RT-AC88U vpn problem (open vpn client)

[tester83]

Hi all,

i have imported openVPN config file on my asus rt-ac88u router, for use it as a OpenVPN Clients.

When i try change service state to ON i read this error on System log file:

Jan 17 16:57:04 rc_service: httpd 533:notify_rc start_vpnclient1
Jan 17 16:57:05 openvpn[28172]: Options error: Unrecognized option or missing parameter(s) in config.ovpn:33: register-dns (2.3.14)
Jan 17 16:57:05 openvpn[28172]: Use --help for more information.

this is the configuration:

auth md5
auth-user-pass
cipher AES-256-CBC
client
comp-lzo adaptive
dev tun
explicit-exit-notify 2
fragment 1390
hand-window 30
key-direction 1
mssfix
mute 5
mute-replay-warnings
nobind
ns-cert-type server
persist-key
redirect-gateway def1
register-dns
remote xxx.xxx.xxx.xxx 1194 udp
reneg-sec 0
resolv-retry infinite
route-delay 2
route-method exe
route-metric 1
topology subnet
tun-mtu 1500
verb 4

what could be the error???

Thank you

 

[octopus]

You don't told which firware you using.
Try to remove from configfile and restart client1:
register-dns
explicit-exit-notify 2

If you must use "auth md5" otherwise switch to SHA1 as security matter.

 

[tester83]

You don't told which firware you using.
Try to remove from configfile and restart client1:
register-dns
explicit-exit-notify 2

If you must use "auth md5" otherwise switch to SHA1 as security matter.

Thanx for your reply octopus.




I'm using Merlin 380.64.
On custom configuration box i have removed:
register-dns
explicit-exit-notify 2

OpenVPN Client 1 - Connecting... (xx.xx.xx.xxx udp:1194) (It appears in the loop)

Now i don't have previous errror but these:

Jan 18 11:14:07 openvpn[10677]: Current Parameter Settings:
Jan 18 11:14:07 openvpn[10677]: config = 'config.ovpn'
Jan 18 11:14:07 openvpn[10677]: mode = 0
Jan 18 11:14:07 openvpn[10677]: persist_config = DISABLED
Jan 18 11:14:07 openvpn[10677]: persist_mode = 1
Jan 18 11:14:07 openvpn[10677]: NOTE: --mute triggered...
Jan 18 11:14:07 openvpn[10677]: 217 variation(s) on previous 5 message(s) suppressed by --mute
Jan 18 11:14:07 openvpn[10677]: OpenVPN 2.3.14 arm-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Dec 16 2016
Jan 18 11:14:07 openvpn[10677]: library versions: OpenSSL 1.0.2j 26 Sep 2016, LZO 2.08
Jan 18 11:14:07 openvpn[10679]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Jan 18 11:14:07 openvpn[10679]: Control Channel Authentication: using 'static.key' as a OpenVPN static key file
Jan 18 11:14:07 openvpn[10679]: Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Jan 18 11:14:07 openvpn[10679]: Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Jan 18 11:14:07 openvpn[10679]: LZO compression initialized
Jan 18 11:14:07 openvpn[10679]: Control Channel MTU parms [ L:1562 D:1184 EF:66 EB:0 ET:0 EL:3 ]
Jan 18 11:14:07 openvpn[10679]: Socket Buffers: R=[122880->122880] S=[122880->122880]
Jan 18 11:14:07 openvpn[10679]: Data Channel MTU parms [ L:1562 D:1390 EF:62 EB:143 ET:0 EL:3 AF:3/1 ]
Jan 18 11:14:07 openvpn[10679]: Fragmentation MTU parms [ L:1562 D:1390 EF:61 EB:143 ET:1 EL:3 AF:3/1 ]
Jan 18 11:14:07 openvpn[10679]: Local Options String: 'V4,dev-type tun,link-mtu 1562,tun-mtu 1500,proto UDPv4,comp-lzo,mtu-dynamic,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
Jan 18 11:14:07 openvpn[10679]: Expected Remote Options String: 'V4,dev-type tun,link-mtu 1562,tun-mtu 1500,proto UDPv4,comp-lzo,mtu-dynamic,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
Jan 18 11:14:07 openvpn[10679]: Local Options hash (VER=V4): 'e05aa1c5'
Jan 18 11:14:07 openvpn[10679]: Expected Remote Options hash (VER=V4): '0088baee'
Jan 18 11:14:07 openvpn[10679]: UDPv4 link local: [undef]
Jan 18 11:14:07 openvpn[10679]: UDPv4 link remote: [AF_INET]xx.xx.xx.xxx:1194
Jan 18 11:14:37 openvpn[10679]: TLS Error: TLS key negotiation failed to occur within 30 seconds (check your network connectivity)
Jan 18 11:14:37 openvpn[10679]: TLS Error: TLS handshake failed
Jan 18 11:14:37 openvpn[10679]: TCP/UDP: Closing socket
Jan 18 11:14:37 openvpn[10679]: SIGUSR1[soft,tls-error] received, process restarting
Jan 18 11:14:37 openvpn[10679]: Restart pause, 2 second(s)
Jan 18 11:14:39 openvpn[10679]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Jan 18 11:14:39 openvpn[10679]: Re-using SSL/TLS context
Jan 18 11:14:39 openvpn[10679]: LZO compression initialized
Jan 18 11:14:39 openvpn[10679]: Control Channel MTU parms [ L:1562 D:1184 EF:66 EB:0 ET:0 EL:3 ]
Jan 18 11:14:39 openvpn[10679]: Socket Buffers: R=[122880->122880] S=[122880->122880]
Jan 18 11:14:39 openvpn[10679]: Data Channel MTU parms [ L:1562 D:1390 EF:62 EB:143 ET:0 EL:3 AF:3/1 ]
Jan 18 11:14:39 openvpn[10679]: Fragmentation MTU parms [ L:1562 D:1390 EF:61 EB:143 ET:1 EL:3 AF:3/1 ]
Jan 18 11:14:39 openvpn[10679]: Local Options String: 'V4,dev-type tun,link-mtu 1562,tun-mtu 1500,proto UDPv4,comp-lzo,mtu-dynamic,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
Jan 18 11:14:39 openvpn[10679]: Expected Remote Options String: 'V4,dev-type tun,link-mtu 1562,tun-mtu 1500,proto UDPv4,comp-lzo,mtu-dynamic,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
Jan 18 11:14:39 openvpn[10679]: Local Options hash (VER=V4): 'e05aa1c5'
Jan 18 11:14:39 openvpn[10679]: Expected Remote Options hash (VER=V4): '0088baee'
Jan 18 11:14:39 openvpn[10679]: UDPv4 link local: [undef]
Jan 18 11:14:39 openvpn[10679]: UDPv4 link remote: [AF_INET]68.71.55.123:1194
Jan 18 11:15:01 (restart_wan.sh): 10853 START VERIFICA CONNESSIONE
Jan 18 11:15:09 openvpn[10679]: TLS Error: TLS key negotiation failed to occur within 30 seconds (check your network connectivity)
Jan 18 11:15:09 openvpn[10679]: TLS Error: TLS handshake failed
Jan 18 11:15:09 openvpn[10679]: TCP/UDP: Closing socket
Jan 18 11:15:09 openvpn[10679]: SIGUSR1[soft,tls-error] received, process restarting
Jan 18 11:15:09 openvpn[10679]: Restart pause, 2 second(s)
Jan 18 11:15:11 openvpn[10679]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Jan 18 11:15:11 openvpn[10679]: Re-using SSL/TLS context
Jan 18 11:15:11 openvpn[10679]: LZO compression initialized
Jan 18 11:15:11 openvpn[10679]: Control Channel MTU parms [ L:1562 D:1184 EF:66 EB:0 ET:0 EL:3 ]
Jan 18 11:15:11 openvpn[10679]: Socket Buffers: R=[122880->122880] S=[122880->122880]
Jan 18 11:15:11 openvpn[10679]: Data Channel MTU parms [ L:1562 D:1390 EF:62 EB:143 ET:0 EL:3 AF:3/1 ]
Jan 18 11:15:11 openvpn[10679]: Fragmentation MTU parms [ L:1562 D:1390 EF:61 EB:143 ET:1 EL:3 AF:3/1 ]
Jan 18 11:15:11 openvpn[10679]: Local Options String: 'V4,dev-type tun,link-mtu 1562,tun-mtu 1500,proto UDPv4,comp-lzo,mtu-dynamic,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
Jan 18 11:15:11 openvpn[10679]: Expected Remote Options String: 'V4,dev-type tun,link-mtu 1562,tun-mtu 1500,proto UDPv4,comp-lzo,mtu-dynamic,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
Jan 18 11:15:11 openvpn[10679]: Local Options hash (VER=V4): 'e05aa1c5'
Jan 18 11:15:11 openvpn[10679]: Expected Remote Options hash (VER=V4): '0088baee'
Jan 18 11:15:11 openvpn[10679]: UDPv4 link local: [undef]
Jan 18 11:15:11 openvpn[10679]: UDPv4 link remote: [AF_INET]xxx.xxx.xxx.xxx:1194
Jan 18 11:15:41 openvpn[10679]: TLS Error: TLS key negotiation failed to occur within 30 seconds (check your network connectivity)
Jan 18 11:15:41 openvpn[10679]: TLS Error: TLS handshake failed
Jan 18 11:15:41 openvpn[10679]: TCP/UDP: Closing socket
Jan 18 11:15:41 openvpn[10679]: SIGUSR1[soft,tls-error] received, process restarting
Jan 18 11:15:41 openvpn[10679]: Restart pause, 2 second(s)
Jan 18 11:15:43 openvpn[10679]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Jan 18 11:15:43 openvpn[10679]: Re-using SSL/TLS context
Jan 18 11:15:43 openvpn[10679]: LZO compression initialized
Jan 18 11:15:43 openvpn[10679]: Control Channel MTU parms [ L:1562 D:1184 EF:66 EB:0 ET:0 EL:3 ]
Jan 18 11:15:43 openvpn[10679]: Socket Buffers: R=[122880->122880] S=[122880->122880]
Jan 18 11:15:43 openvpn[10679]: Data Channel MTU parms [ L:1562 D:1390 EF:62 EB:143 ET:0 EL:3 AF:3/1 ]
Jan 18 11:15:43 openvpn[10679]: Fragmentation MTU parms [ L:1562 D:1390 EF:61 EB:143 ET:1 EL:3 AF:3/1 ]
Jan 18 11:15:43 openvpn[10679]: Local Options String: 'V4,dev-type tun,link-mtu 1562,tun-mtu 1500,proto UDPv4,comp-lzo,mtu-dynamic,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
Jan 18 11:15:43 openvpn[10679]: Expected Remote Options String: 'V4,dev-type tun,link-mtu 1562,tun-mtu 1500,proto UDPv4,comp-lzo,mtu-dynamic,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
Jan 18 11:15:43 openvpn[10679]: Local Options hash (VER=V4): 'e05aa1c5'
Jan 18 11:15:43 openvpn[10679]: Expected Remote Options hash (VER=V4): '0088baee'
Jan 18 11:15:43 openvpn[10679]: UDPv4 link local: [undef]
Jan 18 11:15:43 openvpn[10679]: UDPv4 link remote: [AF_INET]xxx.xxx.xxx.xxx:1194

 

[octopus]

TLS Error: TLS key negotiation failed to occur within 30 seconds (check your network connectivity)
TLS Error: TLS handshake failed
Control Channel Authentication: using 'static.key' as a OpenVPN static key file

Make sure static key is same on server/client side and Extra HMAC Authorization is "1" on client and "0" server side.

 

[tester83]

the VPN is a service of strongvpn.com that supports only router with DD-WRT, Tomato or Sabai firmware. Other firmware can be tested without any their support.

I attached a screen with the router configuration. Is it ok?

custom configuration here:

fragment 1390
hand-window 30
mssfix
mute 5
mute-replay-warnings
ns-cert-type server
reneg-sec 0
route-delay 2
route-method exe
route-metric 1
topology subnet
tun-mtu 1500

Thank you octopus

 

[octopus]

Look at this, may help you.
http://www.snbforums.com/threads/help-with-strongvpn-configuration.12792/page-2#post-285453

 

[tester83]

I followed the link and also i have tried official guide here http://strongvpn.com/setup-tomato-openvpn.html

but i have always this error Auth digest is set to default:

an 18 23:19:49 openvpn[8013]: TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Jan 18 23:19:49 openvpn[8013]: TLS Error: TLS handshake failed

When i change Auth digest to MD5 i have "AUTH_FAILED", this is log:

Jan 18 23:30:37 rc_service: httpd 533:notify_rc start_vpnclient1
Current Parameter Settings:
config = 'config.ovpn'
mode = 0
persist_config = DISABLED
persist_mode = 1
show_ciphers = DISABLED
show_digests = DISABLED
show_engines = DISABLED
genkey = DISABLED
key_pass_file = '[UNDEF]'
show_tls_ciphers = DISABLED
Connection profiles [default]:
proto = udp
local = '[UNDEF]'
local_port = 0
remote = 'xxx.xxx.xxx'
remote_port = 1194
remote_float = DISABLED
bind_defined = DISABLED
bind_local = DISABLED
connect_retry_seconds = 5
connect_timeout = 10
connect_retry_max = 0
tun_mtu = 1500
tun_mtu_defined = ENABLED
link_mtu = 1500
link_mtu_defined = DISABLED
tun_mtu_extra = 0
tun_mtu_extra_defined = DISABLED
mtu_discover_type = -1
fragment = 1390
mssfix = 1390
explicit_exit_notification = 0
Connection profiles END
remote_random = DISABLED
ipchange = '[UNDEF]'
dev = 'tun11'
dev_type = '[UNDEF]'
dev_node = '[UNDEF]'
lladdr = '[UNDEF]'
topology = 1
tun_ipv6 = DISABLED
ifconfig_local = '[UNDEF]'
ifconfig_remote_netmask = '[UNDEF]'
ifconfig_noexec = DISABLED
ifconfig_nowarn = DISABLED
ifconfig_ipv6_local = '[UNDEF]'
ifconfig_ipv6_netbits = 0
ifconfig_ipv6_remote = '[UNDEF]'
shaper = 0
mtu_test = 0
mlock = DISABLED
keepalive_ping = 0
keepalive_timeout = 0
inactivity_timeout = 0
ping_send_timeout = 0
ping_rec_timeout = 0
ping_rec_timeout_action = 0
ping_timer_remote = DISABLED
remap_sigusr1 = 0
persist_tun = ENABLED
persist_local_ip = DISABLED
persist_remote_ip = DISABLED
persist_key = ENABLED
passtos = DISABLED
resolve_retry_seconds = 1000000000
username = '[UNDEF]'
groupname = '[UNDEF]'
chroot_dir = '[UNDEF]'
cd_dir = '/etc/openvpn/client1'
writepid = '[UNDEF]'
up_script = 'updown.sh'
down_script = 'updown.sh'
down_pre = DISABLED
up_restart = DISABLED
up_delay = DISABLED
daemon = ENABLED
inetd = 0
log = DISABLED
suppress_timestamps = DISABLED
nice = 0
verbosity = 4
mute = 0
status_file = 'status'
status_file_version = 2
status_file_update_freq = 10
occ = ENABLED
rcvbuf = 0
sndbuf = 0
mark = 0
sockflags = 0
fast_io = DISABLED
lzo = 7
route_script = 'vpnrouting.sh'
route_default_gateway = '[UNDEF]'
route_default_metric = 0
route_noexec = DISABLED
route_delay = 2
route_delay_window = 30
route_delay_defined = ENABLED
route_nopull = DISABLED
route_gateway_via_dhcp = DISABLED
max_routes = 100
allow_pull_fqdn = DISABLED
[redirect_default_gateway local=0]
management_addr = '[UNDEF]'
management_port = 0
management_user_pass = '[UNDEF]'
management_log_history_cache = 250
management_echo_buffer_size = 100
management_write_peer_info_file = '[UNDEF]'
management_client_user = '[UNDEF]'
management_client_group = '[UNDEF]'
management_flags = 0
shared_secret_file = '[UNDEF]'
key_direction = 2
ciphername_defined = ENABLED
ciphername = 'AES-256-CBC'
authname_defined = ENABLED
authname = 'MD5'
prng_hash = 'SHA1'
prng_nonce_secret_len = 16
keysize = 0
engine = DISABLED
replay = ENABLED
mute_replay_warnings = DISABLED
replay_window = 64
replay_time = 15
packet_id_file = '[UNDEF]'
use_iv = ENABLED
test_crypto = DISABLED
tls_server = DISABLED
tls_client = ENABLED
key_method = 2
ca_file = 'ca.crt'
ca_path = '[UNDEF]'
dh_file = '[UNDEF]'
cert_file = '[UNDEF]'
extra_certs_file = '[UNDEF]'
priv_key_file = '[UNDEF]'
pkcs12_file = '[UNDEF]'
cipher_list = '[UNDEF]'
tls_verify = '[UNDEF]'
tls_export_cert = '[UNDEF]'
verify_x509_type = 0
verify_x509_name = '[UNDEF]'
crl_file = '[UNDEF]'
ns_cert_type = 1
remote_cert_ku = 0
remote_cert_ku = 0
remote_cert_ku = 0
remote_cert_ku = 0
remote_cert_ku = 0
remote_cert_ku = 0
remote_cert_ku = 0
remote_cert_ku = 0
remote_cert_ku = 0
remote_cert_ku = 0
remote_cert_ku = 0
remote_cert_ku = 0
remote_cert_ku = 0
remote_cert_ku = 0
remote_cert_ku = 0
remote_cert_ku = 0
remote_cert_eku = '[UNDEF]'
ssl_flags = 0
tls_timeout = 2
renegotiate_bytes = -1
renegotiate_packets = 0
renegotiate_seconds = 3600
handshake_window = 30
transition_window = 3600
single_session = DISABLED
push_peer_info = DISABLED
tls_exit = DISABLED
tls_auth_file = 'static.key'
server_network = 0.0.0.0
server_netmask = 0.0.0.0
server_network_ipv6 = ::
server_netbits_ipv6 = 0
server_bridge_ip = 0.0.0.0
server_bridge_netmask = 0.0.0.0
server_bridge_pool_start = 0.0.0.0
server_bridge_pool_end = 0.0.0.0
ifconfig_pool_defined = DISABLED
ifconfig_pool_start = 0.0.0.0
ifconfig_pool_end = 0.0.0.0
ifconfig_pool_netmask = 0.0.0.0
ifconfig_pool_persist_filename = '[UNDEF]'
ifconfig_pool_persist_refresh_freq = 600
ifconfig_ipv6_pool_defined = DISABLED
ifconfig_ipv6_pool_base = ::
ifconfig_ipv6_pool_netbits = 0
n_bcast_buf = 256
tcp_queue_limit = 64
real_hash_size = 256
virtual_hash_size = 256
client_connect_script = '[UNDEF]'
learn_address_script = '[UNDEF]'
client_disconnect_script = '[UNDEF]'
client_config_dir = '[UNDEF]'
ccd_exclusive = DISABLED
tmp_dir = '/tmp'
push_ifconfig_defined = DISABLED
push_ifconfig_local = 0.0.0.0
push_ifconfig_remote_netmask = 0.0.0.0
push_ifconfig_ipv6_defined = DISABLED
push_ifconfig_ipv6_local = ::/0
push_ifconfig_ipv6_remote = ::
enable_c2c = DISABLED
duplicate_cn = DISABLED
cf_max = 0
cf_per = 0
max_clients = 1024
max_routes_per_client = 256
auth_user_pass_verify_script = '[UNDEF]'
auth_user_pass_verify_script_via_file = DISABLED
port_share_host = '[UNDEF]'
port_share_port = 0
client = ENABLED
pull = ENABLED
auth_user_pass_file = 'up'
OpenVPN 2.3.14 arm-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Dec 16 2016
library versions: OpenSSL 1.0.2j 26 Sep 2016, LZO 2.08
NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Control Channel Authentication: using 'static.key' as a OpenVPN static key file
Outgoing Control Channel Authentication: Using 128 bit message hash 'MD5' for HMAC authentication
Incoming Control Channel Authentication: Using 128 bit message hash 'MD5' for HMAC authentication
LZO compression initialized
Control Channel MTU parms [ L:1558 D:1188 EF:62 EB:0 ET:0 EL:3 ]
Socket Buffers: R=[122880->122880] S=[122880->122880]
Data Channel MTU parms [ L:1558 D:1390 EF:58 EB:143 ET:0 EL:3 AF:3/1 ]
Fragmentation MTU parms [ L:1558 D:1390 EF:57 EB:143 ET:1 EL:3 AF:3/1 ]
Local Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,mtu-dynamic,keydir 1,cipher AES-256-CBC,auth MD5,keysize 256,tls-auth,key-method 2,tls-client'
Expected Remote Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,mtu-dynamic,keydir 0,cipher AES-256-CBC,auth MD5,keysize 256,tls-auth,key-method 2,tls-server'
Local Options hash (VER=V4): 'df4facff'
Expected Remote Options hash (VER=V4): 'a4aabb18'
UDPv4 link local: [undef]
UDPv4 link remote: [AF_INET]xxx.xxx.xxx.xxx:1194
TLS: Initial packet from [AF_INET]xxx.xxx.xxx.xxx:1194, sid=d32902e7 29b3b006
WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
VERIFY OK: depth=1, C=US, ST=CA, L=San-Francisco, O=reliablehosting.com, CN=reliablehosting.com CA, emailAddress=techies@reliablehosting.com
VERIFY OK: nsCertType=SERVER
VERIFY OK: depth=0, C=US, ST=CA, L=San-Francisco, O=reliablehosting.com, CN=openvpn, emailAddress=techies@reliablehosting.com
Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Data Channel Encrypt: Using 128 bit message hash 'MD5' for HMAC authentication
Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Data Channel Decrypt: Using 128 bit message hash 'MD5' for HMAC authentication
Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
[openvpn] Peer Connection Initiated with [AF_INET]xxx.xxx.xxx.xxx:1194
SENT CONTROL [openvpn]: 'PUSH_REQUEST' (status=1)
AUTH: Received control message: AUTH_FAILED
TCP/UDP: Closing socket
SIGTERM[soft,auth-failure] received, process exiting

we are solving?

 

[tester83]

up