OpenVPN on DD WRT

ilPadrino

Hi there,

so my english is very bad, but I try to explain my problem.

I have a DD WRT router and there goes an OpenVPN server.

My internal IP address from the router is the 192.168.1.1.

Here my Server Config:

port 1194
proto udp
dev tun0
keepalive 10 120
verb 3
persist-key
persist-tun
comp-lzo
server 192.168.11.0 255.255.255.0 
push "redirect-gateway def1"
push "dhcp-options DNS 192.168.1.1"
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem

When I try to connect to my Andriod tablet, I get the following log and error message:

20140318 14:31:24 80.255.0.4:36864 TLS: Initial packet from [AF_INET]80.255.0.4:36864 sid=83576bca ef0e7061
20140318 14:31:32 80.255.0.4:49701 TLS: Initial packet from [AF_INET]80.255.0.4:49701 sid=d3194617 63eb425e
20140318 14:31:38 80.255.0.4:44106 TLS: Initial packet from [AF_INET]80.255.0.4:44106 sid=841ebf0c cf4b25ac
20140318 14:31:44 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14
20140318 14:31:44 D MANAGEMENT: CMD 'state'
20140318 14:31:44 MANAGEMENT: Client disconnected
20140318 14:31:44 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14
20140318 14:31:44 D MANAGEMENT: CMD 'state'
20140318 14:31:44 MANAGEMENT: Client disconnected

And this when i start my server without connecting clients:

Serverlog 20140318 14:36:04 I OpenVPN 2.3.0 mips-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Mar 25 2013
20140318 14:36:04 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:14
20140318 14:36:04 W NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
20140318 14:36:05 Diffie-Hellman initialized with 2048 bit key
20140318 14:36:05 Socket Buffers: R=[163840->131072] S=[163840->131072]
20140318 14:36:05 I TUN/TAP device tun0 opened
20140318 14:36:05 TUN/TAP TX queue length set to 100
20140318 14:36:05 I do_ifconfig tt->ipv6=1 tt->did_ifconfig_ipv6_setup=0
20140318 14:36:05 I /sbin/ifconfig tun0 192.168.11.1 netmask 255.255.255.0 mtu 1500 broadcast 192.168.11.255
20140318 14:36:05 I UDPv4 link local (bound): [undef]
20140318 14:36:05 I UDPv4 link remote: [undef]
20140318 14:36:05 MULTI: multi_init called r=256 v=256
20140318 14:36:05 IFCONFIG POOL: base=192.168.11.2 size=252 ipv6=0
20140318 14:36:05 IFCONFIG POOL LIST
20140318 14:36:05 I Initialization Sequence Completed
20140318 14:36:10 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14
20140318 14:36:10 D MANAGEMENT: CMD 'state'
20140318 14:36:10 MANAGEMENT: Client disconnected
20140318 14:36:10 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14
20140318 14:36:10 D MANAGEMENT: CMD 'state'
20140318 14:36:10 MANAGEMENT: Client disconnected
20140318 14:36:10 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14
20140318 14:36:10 D MANAGEMENT: CMD 'state'
20140318 14:36:10 MANAGEMENT: Client disconnected
20140318 14:36:10 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14
20140318 14:36:10 D MANAGEMENT: CMD 'status 2'
20140318 14:36:10 MANAGEMENT: Client disconnected
20140318 14:36:10 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14
20140318 14:36:10 D MANAGEMENT: CMD 'log 500'
19700101 00:00:00

Maybe I can have someone help? It's my first VPN server and I'm soon to despair.

maikcat

please post also your client config,

can you also try to connect from a standard pc?

Michael.

ilPadrino

here the client config

client
dev tun
proto udp
remote domain.no-ip.biz 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca c:\\client1\\ca.crt
key c:\\client1\\client1.key
cert c:\\client1\\client1.crt
comp-lzo
verb 3

can i connect with a PC in the same network?

this the log from the client when i try to connect, but is the same network

Tue Mar 18 15:31:41 2014 OpenVPN 2.3.2 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [P
KCS11] [eurephia] [IPv6] built on Aug 22 2013
Tue Mar 18 15:31:41 2014 WARNING: No server certificate verification method has
been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Tue Mar 18 15:31:41 2014 Socket Buffers: R=[65536->65536] S=[65536->65536]
Tue Mar 18 15:31:41 2014 UDPv4 link local: [undef]
Tue Mar 18 15:31:41 2014 UDPv4 link remote: [AF_INET]46.111.477.237:1194
Tue Mar 18 15:31:41 2014 TCP/UDP: Incoming packet rejected from [AF_INET]192.168
.1.1:1194[2], expected peer address: [AF_INET]46.111.477.237:1194 (allow this in
coming source address/port by removing --remote or adding --float)
Tue Mar 18 15:31:42 2014 TCP/UDP: Incoming packet rejected from [AF_INET]192.168
.1.1:1194[2], expected peer address: [AF_INET]46.111.477.237:1194 (allow this in

ilPadrino

and this is the log when i connect with a pc from a outside network:

20140318 16:09:01 192.168.1.145:60146 TLS: Initial packet from [AF_INET]192.168.1.145:60146 sid=bbb87c9a 155092d1
20140318 16:10:01 N 192.168.1.145:60146 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
20140318 16:10:01 N 192.168.1.145:60146 TLS Error: TLS handshake failed
20140318 16:10:01 192.168.1.145:60146 SIGUSR1[soft tls-error] received client-instance restarting
20140318 16:11:14 80.135.0.4:57182 TLS: Initial packet from [AF_INET]80.135.0.4:57182 sid=5a1bc881 92facdd7
20140318 16:11:18 80.135.0.4:33284 TLS: Initial packet from [AF_INET]80.135.0.4:33284 sid=3b693a09 59fb2f0f
20140318 16:11:22 80.135.0.4:56755 TLS: Initial packet from [AF_INET]80.135.0.4:56755 sid=52804a72 8e3e2fff
20140318 16:11:27 80.135.0.4:53857 NOTE: --mute triggered...
20140318 16:12:14 80.135.0.4:57182 9 variation(s) on previous 3 message(s) suppressed by --mute
20140318 16:12:14 N 80.135.0.4:57182 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)

ilPadrino

nobody can help me?

ilPadrino

After I've made new certificates under Linux, I now get a connection and my client gets an IP address from the OpenVPN server. Unfortunately, a new problem.

20140320 02:32:05 client1/192.168.1.134:1194 TLS: new session incoming connection from [AF_INET]192.168.1.134:1194
20140320 02:32:05 client1/192.168.1.134:1194 VERIFY OK: depth=1 C=DE ST=CA L=SanFrancisco O=Fort-Funston OU=changeme CN=changeme name=changeme emailAddress=mail@host.domain
20140320 02:32:05 client1/192.168.1.134:1194 VERIFY OK: depth=0 C=DE ST=CA L=SanFrancisco O=Fort-Funston OU=changeme CN=client1 name=changeme emailAddress=mail@host.domain
20140320 02:32:05 W client1/192.168.1.134:1194 WARNING: 'link-mtu' is used inconsistently local='link-mtu 1554' remote='link-mtu 1542'
20140320 02:32:05 W client1/192.168.1.134:1194 WARNING: 'auth' is used inconsistently local='auth SHA256' remote='auth SHA1'
20140320 02:32:05 client1/192.168.1.134:1194 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
20140320 02:32:05 client1/192.168.1.134:1194 Data Channel Encrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
20140320 02:32:05 client1/192.168.1.134:1194 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
20140320 02:32:05 client1/192.168.1.134:1194 NOTE: --mute triggered...
20140320 02:32:08 client1/192.168.1.134:1194 4 variation(s) on previous 3 message(s) suppressed by --mute
20140320 02:32:08 client1/192.168.1.134:1194 PUSH: Received control message: 'PUSH_REQUEST'
20140320 02:32:08 I client1/192.168.1.134:1194 send_push_reply(): safe_cap=940
20140320 02:32:08 client1/192.168.1.134:1194 SENT CONTROL [client1]: 'PUSH_REPLY dhcp-option DNS 8.8.8.8 redirect-gateway def1 route-gateway 192.168.66.1 topology subnet ping 10 ping-restart 120 ifconfig 192.168.66.2 255.255.255.0' (status=1)
20140320 02:32:10 N client1/192.168.1.134:1194 Authenticate/Decrypt packet error: packet HMAC authentication failed
20140320 02:32:20 N client1/192.168.1.134:1194 Authenticate/Decrypt packet error: packet HMAC authentication failed

maikcat

nobody can help me?

Relax m8 , keep in mind that i personally have a full time job as a linux sysadmin and a family... 😉

can i connect with a PC in the same network?

hmmm...
so you are trying to connect while in the same LAN with openvpn server using
your routers WAN ip,this means that your router must redirects its traffic from lan back to the lan...

this is NOT always working you know..

try to connect from a seperate internet line.

Michael.

ilPadrino

well, when i connect from outside Internetline, i get this logfile on my Server

20140321 23:45:50 80.135.0.6:46249 TLS: Initial packet from [AF_INET]80.135.0.6:46249 sid=c86bd69b d2636dc3
20140321 23:46:38 80.135.0.6:46249 TLS: new session incoming connection from [AF_INET]80.135.0.6:46249
20140321 23:46:51 N 80.135.0.6:46249 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
20140321 23:46:51 N 80.135.0.6:46249 TLS Error: TLS handshake failed
20140321 23:46:51 80.135.0.6:46249 SIGUSR1[soft tls-error] received client-instance restarting
20140321 23:46:52 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14

maikcat

usually TLS errors caused by filtered packets...

can you disable the firewall for testing?

Michael.