AC68U 384.6 not importing OpenVPN certs or saving them if manually entered

ArtG · Sep 6, 2018

I have uploaded the Torguard .ovpn file and followed all steps in this walk through

https://x3mtek.com/torguard-openvpn-2-4-client-setup-for-asuswrt-merlin-firmware/

The VPN fails to start with a Options error: You must define CA file (--ca) or CA path (--capath). I manually enter the keys but they do not save. I also do not see a jffs/openvpn directory when I ssh to the router. I have flashed the router to start from scratch but get the same results.

bnhf · Sep 6, 2018

ArtG said:
I have uploaded the Torguard .ovpn file and followed all steps in this walk through

https://x3mtek.com/torguard-openvpn-2-4-client-setup-for-asuswrt-merlin-firmware/

The VPN fails to start with a Options error: You must define CA file (--ca) or CA path (--capath). I manually enter the keys but they do not save. I also do not see a jffs/openvpn directory when I ssh to the router. I have flashed the router to start from scratch but get the same results.

Does the OpenVPN config, as generated by Torguard, work if you load it into a standalone PC client? You can download and install one from here:

https://openvpn.net/index.php/open-source/downloads.html

If it doesn't work in a standalone client it won't work in AsusWRT-Merlin.

RMerlin · Sep 6, 2018

You must do things in that order:

1) Upload the config file
2) Edit keys/certs
3) Apply to save them
4) Start the client

If you enter key/certs before uploading the config, they will be overwritten.

ArtG · Sep 6, 2018

bnhf said:
Does the OpenVPN config, as generated by Torguard, work if you load it into a standalone PC client? You can download and install one from here:

https://openvpn.net/index.php/open-source/downloads.html

If it doesn't work in a standalone client it won't work in AsusWRT-Merlin.

Yes the .ovpn file does work and connect from a windows 10 desktop.

ArtG · Sep 6, 2018

RMerlin said:
You must do things in that order:

1) Upload the config file
2) Edit keys/certs
3) Apply to save them
4) Start the client

If you enter key/certs before uploading the config, they will be overwritten.

I get the same results with this process as well. Options error: You must define CA file (--ca) or CA path (--capath). The Static Key and CA are not being saved in the gui config.

bnhf · Sep 6, 2018

ArtG said:
I have uploaded the Torguard .ovpn file and followed all steps in this walk through

https://x3mtek.com/torguard-openvpn-2-4-client-setup-for-asuswrt-merlin-firmware/

The VPN fails to start with a Options error: You must define CA file (--ca) or CA path (--capath). I manually enter the keys but they do not save. I also do not see a jffs/openvpn directory when I ssh to the router. I have flashed the router to start from scratch but get the same results.

Just took a look at a sample Torguard .ovpn file and it looks like this:

Code:

client
dev tun
remote chi.central.usa.torguardvpnaccess.com 443 udp
remote chi.central.usa.torguardvpnaccess.com 443 tcp
resolv-retry infinite
nobind
persist-key
persist-tun
setenv CLIENT_CERT 0
<ca>
-----BEGIN CERTIFICATE-----
MIIEwTCCA6mgAwIBAgIJAKROjebUHo0gMA0GCSqGSIb3DQEBBQUAMIGbMQswCQYD
VQQGEwJVUzELMAkGA1UECBMCRkwxEDAOBgNVBAcTB09ybGFuZG8xETAPBgNVBAoT
CFRvckd1YXJkMQwwCgYDVQQLEwNWUE4xEzARBgNVBAMTClRHLU9WUE4tQ0ExETAP
BgNVBCkTCFRvckd1YXJkMSQwIgYJKoZIhvcNAQkBFhVzeXNhZG1pbkB0b3JndWFy
ZC5uZXQwHhcNMTQwNDE3MTAwOTIzWhcNMjQwNDE0MTAwOTIzWjCBmzELMAkGA1UE
BhMCVVMxCzAJBgNVBAgTAkZMMRAwDgYDVQQHEwdPcmxhbmRvMREwDwYDVQQKEwhU
b3JHdWFyZDEMMAoGA1UECxMDVlBOMRMwEQYDVQQDEwpURy1PVlBOLUNBMREwDwYD
VQQpEwhUb3JHdWFyZDEkMCIGCSqGSIb3DQEJARYVc3lzYWRtaW5AdG9yZ3VhcmQu
bmV0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAws1hJzlbWKlm3DEO
XyQpmvtxwrsR4CIYMi8C6np5w74lTRYmGBcuuPqAT3ig2DnH9HNNFx1WWZbYO8pU
a1tdn7uYErJi4EP9/t2l3uXCNgoWYVdVP1j5EXIY1oacOv9srbNZHeWpxHIb1wZr
1i4sLsdaifOibgVZI91FATXGrVdFDaQb2OjyJrFW8b4xbC8pBJxQDzqPeu9mkVpu
OhBuU+dM+9h+8Bj0tpdAernEAt8CbHIywe9Rjm0JLrYmCPKuB5ldVgG3rYQWFa3X
YWjrWtr//nGM4f4WKOFc2PHWA2gI3JwdynTNLsB9NQi0N7hhR6lmtCMeqHlm0oAz
4Ad4gQIDAQABo4IBBDCCAQAwHQYDVR0OBBYEFJvAPA1gnlD/majxi+43jL0XDfqQ
MIHQBgNVHSMEgcgwgcWAFJvAPA1gnlD/majxi+43jL0XDfqQoYGhpIGeMIGbMQsw
CQYDVQQGEwJVUzELMAkGA1UECBMCRkwxEDAOBgNVBAcTB09ybGFuZG8xETAPBgNV
BAoTCFRvckd1YXJkMQwwCgYDVQQLEwNWUE4xEzARBgNVBAMTClRHLU9WUE4tQ0Ex
ETAPBgNVBCkTCFRvckd1YXJkMSQwIgYJKoZIhvcNAQkBFhVzeXNhZG1pbkB0b3Jn
dWFyZC5uZXSCCQCkTo3m1B6NIDAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUA
A4IBAQBRG46DnL/8EAPbi/eOQli5WO7lRHYyZJdlLUMlsnwkp6Ul6BMJq8q3UX3z
+pqDf3wzj94y/IpGQgE4l0fgAdwf/C7F533TSwU/vi+5PDWfwD2WmGqVmcmXn6Rp
9Fwr+oryRw8GfsVBLZHTkWF1RZrRAr8hWZhNySGFwSXlEIicvNy+9mlFhk2Nb46w
ioZKc1Lc7/okeXNWHPv6Dlm39TcNBpGX/xNoWBzqs1EtA1ZGvMcQHsKLfi3Nbaab
BYe08KWsfeZA+ih4BZ6y2E+x84NYHRebqijXTtHp35coyXllBL/+LBoZ86hKszEx
F3pjGU0+8NzvdPUbKndhzyPPnHF1
-----END CERTIFICATE-----
</ca>
tls-client
remote-cert-tls server
auth-user-pass
comp-lzo
verb 1
reneg-sec 0

Looks pretty straightforward. You mention "keys" (plural) though in your original post. Torguard (in this sample file) is only using a Certificate Authority and then your username and password to validate you. You may want to try just configuring your router client from scratch, without uploading the .ovpn. You shouldn't need to worry about the "client", "dev tun", or "setenv CLIENT_CERT 0" items -- they're taken care of for you or irrelevant. "persist-key" and "persist-tun" go in the custom config box at the bottom. The rest of the config items should match up with drop-down box items or radio-button selections in the client config GUI. I'd suggest going with either the UDP or TCP Torguard server, not both.

The Certificate Authority to paste in and save (in this example) would look like this:

Code:

Be sure to get all the dashes in your copy and paste, but not the <ca> or </ca> and scroll down in that pop-up window to save it. That should do it, and hopefully get you connected.

ArtG · Sep 7, 2018

bnhf said:

Just took a look at a sample Torguard .ovpn file and it looks like this:

Code:

client
dev tun
remote chi.central.usa.torguardvpnaccess.com 443 udp
remote chi.central.usa.torguardvpnaccess.com 443 tcp
resolv-retry infinite
nobind
persist-key
persist-tun
setenv CLIENT_CERT 0
<ca>
-----BEGIN CERTIFICATE-----
MIIEwTCCA6mgAwIBAgIJAKROjebUHo0gMA0GCSqGSIb3DQEBBQUAMIGbMQswCQYD
VQQGEwJVUzELMAkGA1UECBMCRkwxEDAOBgNVBAcTB09ybGFuZG8xETAPBgNVBAoT
CFRvckd1YXJkMQwwCgYDVQQLEwNWUE4xEzARBgNVBAMTClRHLU9WUE4tQ0ExETAP
BgNVBCkTCFRvckd1YXJkMSQwIgYJKoZIhvcNAQkBFhVzeXNhZG1pbkB0b3JndWFy
ZC5uZXQwHhcNMTQwNDE3MTAwOTIzWhcNMjQwNDE0MTAwOTIzWjCBmzELMAkGA1UE
BhMCVVMxCzAJBgNVBAgTAkZMMRAwDgYDVQQHEwdPcmxhbmRvMREwDwYDVQQKEwhU
b3JHdWFyZDEMMAoGA1UECxMDVlBOMRMwEQYDVQQDEwpURy1PVlBOLUNBMREwDwYD
VQQpEwhUb3JHdWFyZDEkMCIGCSqGSIb3DQEJARYVc3lzYWRtaW5AdG9yZ3VhcmQu
bmV0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAws1hJzlbWKlm3DEO
XyQpmvtxwrsR4CIYMi8C6np5w74lTRYmGBcuuPqAT3ig2DnH9HNNFx1WWZbYO8pU
a1tdn7uYErJi4EP9/t2l3uXCNgoWYVdVP1j5EXIY1oacOv9srbNZHeWpxHIb1wZr
1i4sLsdaifOibgVZI91FATXGrVdFDaQb2OjyJrFW8b4xbC8pBJxQDzqPeu9mkVpu
OhBuU+dM+9h+8Bj0tpdAernEAt8CbHIywe9Rjm0JLrYmCPKuB5ldVgG3rYQWFa3X
YWjrWtr//nGM4f4WKOFc2PHWA2gI3JwdynTNLsB9NQi0N7hhR6lmtCMeqHlm0oAz
4Ad4gQIDAQABo4IBBDCCAQAwHQYDVR0OBBYEFJvAPA1gnlD/majxi+43jL0XDfqQ
MIHQBgNVHSMEgcgwgcWAFJvAPA1gnlD/majxi+43jL0XDfqQoYGhpIGeMIGbMQsw
CQYDVQQGEwJVUzELMAkGA1UECBMCRkwxEDAOBgNVBAcTB09ybGFuZG8xETAPBgNV
BAoTCFRvckd1YXJkMQwwCgYDVQQLEwNWUE4xEzARBgNVBAMTClRHLU9WUE4tQ0Ex
ETAPBgNVBCkTCFRvckd1YXJkMSQwIgYJKoZIhvcNAQkBFhVzeXNhZG1pbkB0b3Jn
dWFyZC5uZXSCCQCkTo3m1B6NIDAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUA
A4IBAQBRG46DnL/8EAPbi/eOQli5WO7lRHYyZJdlLUMlsnwkp6Ul6BMJq8q3UX3z
+pqDf3wzj94y/IpGQgE4l0fgAdwf/C7F533TSwU/vi+5PDWfwD2WmGqVmcmXn6Rp
9Fwr+oryRw8GfsVBLZHTkWF1RZrRAr8hWZhNySGFwSXlEIicvNy+9mlFhk2Nb46w
ioZKc1Lc7/okeXNWHPv6Dlm39TcNBpGX/xNoWBzqs1EtA1ZGvMcQHsKLfi3Nbaab
BYe08KWsfeZA+ih4BZ6y2E+x84NYHRebqijXTtHp35coyXllBL/+LBoZ86hKszEx
F3pjGU0+8NzvdPUbKndhzyPPnHF1
-----END CERTIFICATE-----
</ca>
tls-client
remote-cert-tls server
auth-user-pass
comp-lzo
verb 1
reneg-sec 0

Looks pretty straightforward. You mention "keys" (plural) though in your original post. Torguard (in this sample file) is only using a Certificate Authority and then your username and password to validate you. You may want to try just configuring your router client from scratch, without uploading the .ovpn. You shouldn't need to worry about the "client", "dev tun", or "setenv CLIENT_CERT 0" items -- they're taken care of for you or irrelevant. "persist-key" and "persist-tun" go in the custom config box at the bottom. The rest of the config items should match up with drop-down box items or radio-button selections in the client config GUI. I'd suggest going with either the UDP or TCP Torguard server, not both.

The Certificate Authority to paste in and save (in this example) would look like this:

Code:

Be sure to get all the dashes in your copy and paste, but not the <ca> or </ca> and scroll down in that pop-up window to save it. That should do it, and hopefully get you connected.

Even without using the.ovpn file I get the same CA error. After I enter the CA in the gui and save and apply. When I go back to view the CA it is no longer there.

john9527 · Sep 7, 2018

@ArtG Can you log into the router and post the output of running

df

bnhf · Sep 7, 2018

ArtG said:
Even without using the.ovpn file I get the same CA error. After I enter the CA in the gui and save and apply. When I go back to view the CA it is no longer there.

It seems like a factory reset would be in order at this point. You could also try flashing back to stock firmware to verify that you can save a CA there. Either way, one or more factory resets wouldn't hurt.

ArtG · Sep 7, 2018

john9527 said:
@ArtG Can you log into the router and post the output of running

df

Filesystem 1K-blocks Used Available Use% Mounted on
/dev/root 34816 34816 0 100% /
devtmpfs 127744 0 127744 0% /dev
tmpfs 127848 512 127336 0% /tmp

john9527 · Sep 7, 2018

@ArtG

Ahhh....you have no /jffs mounted so it can't save the certs (and a lot of other things that now need to go into jffs space)

Go to the Administration > System page and select the option to format JFFS on next boot, hit apply, then Reboot at the top of the page. After it reboots, wait a couple of minutes, then reboot again. Then give it another try.

ArtG · Sep 7, 2018

john9527 said:
@ArtG

Ahhh....you have no /jffs mounted so it can't save the certs (and a lot of other things that now need to go into jffs space)

Go to the Administration > System page and select the option to format JFFS on next boot, hit apply, then Reboot at the top of the page. After it reboots, wait a couple of minutes, then reboot again. Then give it another try.

I ran through this process twice and still cannot save the CA in the gui and the df output shows the same.

Filesystem 1K-blocks Used Available Use% Mounted on
/dev/root 34816 34816 0 100% /
devtmpfs 127744 0 127744 0% /dev
tmpfs 127848 400 127448 0% /tmp

john9527 · Sep 7, 2018

I have to ask....is this a real AC68 or a converted TM-1900?

If the former..
.
post the output of
cat /proc/mtd

and upload your syslog to a file sharing site and PM a link so I can take a look at it.

ArtG · Sep 7, 2018

john9527 said:
I have to ask....is this a real AC68 or a converted TM-1900?

If the former..
.
post the output of
cat /proc/mtd

and upload your syslog to a file sharing site and PM a link so I can take a look at it.

It says it is a
RT-AC68U
802.11ac
Wireless-AC1900

@RT-AC68U-D360:/tmp/home/root# cat /proc/mtd
dev: size erasesize name
mtd0: 00080000 00020000 "boot"
mtd1: 00180000 00020000 "nvram"
mtd2: 03e00000 00020000 "linux"
mtd3: 03c62568 00020000 "rootfs"
mtd4: 03ec0000 00020000 "brcmnand"
mtd5: 00140000 00020000 "asus"

Syslog coming.

john9527 · Sep 7, 2018

The mtd output looks right....

john9527 · Sep 7, 2018

@ArtG

Got your syslog.....and have some bad news.

Code:

May  5 00:05:05 kernel: JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
May  5 00:05:05 kernel: Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes
May  5 00:05:05 kernel: empty_blocks 445, bad_blocks 1, c->nr_blocks 502
May  5 00:05:05 kernel: nand_erase_nand: attempt to erase a bad block at page 0x0000ef40

It looks like you have a bad block that the code can't work around when formatting jffs and it just gives up (it looks like the code in general should try and handle it, but apparently in this case it can't).
So, three options....
(1) Someone would need to try and debug the mtd code and find out why it can't skip this block
(2) My LTS fork uses a slightly different code which MAY handle it correctly. You might be able to load my fork, format jffs, and then reload Merlin
(3) If it's still under warranty.....start a return.

ArtG · Sep 7, 2018

I have had the router for 2 years so it may be out of warranty. Where can I get your LTS fork?

john9527 · Sep 7, 2018

Sticky near the top of the forum
https://www.snbforums.com/threads/fork-asuswrt-merlin-374-43-lts-releases-v34e3.18914/

Make sure you read through the first post on how to load the code and do a factory reset after it's loaded.

Thread starter	Title	Forum	Replies	Date
	TM-AC1900 upgraded to RT-AC68U unable to upgrade past 384.15	Asuswrt-Merlin	2	Aug 8, 2023
	RT-AC68U 802.11 DSCP QoS issue?	Asuswrt-Merlin	3	Saturday at 5:05 PM
H	changed AC68U to AX86U Pro, same guest network setting but all devices gone?	Asuswrt-Merlin	11	Apr 26, 2024
S	Help Required AC68U (TM-AC1900) troubleshooting after power outage	Asuswrt-Merlin	3	Apr 9, 2024
A	Help Required Upgrading AC68U from Stock FW to Merlin Please?	Asuswrt-Merlin	15	Mar 25, 2024
C	Where to Download GNUton's Asus Merlin For DSL-AC68U	Asuswrt-Merlin	5	Mar 22, 2024
	ASUS RT-AC68U not working after Merlin firmware update, did I brick it?	Asuswrt-Merlin	15	Mar 21, 2024
T	Cloudflared Tunnel in RT-AC68U	Asuswrt-Merlin	0	Feb 15, 2024
C	Need urgent help with home internet w/ RT-AC68U! Willing to do anything to get this fixed!	Asuswrt-Merlin	5	Feb 14, 2024
B	RT-AC68U QoS and questions about latest Merlin	Asuswrt-Merlin	20	Feb 12, 2024

AC68U 384.6 not importing OpenVPN certs or saving them if manually entered

New Around Here

Regular Contributor

Asuswrt-Merlin dev

New Around Here

New Around Here

Regular Contributor

New Around Here

Part of the Furniture

Regular Contributor

New Around Here

Part of the Furniture

New Around Here

Part of the Furniture

New Around Here

Part of the Furniture

Part of the Furniture

New Around Here

Part of the Furniture

Similar threads

Similar threads

Sign Up For SNBForums Daily Digest