Please help a beginner... Server on OpenWRT

Wriggerz

Hi to the Community,

Glad to be here and hope to be learning from you all…… maybe one day even contribute to helping others.

I’ve been using a PPTP VPN to connect to my home network whilst travelling, but recently started using a paid-for VPN service with openVPN options, as well as others, which made me compare the differences between each protocol.

Needless to say I’d like to move to an openVPN configuration. That said, I’m a novice, but I’m keen to learn and I’m sure that, with some guidance , I can get the hang of it

I’ve been wrestling with setting up a working server on openWRT for nearly a week. There are so many different How-To’s and guides and I’ve I tried them all as well as multiple combinations. I’ve hit a wall.

I have a WNDR3800 (dunno if that matters) and I’m connecting from and android tablet with the OpenVPN Settings app, something I started using after following a guide somewhere else. It’s been fine for the paid-for VPN service.

The problem seems to be at authentication, I see the initial TLS packet on the system log screen on the router but it’s continuous until I disconnect. For some reason the server log appears to be empty. The client repeatedly cycles through attempting to authenticate, showing a TLS error and reconnecting.

It would appear to be a routing issue. From what I can see the traffic doesn’t seem to be reaching the server for authentication, and this would explain the lack of info in the server log.

Below are the Server and Client, configs and logs. Let me know if you would like me to post the any details such as firewall configs.

Server config:

config 'openvpn' 'lan'
        option 'enable' '1'
        option 'port' '1194'
        option 'proto' 'udp'
        option 'dev' 'tun'
        option 'ca' '/etc/openvpn/ca.crt'
        option 'cert' '/etc/openvpn/server.crt'
        option 'key' '/etc/openvpn/server.key'
        option 'dh' '/etc/openvpn/dh1024.pem'
        option 'ifconfig_pool_persist' '/tmp/ipp.txt'
        option 'keepalive' '10 120'
        option 'comp_lzo' 'no'
        option 'persist_key' '1'
        option 'persist_tun' '1'
        option 'status' '/tmp/openvpn-status.log'
        option 'verb' '3'
        option 'server' '10.22.22.0 255.255.255.0'
        list 'push' 'redirect-gateway def1'
        list 'push' 'dhcp-option DNS 192.168.10.1'
        list 'push' 'dhcp-option DOMAIN lan'

Server log:

OpenVPN CLIENT LIST
Updated,Mon Dec 16 20:25:16 2013
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
GLOBAL STATS
Max bcast/mcast queue length,0
END

Client .ovpn confiig:

#Configuration
client
tls-client
remote my.dns.com 1194
#ping 5
#ping-exit 30
dev tun
proto udp
#ns-cert-type server
#remote-cert-tls server
resolv-retry infinite
nobind
persist-tun
persist-key
ca ca1.crt    - renamed the ca.crt file because I had another in the folder
cert TF201.crt
key TF201.key
#pkcs12 TF201.p12 
#comp-lzo
verb 3

Some of the lines were copied over from .ovpn files used when connecting to a paid for service but later commented out, they didn’t help, and I knew it would be a long shot. Obviously these configs depend heavily on the server side config.

Client log:

Mon Dec 16 01:22:48 2013 OpenVPN 2.1.1 i686-pc-linux-gnu [SSL] [LZO2] [EPOLL] built on Feb  2 2010
Mon Dec 16 01:22:48 2013 MANAGEMENT: TCP Socket listening on 127.0.0.1:52066
Mon Dec 16 01:22:48 2013 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Mon Dec 16 01:22:48 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon Dec 16 01:22:48 2013 WARNING: file 'TF201.key' is group or others accessible
Mon Dec 16 01:22:48 2013 Control Channel MTU parms [ L:1541 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Dec 16 01:22:49 2013 Data Channel MTU parms [ L:1541 D:1450 EF:41 EB:4 ET:0 EL:0 ]
Mon Dec 16 01:22:49 2013 Local Options hash (VER=V4): '3514370b'
Mon Dec 16 01:22:49 2013 Expected Remote Options hash (VER=V4): '239669a8'
Mon Dec 16 01:22:49 2013 Socket Buffers: R=[110592->131072] S=[110592->131072]
Mon Dec 16 01:22:49 2013 UDPv4 link local: [undef]
Mon Dec 16 01:22:49 2013 UDPv4 link remote: 99.999.99.999:1194
Mon Dec 16 01:22:49 2013 MANAGEMENT: Client connected from 127.0.0.1:52066
Mon Dec 16 01:22:49 2013 MANAGEMENT: CMD 'state'
Mon Dec 16 01:22:49 2013 MANAGEMENT: CMD 'state on'
Mon Dec 16 01:22:49 2013 MANAGEMENT: CMD 'bytecount 0'
Mon Dec 16 01:22:49 2013 MANAGEMENT: >STATE:1387156969,AUTH,,,
Mon Dec 16 01:22:49 2013 TLS: Initial packet from 86.153.63.154:1194, sid=8c2a3e10 97da3da0
Mon Dec 16 01:22:49 2013 MANAGEMENT: CMD 'bytecount 0'
Mon Dec 16 01:22:51 2013 VERIFY ERROR: depth=0, error=unable to get local issuer certificate: /C=UK/ST=EN/L=XXXXXXXX/O=TheGaff/OU=LaFamilia/CN=TheGaff/name=EasyRSA/emailAddress=xxxxxxxxxxx@xxxxx.xxxx
Mon Dec 16 01:22:51 2013 TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
Mon Dec 16 01:22:51 2013 TLS Error: TLS object -> incoming plaintext read error
Mon Dec 16 01:22:51 2013 TLS Error: TLS handshake failed
Mon Dec 16 01:22:51 2013 TCP/UDP: Closing socket
Mon Dec 16 01:22:51 2013 SIGUSR1[soft,tls-error] received, process restarting
Mon Dec 16 01:22:51 2013 MANAGEMENT: >STATE:1387156971,RECONNECTING,tls-error,,
Mon Dec 16 01:22:51 2013 Restart pause, 2 second(s)
Mon Dec 16 01:22:51 2013 MANAGEMENT: CMD 'bytecount 0'
Mon Dec 16 01:22:53 2013 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Mon Dec 16 01:22:53 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon Dec 16 01:22:53 2013 Re-using SSL/TLS context
Mon Dec 16 01:22:53 2013 Control Channel MTU parms [ L:1541 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Dec 16 01:22:53 2013 MANAGEMENT: >STATE:1387156973,RESOLVE,,,
Mon Dec 16 01:22:53 2013 Data Channel MTU parms [ L:1541 D:1450 EF:41 EB:4 ET:0 EL:0 ]
Mon Dec 16 01:22:53 2013 Local Options hash (VER=V4): '3514370b'
Mon Dec 16 01:22:53 2013 Expected Remote Options hash (VER=V4): '239669a8'
Mon Dec 16 01:22:53 2013 Socket Buffers: R=[110592->131072] S=[110592->131072]
Mon Dec 16 01:22:53 2013 UDPv4 link local: [undef]
Mon Dec 16 01:22:53 2013 UDPv4 link remote: 99.999.99.999:1194
Mon Dec 16 01:22:53 2013 MANAGEMENT: >STATE:1387156973,WAIT,,,
Mon Dec 16 01:22:53 2013 MANAGEMENT: CMD 'bytecount 0'
Mon Dec 16 01:22:53 2013 MANAGEMENT: CMD 'bytecount 0'
Mon Dec 16 01:22:53 2013 MANAGEMENT: >STATE:1387156973,AUTH,,,
Mon Dec 16 01:22:53 2013 TLS: Initial packet from 99.999.99.999:1194, sid=0a9fc1d5 53f97fed
Mon Dec 16 01:22:53 2013 MANAGEMENT: CMD 'bytecount 0'
Mon Dec 16 01:22:54 2013 VERIFY ERROR: depth=0, error=unable to get local issuer certificate: 

And so on…..

I had tried using a .p12 key/cert file and kept getting a TLS error, no matter what I tried, and thought that trying separate key and crt files would produce better results. It didn’t, I’m not sure it made any difference.

Sorry for such a long post but I thought that more information would be better than less.

I hope I haven’t missed anything…….. 😃

Wriggerz

Thanks for the quick response debbie10t.

I have started from scratch on numerous occasions, or so i think.... when you say start from scratch, is that start back at 'clean-all' or remove the openPVN installation and start again? I have been referring to the link you posted but can't see what i'm doing differently.

Can you see where the problem with my certificates lies?

Does renaming the ca.crt on the client, after it's created on the server, have an adverse effect on connecting?

The only reason i renamed the ca.crt is because on my android tablet i have another bunch on crt's, key's and ovpn's from a paid for VPN service in the folder thats used by the app on the tablet, and i thought that renaming the new file ca1.crt and amending the ovpn would be fine.

Wriggerz

Thanks once again for the prompt response.

I'll try again tonight. I suspect the line I have commented out is the issue so that's the first thing I will try.

Will post some feedback after some more testing.

Wriggerz

Just a quick update for anyone looking at this thread.....

I had made a rookie mistake in my configuration of the server, see below.

        option 'cert' '/etc/openvpn/server.crt'
        option 'key' '/etc/openvpn/server.key'

I needed to amend the 'Server.crt/.key' to 'TheGaffServer.crt/.key'...... idiot.

I was that deep in VPN i couldn't tell up from down and a couple of days off seems to have helped me get a fresh perspective. And i can now connect, albeit with routing issues. That is, i can't connect to any other resource on the LAN or WAN side, when connected.

I won't go in to much details yet as i;d like to spend some time trying to figure it out but if anyone is interested and seeing the amended configs let me know.

Thanks

Wriggerz

Sorry debbie10t,

Original server config:

config 'openvpn' 'lan'
        option 'enable' '1'
        option 'port' '1194'
        option 'proto' 'udp'
        option 'dev' 'tun'
        option 'ca' '/etc/openvpn/ca.crt'
        option 'cert' '/etc/openvpn/server.crt'
        option 'key' '/etc/openvpn/server.key'
        option 'dh' '/etc/openvpn/dh1024.pem'
        option 'ifconfig_pool_persist' '/tmp/ipp.txt'
        option 'keepalive' '10 120'
        option 'comp_lzo' 'no'
        option 'persist_key' '1'
        option 'persist_tun' '1'
        option 'status' '/tmp/openvpn-status.log'
        option 'verb' '3'
        option 'server' '10.22.22.0 255.255.255.0'
        list 'push' 'redirect-gateway def1'
        list 'push' 'dhcp-option DNS 192.168.10.1'
        list 'push' 'dhcp-option DOMAIN lan'

New server config:

config 'openvpn' 'lan'
        option 'enable' '1'
        option 'port' '1194'
        option 'proto' 'udp'
        option 'dev' 'tun0'
        option 'ca' '/etc/openvpn/ca.crt'
        option 'cert' '/etc/openvpn/TheGaffServer.crt'
        option 'key' '/etc/openvpn/TheGaffServer.key'
        option 'dh' '/etc/openvpn/dh1024.pem'
        option 'ifconfig_pool_persist' '/tmp/ipp.txt'
        option 'keepalive' '10 120'
        option 'comp_lzo' 'no'
        option 'persist_key' '1'
        option 'persist_tun' '1'
        option 'status' '/tmp/openvpn-status.log'
        option 'verb' '3'
        option 'server' '10.22.22.0 255.255.255.0'
        list 'push' 'route 192.168.10.0 255.255.255.0'
        list 'push' 'redirect-gateway'

As you can see i amended the file names for the server .crt and .key. The last time i was creating keys/certs i used the unique name TheGaffServer but hadn't updated the server config. Rookie.....

There have been other changes made but these relate to the fact that i have been trying the TUN option rather than TAP as i'm only trying to connect a client on the road to my home network, not bridge two networks.

I was going to raise the issues i'm having with routes on the openwrt forum as i thought that would be the best place for it, but do you think you'd be able to offer some insight?

Thanks

Wriggerz

Sorry, those changes don't relate to a change to TUN.......

I had already been using TUN, but have been trying to change the routing options, with little success.

I have just noticed, i've added a '0' the the 'tun' option on the server config, it doesn't seem to matter. I think i saw that on another forum. Should i remove the '0'?

Thanks

Wriggerz

Thanks, I'll check them out now and let you know how i get on.