I'm not sure if this is the right place to ask this, but I figured it couldn't hurt to try. I've to an Asus RT-AC66R that offers the ability to configure an OpenVPN server on it. I enabled it with all of the default settings, with the exception of changing UDP over to TCP. [code] Interface Type = TUN Protocol = TCP Server Port = 1194 Firewall = Auto Authorization Mode = TLS Username/Password Auth. Only = No Extra HMAC Auth = Disabled Poll Interval = 0 minutes (disabled) Push LAN to clients = Yes Direct clients to redirect Internet traffic = No Respond to DNS = No Encryption cipher = Default Compression = Adaptive TLS Renegotiation Time = -1 Manage Client-Specific Options = No [/code] When I try to connect, I'm currently trying to connect from a Mac using Tunnelblick, it fails to connect with the following errors: [code] 2015-06-12 09:28:46 TLS_ERROR: BIO read tls_read_plaintext error: error:14082174:SSL routines:SSL3_CHECK_CERT_AND_ALGORITHM:dh key too small 2015-06-12 09:28:46 TLS Error: TLS object -> incoming plaintext read error 2015-06-12 09:28:46 TLS Error: TLS handshake failed 2015-06-12 09:28:46 Fatal TLS error (check_tls_errors_co), restarting 2015-06-12 09:28:46 SIGUSR1[soft,tls-error] received, process restarting [/code] So any thoughts? I've tried searching for the error "dh key too small" and got nothing. Thanks.

It looks like your your [i]Key [/i]has not been created correctly ? Unfortunately, this has no relevant information: [url]http://www.asus.com/support/FAQ/1008713[/url] I suggest you contact Asus ..

I have the AC68U and a Macbook. I can connect form Remote with the following settings via Tunnelblick: [img]http://i.imgur.com/NFkr0io.jpg[/img] BUT when I try to connect from my linux netbook I have the same error as you: dh key too small. Wheres the solution for it? :/

TLS Problem with OpenVPN Server on Asus RT-AC66R Router

jwilliams31

I'm not sure if this is the right place to ask this, but I figured it couldn't hurt to try.

I've to an Asus RT-AC66R that offers the ability to configure an OpenVPN server on it. I enabled it with all of the default settings, with the exception of changing UDP over to TCP.

Interface Type = TUN
Protocol = TCP
Server Port = 1194
Firewall = Auto
Authorization Mode = TLS
Username/Password Auth. Only = No
Extra HMAC Auth = Disabled
Poll Interval = 0 minutes (disabled)
Push LAN to clients = Yes
Direct clients to redirect Internet traffic = No
Respond to DNS = No
Encryption cipher = Default
Compression = Adaptive
TLS Renegotiation Time = -1
Manage Client-Specific Options = No

When I try to connect, I'm currently trying to connect from a Mac using Tunnelblick, it fails to connect with the following errors:

2015-06-12 09:28:46 TLS_ERROR: BIO read tls_read_plaintext error: error:14082174:SSL routines:SSL3_CHECK_CERT_AND_ALGORITHM:dh key too small
2015-06-12 09:28:46 TLS Error: TLS object -> incoming plaintext read error
2015-06-12 09:28:46 TLS Error: TLS handshake failed
2015-06-12 09:28:46 Fatal TLS error (check_tls_errors_co), restarting
2015-06-12 09:28:46 SIGUSR1[soft,tls-error] received, process restarting

So any thoughts? I've tried searching for the error "dh key too small" and got nothing.

Thanks.

Traffic

It looks like your your Key has not been created correctly ?

Unfortunately, this has no relevant information:
http://www.asus.com/support/FAQ/1008713

I suggest you contact Asus ..

glwhiogwe

I have the AC68U and a Macbook.

I can connect form Remote with the following settings via Tunnelblick:

BUT when I try to connect from my linux netbook I have the same error as you: dh key too small.

Wheres the solution for it? :/

glwhiogwe

matteoguglielmi

Same over here!

I have two asus routers:

RT-N66U and RT-AC3200

and the 'key too small' problem started on both
routers after (but not sure...) upgrading to the
latest merlin firmware 378.54_2.

But this is weird because it only happens when
I try to start the VPNs using openvpn installed
on arch linux.

From my IPhone, I have no issues at all and the
certificate (ovpn format) is exactly the same!

What happened then?

I've also rolled back the firmware on both routers
without luck.

This is why I though that maybe there was an
upgrade of openvpn on arch linux which broke
the vpns.

Did you also upgrade the firmware recently?

flakrat

Hmm, I just found this post while searching for the same error. The only link provided by Google, interestingly.

I just encountered the same thing on my EE-N66U setting up OpenVPN server on it and using Tunnelblick on Mac.

I don't have anything new to add, but will post back if I find any solution.

MichaelR64

I have a Asus N66 and since this weekend a AC87, with new fw on it.
I used OpenVPN on the N66 together with Tunnelblick successfully.
However on the new AC87 Tunnelblick can not connect to the OpenVPN server.
It gives the exact same message.

It is a problem in the way Tunnelblick sets up a connection i think.
If i use Shimo it works. The same with my android app on my phone.
This page here : http://stackoverflow.com/questions/30701397/ssl-operation-failed-with-code-1-dh-key-too-smallseems to indicate that tunnelblick is using old ciphers when setting up a connection.
Since my N66 wasn't updated a while it probably still accepts old ciphers/keys etc.

MichaelR64

I have the same issue here.
It has to do with the Tunnelblick client using 768bits keys whereas the OpenVPN server on the Rmerlin fw uses default 512bit keys.
However i noticed that in the latest checkin of the openssl bit of the fw he mentions that that version doesn't accept shorter than 768bit keys anymore.
I also saw that it wasn't included in the latest fw.

I made a post about it here:
http://www.snbforums.com/threads/asuswrt-merlin-378-54_2-is-now-available.24902/page-12
However it is not entirely clear to me if and when the openssl update is included the openvpn part will start to generate 768bit DH keys.
He does mention however that one can make one and insert it on the web gui.
I don't really know how to do that though....
So i'll see what happens next.

matteoguglielmi

UPDATE:

The 'key too small' error message occurs only when I connect to the routers from Arch Linux.

If I use the OpenVPN app (iPhone) or a Debian 7 (wheezy) workstation, everything works as
expected.

Therefore I'm not sure if it's due to the recent firmware upgrade of the routers (asuswrt-merlin
378.54_2) or to a broken version of openvpn in Arch Linux (core/openvpn 2.3.6-1).

Any idea?

dscreen

I got the same error with my Asus RT-AC68U router. The DH key is too small now at 512 bits. You can generate a new DH Key using the terminal window on your mac...by typing in OpenSSL...then dhparam -out dh2048.pem 2048
You can view the result with cat dh_2048.pem
It will list the begin and end with the dh key code inbetween. Copy that information and paste it into your settings in your router's VPN advanced settings then go to Authorization Mode and click on Content modification of Keys & Certification.
Paste the new DH key information into the Diffie Hellman Parameters box.
You must hit Apply at the bottom of that screen for it to take and work correctly.

No need to generate any of the other certificates or keys. Go back to the General tab for the OpenVPN. You can then export a new OVPN config file to use with Tunnelblick.
No more complaints from Tunnelblick about the DH Key being too small and unable to connect.
Took me a day of googling to put this solution together. Asus should update their router firmware to generate a larger DH key.

ehlers320

I fixed a similar issue with my RT-68U. It seems the openssl gurus dont really care what breaks when they push out updates. Logjam changes how dhpararms are allowed now have to be > 768bit and soon 1024 bit.

#0 Make sure your router has the correct TIME.
#1 in linux run: openssl dhparam -out dhparams.pem 2048
#2 in the ASUS RT-68U go to /Advanced_VPN_OpenVPN.asp and change it to "advanced" on the dropdown
#3 click Content modification of Keys & Certification. Copy Paste your dhparams.pem content into "Diffie Hellman parameters"
#4 Hit Apply. Your clients should reconnect
#6 Credit me when you get points on stackexchange for this, i spent hours reading openssl change logs and understanding what all was done here to break this for everybody.

Traffic

Did you see this:
https://forums.openvpn.net/topic19384-15.html#p53874

jwilliams31

@ehlers320 - Unfortunately that won't work. Or at least it doesn't work for me. I tried putting in the custom DH key, but when I applied the changes, I get an error message, so the router isn't taking it.

@Traffic - That would be perfect, but I looked at the current Merlin releases and it doesn't look like they support my router. I've got an AC66R which they don't have listed. The closest they have is the AC66U. I'm sure there are enough differences that I don't want to take the chance just for this.

Asus did have a beta version of a new firmware version on their site, but I was hesitant to install it because it required a complete factory reset of the router, and I really didn't feel like going through all of that. Plus it was beta. Now it looks like it the beta was removed. Hopefully this means the standard release will be available soon. And hopefully it will fix this issue.

Thijsvr

Just came in to say that the solution Dscreen offered worked for me. It's the same solution I found elsewhere for Merlin, but it works with the stock firmware too. Easy fix.

Thanks.

dscreen

You're welcome! Glad someone found my fix useful. :-)

jcarerra

jwilliams31 wrote...@Traffic - .That would be perfect, but I looked at the current Merlin releases and it doesn't look like they support my router. I've got an AC66R which they don't have listed. The closest they have is the AC66U. I'm sure there are enough differences that I don't want to take the chance just for this.....

The "R" versions of ASUS routers are identical to "U" versions.
The "R" simply identifies ones bought 'retail' such as at Best Buy.

^^This is from files on Merlin's pages.

Throwaway1990

For anyone still having this problem, I was able to resolve it by just updating the stock firmware to its latest version. I'm currently running 3.0.0.4.378_9459 and it works fine with Tunnelblick 3.6.0a (build 4543.4546)