE
   iptables -A OUTPUT -o tun+ -j ACCEPT

# Specify that we are a client and that we
# will be pulling certain config file directives
# from the server.
client

# Use the same setting as you are using on
# the server.
# On most systems, the VPN will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
dev tun


# Are we connecting to a TCP or
# UDP server?  Use the same setting as
# on the server.
proto udp

# The hostname/IP and port of the server.
# You can have multiple remote entries
# to load balance between the servers.
remote XXX.XXX.XXX.XXX 1194


# Keep trying indefinitely to resolve the
# host name of the OpenVPN server.  Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
resolv-retry infinite

# Most clients don't need to bind to
# a specific local port number.
nobind

# Downgrade privileges after initialization (non-Windows only)
user nobody
group nogroup

# Try to preserve some state across restarts.
persist-key
persist-tun

# Verify server certificate by checking that the
# certicate has the correct key usage set.
remote-cert-tls server

# Select a cryptographic cipher.
cipher AES-256-GCM
auth SHA256

# Set log file verbosity.
verb 3

#key direction directive
key-direction 1

#systemd-resolved config
script-security 2
up /etc/openvpn/update-systemd-resolved
down /etc/openvpn/update-systemd-resolved
down-pre
dhcp-option DOMAIN-ROUTE .

<ca>
-----BEGIN CERTIFICATE-----
........
</ca>

<cert>
......
</cert>

<key>
.......
</key>

<tls-crypt>
......................
</tls-crypt>

client
dev tun
proto udp
remote XXX.XXX.XXX.XXX 1194

resolv-retry infinite
nobind
user nobody
group nogroup

persist-key
persist-tun

remote-cert-tls server

cipher AES-256-GCM
auth SHA256

verb 3

key-direction 1

#systemd-resolved config
script-security 2
up /etc/openvpn/update-systemd-resolved
down /etc/openvpn/update-systemd-resolved
down-pre
dhcp-option DOMAIN-ROUTE .

iptables -t filter -F
    iptables -t filter -X
    iptables -t nat -F
    iptables -t nat -X
    iptables -t mangle -F
    iptables -t mangle -X

    # strategie (-P) par defaut : bloc tout l'entrant le forward et autorise le sortant
    iptables -t filter -P INPUT DROP
    iptables -t filter -P FORWARD DROP
    iptables -t filter -P OUTPUT ACCEPT


 # Loopback
    iptables -t filter -A INPUT -i lo -j ACCEPT
    iptables -t filter -A OUTPUT -o lo -j ACCEPT

    # Permettre a une connexion ouverte de recevoir du trafic en entree
    iptables -t filter -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

    # ICMP
    iptables -t filter -A INPUT -p icmp -j DROP

    # DNS:53
    iptables -t filter -A INPUT -p tcp --dport 53 -j ACCEPT
    iptables -t filter -A INPUT -p udp --dport 53 -j ACCEPT


  #openvpn
   iptables -A INPUT -i ens3 -p tcp --dport 1194 -j ACCEPT
   iptables -A INPUT -i ens3 -p udp --dport 1194 -j ACCEPT
   iptables -A INPUT -i tun0 -j ACCEPT
   iptables -A FORWARD -i tun0 -j ACCEPT
   iptables -A FORWARD -i tun0 -o ens3 -m state --state RELATED,ESTABLISHED -j ACCEPT
   iptables -A FORWARD -i ens3 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
   iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o ens3 -j MASQUERADE
   iptables -A OUTPUT -o tun0 -j ACCEPT