ExpressVPN - Public IP unknown (problem)

[MidKnight]

Already have nordvpn setup and working, and now I'm wanting to trial ExpressVPN, ive followed there configuration guide and it connects to the server ok, but the public IP comes up as "unknown" , which of cause won't work. I've contacted there support without any luck.

AC88U FW 384.7

 

[RMerlin]

Check your System Log for any error message.

 

[MidKnight]

heres the log when i connected this client.

Oct 30 15:05:20 rc_service: httpd 5118:notify_rc start_vpnclient5
Oct 30 15:05:22 ovpn-client5[17891]: OpenVPN 2.4.6 arm-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Oct 21 2018
Oct 30 15:05:22 ovpn-client5[17891]: library versions: OpenSSL 1.0.2p 14 Aug 2018, LZO 2.08
Oct 30 15:05:22 ovpn-client5[17892]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Oct 30 15:05:22 ovpn-client5[17892]: Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Oct 30 15:05:22 ovpn-client5[17892]: Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Oct 30 15:05:23 ovpn-client5[17892]: TCP/UDP: Preserving recently used remote address: [AF_INET]IPMASKEDHERE:1195
Oct 30 15:05:23 ovpn-client5[17892]: Socket Buffers: R=[122880->122880] S=[122880->122880]
Oct 30 15:05:23 ovpn-client5[17892]: UDP link local: (not bound)
Oct 30 15:05:23 ovpn-client5[17892]: UDP link remote: [AF_INET]117.20.7.19:1195
Oct 30 15:05:23 ovpn-client5[17892]: TLS: Initial packet from [AF_INET]117.20.7.19:1195, sid=c04d4afa 26e32231
Oct 30 15:05:23 ovpn-client5[17892]: WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Oct 30 15:05:23 ovpn-client5[17892]: VERIFY OK: depth=1, C=VG, ST=BVI, O=ExpressVPN, OU=ExpressVPN, CN=ExpressVPN CA, emailAddress=support@expressvpn.com
Oct 30 15:05:23 ovpn-client5[17892]: VERIFY KU OK
Oct 30 15:05:23 ovpn-client5[17892]: Validating certificate extended key usage
Oct 30 15:05:23 ovpn-client5[17892]: ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Oct 30 15:05:23 ovpn-client5[17892]: VERIFY EKU OK
Oct 30 15:05:23 ovpn-client5[17892]: VERIFY OK: depth=0, C=VG, ST=BVI, O=ExpressVPN, OU=ExpressVPN, CN=Server-3024-2a, emailAddress=support@expressvpn.com
Oct 30 15:05:23 ovpn-client5[17892]: WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1633', remote='link-mtu 1606'
Oct 30 15:05:23 ovpn-client5[17892]: WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1532', remote='tun-mtu 1500'
Oct 30 15:05:23 ovpn-client5[17892]: WARNING: 'comp-lzo' is present in remote config but missing in local config, remote='comp-lzo'
Oct 30 15:05:23 ovpn-client5[17892]: WARNING: 'mtu-dynamic' is present in remote config but missing in local config, remote='mtu-dynamic'
Oct 30 15:05:23 ovpn-client5[17892]: Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Oct 30 15:05:23 ovpn-client5[17892]: [Server-3024-2a] Peer Connection Initiated with [AF_INET]117.20.7.19:1195
Oct 30 15:05:24 ovpn-client5[17892]: SENT CONTROL [Server-3024-2a]: 'PUSH_REQUEST' (status=1)
Oct 30 15:05:24 ovpn-client5[17892]: PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 10.118.0.1,comp-lzo no,route 10.118.0.1,topology net30,ping 10,ping-restart 60,ifconfig 10.118.0.34 10.118.0.33,peer-id 10,cipher AES-256-GCM'
Oct 30 15:05:24 ovpn-client5[17892]: OPTIONS IMPORT: timers and/or timeouts modified
Oct 30 15:05:24 ovpn-client5[17892]: OPTIONS IMPORT: compression parms modified
Oct 30 15:05:24 ovpn-client5[17892]: OPTIONS IMPORT: --ifconfig/up options modified
Oct 30 15:05:24 ovpn-client5[17892]: OPTIONS IMPORT: route options modified
Oct 30 15:05:24 ovpn-client5[17892]: OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Oct 30 15:05:24 ovpn-client5[17892]: OPTIONS IMPORT: peer-id set
Oct 30 15:05:24 ovpn-client5[17892]: OPTIONS IMPORT: adjusting link_mtu to 1656
Oct 30 15:05:24 ovpn-client5[17892]: OPTIONS IMPORT: data channel crypto options modified
Oct 30 15:05:24 ovpn-client5[17892]: Data Channel: using negotiated cipher 'AES-256-GCM'
Oct 30 15:05:24 ovpn-client5[17892]: Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Oct 30 15:05:24 ovpn-client5[17892]: Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Oct 30 15:05:24 ovpn-client5[17892]: TUN/TAP device tun15 opened
Oct 30 15:05:24 ovpn-client5[17892]: TUN/TAP TX queue length set to 100
Oct 30 15:05:24 ovpn-client5[17892]: do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Oct 30 15:05:24 ovpn-client5[17892]: /usr/sbin/ip link set dev tun15 up mtu 1500
Oct 30 15:05:24 ovpn-client5[17892]: /usr/sbin/ip addr add dev tun15 local 10.118.0.34 peer 10.118.0.33
Oct 30 15:05:24 ovpn-client5[17892]: updown.sh tun15 1500 1584 10.118.0.34 10.118.0.33 init
Oct 30 15:05:25 rc_service: service 17958:notify_rc updateresolv
Oct 30 15:05:27 ovpn-client5[17892]: /usr/sbin/ip route add 117.20.7.19/32 via 58.96.3.215
Oct 30 15:05:28 ovpn-client5[17892]: /usr/sbin/ip route add 0.0.0.0/1 via 10.118.0.33
Oct 30 15:05:28 ovpn-client5[17892]: /usr/sbin/ip route add 128.0.0.0/1 via 10.118.0.33
Oct 30 15:05:28 ovpn-client5[17892]: /usr/sbin/ip route add 10.118.0.1/32 via 10.118.0.33
Oct 30 15:05:28 openvpn-routing: Configuring policy rules for client 5
Oct 30 15:05:28 ovpn-client5[17892]: Initialization Sequence Completed

 

[RMerlin]

Double check your compression settings, yours don't match what the server uses.

 

[MidKnight]

I've tried changing the compression to lzo, but still no go

 

[octopus]

Oct 30 15:05:24 ovpn-client5[17892]: PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 10.118.0.1,comp-lzo no,route 10.118.0.1,topology net30,ping 10,ping-restart 60,ifconfig 10.118.0.34 10.118.0.33,peer-id 10,cipher AES-256-GCM'

 

[skeal]

Oct 30 15:05:23 ovpn-client5[17892]: WARNING: 'mtu-dynamic' is present in remote config but missing in local config, remote='mtu-dynamic'

I noticed this but have no idea if it is a problem. You have 5 clients configured or just using client 5? Policy rules in one client can interfere with policy rules in another client.

 

[MidKnight]

I noticed this but have no idea if it is a problem. You have 5 clients configured or just using client 5? Policy rules in one client can interfere with policy rules in another client.

I tied adding mtu-dynamic to the custom section, but then it won't start.

I do have 5 vpn clients added to the router, only 1 being active.

 

[skeal]

I don't think you can specify "tun-mtu-extra 32" along with "mtu-dynamic" that may be why it wouldn't start. What I would do is set the client back to defaults. Re-import your config file from Express and connect with no other settings. Try to keep your config simple and add stuff slowly as REQUIRED. I say that because there are a lot of settings a person really has no need for in most cases.