Ipvanish Openvpn will not connect on Merlin

[ALIEN1X]

Hello,
I have an Asus rt ax86u PRO with Merlin version 3004. 38.8.7 set up as a Vpn router with ipvanish configs behind a Primary router.
I have set up the Asus Router with static ip with difrent subnet.
I have setup opnvpn using the ipvanisg guide as below, but get connection error /configs error.
Ihave tried the latest Merlin release but still the samre problem, so reverted back to a pervious version that has been know to work but no joy.

system log files is below , Im guess its a Tls failure so checked my NTP settings which appear ok.

note that upto date open vpn config file and CA cert has been uploaded in router
Note vpn server location is London for speed, real location is London
Time Zone setting is GMT Dublin Edinburgh,Londion

Error logs:

emailAddress=[email protected], serial=14270443926945591939
May 5 06:09:03 ovpn-client1[3534]: OpenSSL: error:1416F086:lib(20):func(367):reason(134):
May 5 06:09:03 ovpn-client1[3534]: TLS_ERROR: BIO read tls_read_plaintext error
May 5 06:09:03 ovpn-client1[3534]: TLS Error: TLS object -> incoming plaintext read error
May 5 06:09:03 ovpn-client1[3534]: TLS Error: TLS handshake failed
May 5 06:09:03 ovpn-client1[3534]: SIGUSR1[soft,tls-error] received, process restarting
May 5 06:09:03 ovpn-client1[3534]: Restart pause, 128 second(s)
May 5 06:11:11 ovpn-client1[3534]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
May 5 06:11:11 ovpn-client1[3534]: TCP/UDP: Preserving recently used remote address: [AF_INET]185.91.122.12:1194
May 5 06:11:11 ovpn-client1[3534]: TCP/UDP: Preserving recently used remote address: [AF_INET]185.91.122.12:1194
May 5 06:11:11 ovpn-client1[3534]: Socket Buffers: R=[524288->524288] S=[524288->524288]
May 5 06:11:11 ovpn-client1[3534]: UDPv4 link local: (not bound)
May 5 06:11:11 ovpn-client1[3534]: UDPv4 link remote: [AF_INET]185.91.122.12:1194
May 5 06:11:11 ovpn-client1[3534]: TLS: Initial packet from [AF_INET]185.91.122.12:1194, sid=3bb4d01c 4cb42040
May 5 06:11:11 ovpn-client1[3534]: VERIFY ERROR: depth=1, error=certificate is not yet valid: C=US, ST=FL, L=Winter Park, O=IPVanish, OU=IPVanish VPN, CN=IPVanish CA, emailAddress=[email protected], serial=14270443926945591939
May 5 06:11:11 ovpn-client1[3534]: OpenSSL: error:1416F086:lib(20):func(367):reason(134):
May 5 06:11:11 ovpn-client1[3534]: TLS_ERROR: BIO read tls_read_plaintext error
May 5 06:11:11 ovpn-client1[3534]: TLS Error: TLS object -> incoming plaintext read error
May 5 06:11:11 ovpn-client1[3534]: TLS Error: TLS handshake failed
May 5 06:11:11 ovpn-client1[3534]: SIGUSR1[soft,tls-error] received, process restarting
May 5 06:11:11 ovpn-client1[3534]: Restart pause, 256 second(s)

 

[ColinTaylor]

system log files is below , Im guess its a Tls failure so checked my NTP settings which appear ok.

Yes, in the first instance the router needs to have its date and time set correctly (which it clearly isn't).

Check your WAN DNS server settings are valid.

 

[ALIEN1X]

Yes, in the first instance the router needs to have its date and time set correctly (which it clearly isn't).

Check your WAN DNS server settings are valid.

Hi,
The Ntp is set to London, Dublin ,Edinburgh,Lisbon so assume thats correct if I'M based in London and the vpn server is in London. Could it vbe the DST seetings as imm nogt shure how that should be set for London?

The WAN Setings is automatic IP
The LAN seting is static with difrent subnet as its behunbd a primary router
DNS seeting I have specified IPVANISH DNS servers instead of cloudflare,google etc, I have set the DNS to exclusive and route all traffic via VPN.
I did follow the same setup proceedure as below in addition to above.

https://support.ipvanish.com/hc/en-us/articles/360000049273-How-to-Configure-IPVanish-OpenVPN-in-ASUSWRT-Merlin

 

[ColinTaylor]

What do you have set for WAN - Internet Connection > WAN DNS Setting > DNS Server ?

This should either be set to "ISP" (usually the best choice) or a publicly available server (e.g. Google). It should not be set to IPVanish's DNS servers.

 

[ALIEN1X]

WAN - Internet Connection > set to automatic ip
WAN DNS Setting > DNS Server is curreently set to 198,18.0.1 and 198.18.0.2 from ipvanish as I thought if you set to ISP serevers you get dns leaks and it would not go through VPN DNS servers as ipvanish recomends?

 

[ColinTaylor]

WAN DNS Setting > DNS Server is curreently set to 198,18.0.1 and 198.18.0.2 from ipvanish as I thought if you set to ISP serevers you get dns leaks and it would not go through VPN DNS servers as ipvanish recomends?

This is wrong. There is also no mention of doing this in IPVanish's own ASUSWRT-Merlin instructions. Set it to "ISP".

The VPN's DNS behaviour is set on the VPN Client page.

 

[ALIEN1X]

This is wrong. There is also no mention of doing this in IPVanish's own instructions. Set it to "ISP".

The VPN's DNS behaviour is set on the VPN Client page.

I will try the public non loging servers like google, cloudflare and see what happens, if not will try isp, but need to figure out how to prevent dns leaks if that occurs

 

[Tech9]

behind a Primary router

The "ISP" for this VPN router is the Primary router. When the VPN router is set to Auto/ISP it will take DNS from Primary router's DHCP. Most likely the Primary router LAN IP forwarding to whatever is set as upstream DNS there. If you have Google DNS on your Primary router your VPN router will also use Google DNS.

 

[ColinTaylor]

I will try the public non loging servers like google, cloudflare and see what happens, if not will try isp, but need to figure out how to prevent dns leaks if that occurs

All you need to do is set "Accept DNS Configuration" to "Exclusive" in the VPN Client settings.

 

[ALIEN1X]

Thanks all got it all working and connected. Will try to set dns from strict to exclusive not made much diffrenyt for any dns leaks. Unde DNS leak test is shows up as 2 servers being cloudflare, none are ipvanish DNS servers? is that still safe?