Connect Synology ds713+ to OpenVPN Server

Kris

:?:

Hi Community

I have an OpenVPN related issue and I hope you can help me with this! I am looking for a solution since the weekend now.
When trying to connect my Synology ds713+ NAS (AS A CLIENT) to my pfSense OpenVPN appliance, the Synology says: "Cannot connect. Please check your network settings. The pfSense Logfile says:

openvpn[12924]: TLS Error: cannot locate HMAC in incoming packet from [AF_INET]<myExtIP>:1194

From the ssh console on the NAS I can successfully ping server on the internet, the firewall is turned off. I guess it is not a network problem then.
On the other hand, I can connect to the VPN from _ALL_ other devices and laptops. So the pfSense is working correctly.

If you guys have any idea how to solve this, please let me know.
Also I can create an OpenVPN Account, if anyone of you has the time and wants to look into this a bit deeper. Synology Support was no help until now...

Thanks a lot in advance!
Kris

maikcat

configs used?

Michael.

Kris

These are the configs, the Synology creates when I run the OpenVPN Connection Wizard:

client_o1358939356:

dev tun
tls-client
remote pfsense.IP> 1194
pull
proto udp
ca ca_o1358939356.crt
comp-lzo
script-security 2
float
reneg-sec 0
explicit-exit-notify
plugin /lib/openvpn/openvpn-down-root.so /etc/ppp/ip-down
auth-user-pass /tmp/ovpn_client_up

ovpn_o1358939356.conf:

[client]
dev=tun
tls-client=_ON_
remote=<pfsense.IP> 1194
pull=_ON_
proto=udp
ca=ca_o1358939356.crt
comp-lzo=_ON_
redirect-gateway=_OFF_
script-security=2
float=_ON_
reneg-sec=0
explicit-exit-notify=_ON_
plugin=/lib/openvpn/openvpn-down-root.so /etc/ppp/ip-down
auth-user-pass=/tmp/ovpn_client_up
[syno]
user=NAS
pass=t1yqVtakASw=
nat=no
conf_name=OpenVPN
reconnect=yes

Thank you for your help!
Kris

maikcat

server config?

Michael.

Kris

Sure. Thanks for being patient!

These are the config files on the pfSense Appliance:

server1.conf

dev ovpns1
dev-type tun
dev-node /dev/tun1
writepid /var/run/openvpn_server1.pid
#user nobody
#group nobody
script-security 3
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
proto udp
cipher AES-128-CBC
up /usr/local/sbin/ovpn-linkup
down /usr/local/sbin/ovpn-linkdown
local <pfsense.IP>
tls-server
server 172.16.17.0 255.255.255.0
client-config-dir /var/etc/openvpn-csc
username-as-common-name
auth-user-pass-verify /var/etc/openvpn/server1.php via-env
tls-verify /var/etc/openvpn/server1.tls-verify.php
lport 1194
management /var/etc/openvpn/server1.sock unix
push "route 172.16.16.0 255.255.255.0"
push "dhcp-option DNS 172.16.16.1"
ca /var/etc/openvpn/server1.ca
cert /var/etc/openvpn/server1.cert
key /var/etc/openvpn/server1.key
dh /etc/dh-parameters.1024
tls-auth /var/etc/openvpn/server1.tls-auth 0
comp-lzo
persist-remote-ip
float

Please let me know, if there is anything else you would need to know!

maikcat

hi there,

your server config contains:

cipher AES-128-CBC

your clients uses the default(?) (blowfish?)

please add it to your client config

Michael.

Kris

Thanks for the hint!

I added

cipher AES-128-CBC

to the client_o1358939356 -file. No success.
Then I added

cipher=AES-128-CBC

to the ovpn_o1358939356.conf. The same thing.

I also added

log log.log

into client_o1358939356. This is the output, when trying to connect to the VPN:

Wed Jan 23 19:36:39 2013 OpenVPN 2.1.4 i686-linux-gnu [SSL] [LZO2] [EPOLL] built
Wed Jan 23 19:36:39 2013 WARNING: file '/tmp/ovpn_client_up' is group or others
Wed Jan 23 19:36:39 2013 IMPORTANT: OpenVPN's default port number is now 1194, b
Wed Jan 23 19:36:39 2013 WARNING: No server certificate verification method has
Wed Jan 23 19:36:39 2013 NOTE: the current --script-security setting may allow t
Wed Jan 23 19:36:39 2013 LZO compression initialized
Wed Jan 23 19:36:39 2013 UDPv4 link local (bound): [undef]:1194
Wed Jan 23 19:36:39 2013 UDPv4 link remote: <pfSense.IP>:1194

Kris

🙂

OK, I don´t want to say bad things about great hardware, but the Synology OpenVPN Client just sucks...
But: I solved the problem and I will write a detailed blog () post about this. Here is the short version anyway:

After installing ipkg and openssl on the Synology (which I already had when I posted my question here) I had to edit the openvpn config like that:

client_o1358939356

dev tun
tls-client
client
remote <pfSense.IP> 1194
pull
proto udp
cipher AES-128-CBC
tls-remote ServerCert
pkcs12 pfSense-udp-1194-NAS.p12
tls-auth pfSense-udp-1194-NAS-tls.key 1
comp-lzo
redirect-gateway
script-security 2
float
reneg-sec 0
explicit-exit-notify
plugin /lib/openvpn/openvpn-down-root.so /etc/ppp/ip-down
auth-user-pass /tmp/ovpn_client_up
resolv-retry infinite

ovpn_o1358939356.conf

[client]
dev=tun
tls-client=_ON_
client=_ON_
remote=<pfSense.IP> 1194
pull=_ON_
proto=udp
cipher=AES-128-CBC
tls-remote=ServerCert
pkcs12=pfSense-udp-1194-NAS.p12
tls-auth=pfSense-udp-1194-NAS-tls.key 1
comp-lzo=_ON_
redirect-gateway=_ON_
script-security=2
float=_ON_
reneg-sec=0
explicit-exit-notify=_ON_
plugin=/lib/openvpn/openvpn-down-root.so /etc/ppp/ip-down
auth-user-pass=/tmp/ovpn_client_up
resolv-retry=infinite
[syno]
user=NAS
pass=KdfQ5S8QgdQp5g==
nat=yes
conf_name=OpenVPN
reconnect=yes

Of course I had to copy the .key and the .p12 file to the synology into the /usr/syno/etc/synovpnclient/openvpn folder.

Dude, maikcat, thank you so much for your help!!!
All the best,
Kris

P.s.: Please delete the link, if it´s not allowed to post external links.

pethson

Kris wrote🙂

OK, I don´t want to say bad things about great hardware, but the Synology OpenVPN Client just sucks...
But: I solved the problem and I will write a detailed blog () post about this. Here is the short version anyway:

P.s.: Please delete the link, if it´s not allowed to post external links.

Hi Kris.

Did you write any detailed information in your blog? I did visit the link, but that seams to be a clean WordPress installtion?

///Peter!