Unable to connect to internet with OpenVPN

[aaronac8]

I just upgraded my Merlin firmware to 384.11_2 and am unable to connect to the internet when I enable my OpenVPN (both with NordVPN and SaferVPN). I have followed the setup per my VPN providers. When I use policy rules, the clients associated with my VPN do not have internet access when the other clients do. Anyone else have this problem after upgrading?

 

[RMerlin]

Post your OpenVPN client configuration. My first guess is your issue lies with DNS mode, which for some providers need to be set to Exclusive.

 

[CaptainSTX]

Please see below

Image is to small for me to read screenshot. Try again and split the image if necessary.

 

[RMerlin]

Any error message in the system log when you connect it?

I personally use NordVPN here for testing, and it's working fine for me.

 

[Martineau]

View attachment 18325 View attachment 18326

Surely this setting must be NO ?

 

[aaronac8]

Surely this setting must be NO ?

View attachment 18327

I don’t understand....if it is NO then how will I connect?

 

[aaronac8]

When I upload the ovpn file, it has text in the custom configuration section. Yet my VPN tells me to enter different text there. Do I delete what was entered by the ovpn file and paste what my VPN provider tells me to enter or do I add to what is already there?

 

[Martineau]

I don’t understand....if it is NO then how will I connect?

OpenVPN connections are secure because they use PKI certificates to ensure a secure authenticated logon.

i.e. without the secure keys a potential hacker would have to guess them which is probably isn't possible/worth the effort.

If 'Username/Password Auth. Only=YES', then the PKI certificates are ignored as it is deemed the OpenVPN server doesn't support them, so now the potential hacker would only need to guess the Username and Password....much easier, which is why by default this value should always be set to 'NO' when connecting to a commercial VPN provider.

 

[aaronac8]

I was told by saferVPN support to use L2TP instead of OpenVPN...thoughts?

 

[Martineau]

I was told by saferVPN support to use L2TP instead of OpenVPN...thoughts?

Unlike OpenVPN, L2TP does not provide confidentiality or strong authentication by itself.
IPsec is often used to secure L2TP packets by providing confidentiality, authentication, and integrity.
The combination of these two protocols is generally known as L2TP/IPsec.

Whilst AsusWRT-Merlin does support an L2TP/IPsec server on HND models, does the firmware support an L2TP/IPSec client? - NO

 

[aaronac8]

Please see admin file log.... Still unable to connect to internet with no problem connecting to vpn

 

[Martineau]

Please see admin file log.... Still unable to connect to internet with no problem connecting to vpn

Well the VPN Client 1 connection appears to be successful.....

Jun 21 07:00:14 ovpn-client1[2450]: Initialization Sequence Completed

then weirdly, 8 seconds later the connection is terminated:

Jun 21 07:00:22 ovpn-client1[2450]: [SaferVPN] Inactivity timeout (--ping-restart), restarting
Jun 21 07:00:22 ovpn-client1[2450]: SIGUSR1[soft,ping-restart] received, process restarting
Jun 21 07:00:22 ovpn-client1[2450]: Restart pause, 5 second(s)

and after the default 5 second delay, the connection is reattempted:

Jun 21 07:00:27 ovpn-client1[2450]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Jun 21 07:00:27 ovpn-client1[2450]: TCP/UDP: Preserving recently used remote address: [AF_INET]66.23.202.66:1194
Jun 21 07:00:27 ovpn-client1[2450]: Socket Buffers: R=[122880->245760] S=[122880->245760]
Jun 21 07:00:27 ovpn-client1[2450]: UDP link local: (not bound)
Jun 21 07:00:27 ovpn-client1[2450]: UDP link remote: [AF_INET]66.23.202.66:1194
Jun 21 07:00:27 ovpn-client1[2450]: TLS: Initial packet from [AF_INET]66.23.202.66:1194, sid

I suggest you try and eliminate some of the SaferVPN pushed directives to see if the connection stays up more than 8 seconds

i.e. add the following to the VPN Client 1 cCustom configuration

auth-nocache
reneg-sec 86400
pull-filter ignore "sndbuf"
pull-filter ignore "rcvbuf"
pull-filter ignore "ping"

 

[aaronac8]

Well the VPN Client 1 connection appears to be successful.....

Jun 21 07:00:14 ovpn-client1[2450]: Initialization Sequence Completed

then weirdly, 8 seconds later the connection is terminated:

Jun 21 07:00:22 ovpn-client1[2450]: [SaferVPN] Inactivity timeout (--ping-restart), restarting
Jun 21 07:00:22 ovpn-client1[2450]: SIGUSR1[soft,ping-restart] received, process restarting
Jun 21 07:00:22 ovpn-client1[2450]: Restart pause, 5 second(s)

and after the default 5 second delay, the connection is reattempted:

Jun 21 07:00:27 ovpn-client1[2450]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Jun 21 07:00:27 ovpn-client1[2450]: TCP/UDP: Preserving recently used remote address: [AF_INET]66.23.202.66:1194
Jun 21 07:00:27 ovpn-client1[2450]: Socket Buffers: R=[122880->245760] S=[122880->245760]
Jun 21 07:00:27 ovpn-client1[2450]: UDP link local: (not bound)
Jun 21 07:00:27 ovpn-client1[2450]: UDP link remote: [AF_INET]66.23.202.66:1194
Jun 21 07:00:27 ovpn-client1[2450]: TLS: Initial packet from [AF_INET]66.23.202.66:1194, sid

I suggest you try and eliminate some of the SaferVPN pushed directives to see if the connection stays up more than 8 seconds

i.e. add the following to the VPN Client 1 cCustom configuration

auth-nocache
reneg-sec 86400
pull-filter ignore "sndbuf"
pull-filter ignore "rcvbuf"
pull-filter ignore "ping"

Thank you for your reply!!!.....I am a nubbie at this, do I add what you wrote above AFTER what is already in the custom configuration?

 

[Martineau]

Thank you for your reply!!!.....I am a nubbie at this, do I add what you wrote above AFTER what is already in the custom configuration?

I have no idea what the current custom directives are, so you should post them here, and replace all of them with the five directives.

The intention is to establish a reliable connection, then you may simply reapply the existing directives one-by-one and/or delete the 'pull-filter' filters one-by-one to identify which directive causes the 8 second restart.

 

[aaronac8]

I have no idea what the current custom directives are, so you should post them here, and replace all of them with the five directives.

The intention is to establish a reliable connection, then you may simply reapply the existing directives one-by-one and/or delete the 'pull-filter' filters one-by-one to identify which directive causes the 8 second restart.

This is what I have under custom config:

remote-cert-tls server
remote-random
nobind
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
persist-key
persist-tun
ping-timer-rem
reneg-sec 0
# log /tmp/vpn.log

 

[aaronac8]

Turns out, the error is on SaferVPN side....they are still trying to figure out the problem which appears to be with their servers or protocol. NordVPN is working fine with OpenVPN.