comp-lzo not working?

therealjmc

Hi,

I've tested the new iOS app against my working Openvpn-Server. It seems that comp-lzo is not supported by the Client, since i can establish a Connection but get the following error messages on the server and can't use the connection actualy from the client.

Sun Jan 27 19:45:50 2013 Client2/xx.xx.xx.xx:xxxx Bad LZO decompression header byte: 65
Sun Jan 27 19:45:50 2013 Client2/xx.xx.xx.xx:xxxx Bad LZO decompression header byte: 65
Sun Jan 27 19:45:50 2013 Client2/xx.xx.xx.xx:xxxx Bad LZO decompression header byte: 65
Sun Jan 27 19:45:50 2013 Client2/xx.xx.xx.xx:xxxx Bad LZO decompression header byte: 65
Sun Jan 27 19:45:50 2013 Client2/xx.xx.xx.xx:xxxx Bad LZO decompression header byte: 65
Sun Jan 27 19:45:50 2013 Client2/xx.xx.xx.xx:xxxx Bad LZO decompression header byte: 65
Sun Jan 27 19:45:50 2013 Client2/xx.xx.xx.xx:xxxx Bad LZO decompression header byte: 65
Sun Jan 27 19:45:50 2013 Client2/xx.xx.xx.xx:xxxx Bad LZO decompression header byte: 65
Sun Jan 27 19:45:50 2013 Client2/xx.xx.xx.xx:xxxx Bad LZO decompression header byte: 65

Is there a way to get comp-lzo to work or do i have to disable it?

jamesyonan

comp-lzo does work. Which comp-lzo directives are you using on client and server side?

therealjmc

Server Config (using 2.2.1)

port 1394
proto udp
dev tun0
log /var/log/openvpn.log
#client-to-client
ca /etc/openvpn/ca.crt
client-config-dir /etc/openvpn/ccd
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
tls-auth /etc/openvpn/ta.key 0
cipher AES-256-CBC
dh /etc/openvpn/dh2048.pem
server 10.7.0.0 255.255.255.0
push "route 192.168.0.0 255.255.255.0"
push "route 10.7.0.0 255.255.255.0"
push "route 10.10.11.0 255.255.255.0"
route 192.168.0.0 255.255.255.0
keepalive 10 120
comp-lzo
max-clients 8
persist-key
persist-tun
verb 3
tun-mtu 1500
fragment 1300
mssfix

I've imported the following config to the iOS Client:

client
proto udp
dev tun
remote host 1394
resolv-retry infinite
pull
nobind
persist-key
persist-tun
ca ca.crt
ns-cert-type server
cert client2.crt
key client2.key
tls-auth ta.key 1
cipher AES-256-CBC
comp-lzo
verb 3
tun-mtu 1500
fragment 1300
mssfix

The Connection Log on the app says:
Tunnel Options: V4,dev-type tun, link-mtu 1558, tun-mtu 1500, proto UDPv4, comp-lzo,keydir 1,cipher AES-256-CBC,keysize 256,tls-auth,key-method 2,tls-client

After the Push from the server there is a line in the logfile again regarding LZO:
LZO-ASYM init swap=0 asym=1

therealjmc

I've the same problem described here:

https://forums.openvpn.net/topic11979.html

I'll try my luck there 😉

jamesyonan

comp-lzo may be a red herring here.

Try removing "fragment" from both client and server configs.

therealjmc

Spending some time to reconfigure my clients to work without fragment etc...

Working fine now!

Took the opportunity to renew my certificates, only 2 Years left till they run invalid... Means i've been too lazy to replace them the last 8 years :roll:

jurev

therealjmc wroteWorking fine now!

Therealjmc, could you please post your working client configuration (and server too)? My non working config is driving me crazy! Thanks.

therealjmc

Server:

port 1394
proto udp
dev tun0
log /var/log/openvpn.log
ca /etc/openvpn/ca.crt
client-config-dir /etc/openvpn/ccd
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
tls-auth /etc/openvpn/ta.key 0
crl-verify /etc/openvpn/keys/crl.pem
cipher AES-256-CBC
dh /etc/openvpn/dh2048.pem
server 10.7.0.0 255.255.255.0
push "route 192.168.0.0 255.255.255.0"
route 192.168.0.0 255.255.255.0
keepalive 10 120
comp-lzo adaptive
max-clients 8
persist-key
persist-tun
verb 3

Client (iPhone)

client
proto udp
dev tun
remote host.org 1394
resolv-retry infinite
pull
nobind
persist-key
persist-tun
ns-cert-type server
key-direction 1
cipher AES-256-CBC
comp-lzo
verb 3

<ca>
-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----
</ca>

<cert>
-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----
</cert>

<key>
-----BEGIN PRIVATE KEY-----

-----END PRIVATE KEY-----
</key>

<tls-auth>
-----BEGIN OpenVPN Static key V1-----

-----END OpenVPN Static key V1-----
</tls-auth>