[SOLVED] Openvpn and Encryption cipher = None: Not working

[janosek]

Hello,

I have an RT-AC66U and I am running 378.52_2

I was reading that Private Internet Access allows having no cipher. Since I am using openvpn for netflix and not security, I don't care if I have encryption enabled. However, when I attempt to turn it off, I get the following in my log and the VPN does not work

Apr 16 18:37:57 rc_service: httpd 366:notify_rc stop_vpnclient1
Apr 16 18:38:07 rc_service: httpd 366:notify_rc start_vpnclient1
Apr 16 18:38:07 kernel: tun: Universal TUN/TAP device driver, 1.6
Apr 16 18:38:08 kernel: tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
Apr 16 18:38:08 openvpn[954]: OpenVPN 2.3.6 mipsel-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Apr  5 2015
Apr 16 18:38:08 openvpn[954]: library versions: OpenSSL 1.0.0r 19 Mar 2015, LZO 2.08
Apr 16 18:38:08 openvpn[954]: WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Apr 16 18:38:08 openvpn[954]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Apr 16 18:38:08 openvpn[954]: ******* WARNING *******: null cipher specified, no encryption will be used
Apr 16 18:38:08 openvpn[954]: Socket Buffers: R=[118784->131072] S=[118784->131072]
Apr 16 18:38:08 openvpn[956]: UDPv4 link local: [undef]
Apr 16 18:38:08 openvpn[956]: UDPv4 link remote: [AF_INET]216.155.131.74:1194
Apr 16 18:38:08 openvpn[956]: TLS: Initial packet from [AF_INET]216.155.131.74:1194, sid=19ccf43c 250e70af
Apr 16 18:38:08 openvpn[956]: WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Apr 16 18:38:08 openvpn[956]: VERIFY OK: depth=1, C=US, ST=OH, L=Columbus, O=Private Internet Access, CN=Private Internet Access CA, emailAddress=secure@privateinternetaccess.com
Apr 16 18:38:08 openvpn[956]: VERIFY OK: depth=0, C=US, ST=CA, L=LosAngeles, O=Private Internet Access, OU=Private Internet Access, CN=Private Internet Access, name=Private Internet Access, emailAddress=secure@privateinternetaccess.com
Apr 16 18:38:09 openvpn[956]: WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1526', remote='link-mtu 1542'
Apr 16 18:38:09 openvpn[956]: WARNING: 'cipher' is used inconsistently, local='cipher [null-cipher]', remote='cipher BF-CBC'
Apr 16 18:38:09 openvpn[956]: WARNING: 'keysize' is used inconsistently, local='keysize 0', remote='keysize 128'
Apr 16 18:38:09 openvpn[956]: Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Apr 16 18:38:09 openvpn[956]: Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Apr 16 18:38:09 openvpn[956]: Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Apr 16 18:38:09 openvpn[956]: [Private Internet Access] Peer Connection Initiated with [AF_INET]216.155.131.74:1194
Apr 16 18:38:11 openvpn[956]: SENT CONTROL [Private Internet Access]: 'PUSH_REQUEST' (status=1)
Apr 16 18:38:11 openvpn[956]: PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 209.222.18.222,dhcp-option DNS 209.222.18.218,ping 10,comp-lzo no,route 10.168.1.1,topology net30,ifconfig 10.168.1.6 10.168.1.5'
Apr 16 18:38:11 openvpn[956]: OPTIONS IMPORT: timers and/or timeouts modified
Apr 16 18:38:11 openvpn[956]: OPTIONS IMPORT: LZO parms modified
Apr 16 18:38:11 openvpn[956]: OPTIONS IMPORT: --ifconfig/up options modified
Apr 16 18:38:11 openvpn[956]: OPTIONS IMPORT: route options modified
Apr 16 18:38:11 openvpn[956]: OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Apr 16 18:38:11 openvpn[956]: TUN/TAP device tun11 opened
Apr 16 18:38:11 openvpn[956]: TUN/TAP TX queue length set to 100
Apr 16 18:38:11 openvpn[956]: do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Apr 16 18:38:11 openvpn[956]: /usr/sbin/ip link set dev tun11 up mtu 1500
Apr 16 18:38:11 openvpn[956]: /usr/sbin/ip addr add dev tun11 local 10.168.1.6 peer 10.168.1.5
Apr 16 18:38:11 openvpn[956]: updown.sh tun11 1500 1526 10.168.1.6 10.168.1.5 init
Apr 16 18:38:11 rc_service: service 998:notify_rc updateresolv
Apr 16 18:38:11 dnsmasq[788]: read /etc/hosts - 5 addresses
Apr 16 18:38:11 dnsmasq[788]: read /etc/hosts.dnsmasq - 0 addresses
Apr 16 18:38:11 dnsmasq-dhcp[788]: read /etc/ethers - 1 addresses
Apr 16 18:38:11 dnsmasq[788]: using nameserver 209.222.18.222#53
Apr 16 18:38:11 dnsmasq[788]: using nameserver 209.222.18.218#53
Apr 16 18:38:14 openvpn[956]: /usr/sbin/ip route add 216.155.131.74/32 via 24.52.233.65
Apr 16 18:38:14 openvpn[956]: /usr/sbin/ip route add 0.0.0.0/1 via 10.168.1.5
Apr 16 18:38:14 openvpn[956]: /usr/sbin/ip route add 128.0.0.0/1 via 10.168.1.5
Apr 16 18:38:14 openvpn[956]: /usr/sbin/ip route add 10.168.1.1/32 via 10.168.1.5
Apr 16 18:38:14 openvpn[956]: Initialization Sequence Completed

After this, the VPN does not work. If I go back to default encryption, it works fine.

 

[john9527]

PIA ties the encryption method to specific ports. For no encryption try using port 1195

 

[cosmoxl]

yep, UDP port 1195, none for cipher, and "auth none" without quotation marks in the custom configuration.

 

[coldwizard]

Hello,

I have an RT-AC66U and I am running 378.52_2

I was reading that Private Internet Access allows having no cipher. Since I am using openvpn for netflix and not security, I don't care if I have encryption enabled. However, when I attempt to turn it off, I get the following in my log and the VPN does not work ...

I don't know if this is a problem, but does not the encryption have to match the servers?
Apr 16 18:38:09 openvpn[956]: WARNING: 'cipher' is used inconsistently, local='cipher [null-cipher]', remote='cipher BF-CBC'

Also be aware of this thread about using VPN to a public server.

www.snbforums.com/threads/router-web-accessibility-from-wan-internet-when-an-openvpn-client-is-running.23743/

 

[janosek]

Thank you Cosmoxl and john9527! "auth none" (and earlier port 1195) was what I was missing!

 

[rockstead]

Sorry to bump an old thread but this configuration no longer works for me, did it stop working for you using private internet access.com ?

Looking for anything to get it working again please.