Asus RT-A68U router with OpenVpn (dh key too small)

makem

Connections can be made by an Android phone and a tablet but Windows 7, 8.1 and Ubuntu cannot get a handshake. The error for each connection is identical'

The client.ovpn was prepared by the router and as I said, works for some.

The OutpostPro firewall is disabled as is the AVFree. Openvpn client is run by administrator. Extra HMAC authorization is disbled.

Router log:

Jul 31 23:33:03 openvpn[28828]: 192.168.1.16:53494 TLS: Initial packet from [AF_INET]192.168.1.16:53494, sid=16ea052d 94bea224
Jul 31 23:33:06 openvpn[28828]: 192.168.1.16:53496 TLS: Initial packet from [AF_INET]192.168.1.16:53496, sid=b65c6184 84e2cef7
Jul 31 23:33:08 openvpn[28828]: 192.168.1.16:53497 TLS: Initial packet from [AF_INET]192.168.1.16:53497, sid=e7ff1d15 1f51a579
Jul 31 23:33:10 openvpn[28828]: 192.168.1.16:53499 TLS: Initial packet from [AF_INET]192.168.1.16:53499, sid=7e33ea38 5cdcea69
Jul 31 23:34:03 openvpn[28828]: 192.168.1.16:53494 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Jul 31 23:34:03 openvpn[28828]: 192.168.1.16:53494 TLS Error: TLS handshake failed
Jul 31 23:34:03 openvpn[28828]: 192.168.1.16:53494 SIGUSR1[soft,tls-error] received, client-instance restarting
Jul 31 23:34:06 openvpn[28828]: 192.168.1.16:53496 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Jul 31 23:34:06 openvpn[28828]: 192.168.1.16:53496 TLS Error: TLS handshake failed
Jul 31 23:34:06 openvpn[28828]: 192.168.1.16:53496 SIGUSR1[soft,tls-error] received, client-instance restarting
Jul 31 23:34:08 openvpn[28828]: 192.168.1.16:53497 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Jul 31 23:34:08 openvpn[28828]: 192.168.1.16:53497 TLS Error: TLS handshake failed
Jul 31 23:34:08 openvpn[28828]: 192.168.1.16:53497 SIGUSR1[soft,tls-error] received, client-instance restarting
Jul 31 23:34:10 openvpn[28828]: 192.168.1.16:53499 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Jul 31 23:34:10 openvpn[28828]: 192.168.1.16:53499 TLS Error: TLS handshake failed
Jul 31 23:34:10 openvpn[28828]: 192.168.1.16:53499 SIGUSR1[soft,tls-error] received, client-instance restarting

Client log:

Fri Jul 31 23:32:51 2015 OpenVPN 2.3.7 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Jul  9 2015
Fri Jul 31 23:32:51 2015 library versions: OpenSSL 1.0.1p 9 Jul 2015, LZO 2.08
Enter Management Password:
Fri Jul 31 23:33:04 2015 UDPv4 link local: [undef]
Fri Jul 31 23:33:04 2015 UDPv4 link remote: [AF_INET]94.175.54.203:1194
Fri Jul 31 23:33:04 2015 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Fri Jul 31 23:33:04 2015 TLS_ERROR: BIO read tls_read_plaintext error: error:14082174:SSL routines:SSL3_CHECK_CERT_AND_ALGORITHM:dh key too small
Fri Jul 31 23:33:04 2015 TLS Error: TLS object -> incoming plaintext read error
Fri Jul 31 23:33:04 2015 TLS Error: TLS handshake failed
Fri Jul 31 23:33:04 2015 SIGUSR1[soft,tls-error] received, process restarting
Fri Jul 31 23:33:06 2015 UDPv4 link local: [undef]
Fri Jul 31 23:33:06 2015 UDPv4 link remote: [AF_INET]94.175.54.203:1194
Fri Jul 31 23:33:06 2015 TLS_ERROR: BIO read tls_read_plaintext error: error:14082174:SSL routines:SSL3_CHECK_CERT_AND_ALGORITHM:dh key too small
Fri Jul 31 23:33:06 2015 TLS Error: TLS object -> incoming plaintext read error
Fri Jul 31 23:33:06 2015 TLS Error: TLS handshake failed
Fri Jul 31 23:33:06 2015 SIGUSR1[soft,tls-error] received, process restarting
Fri Jul 31 23:33:08 2015 UDPv4 link local: [undef]
Fri Jul 31 23:33:08 2015 UDPv4 link remote: [AF_INET]94.175.54.203:1194
Fri Jul 31 23:33:08 2015 TLS_ERROR: BIO read tls_read_plaintext error: error:14082174:SSL routines:SSL3_CHECK_CERT_AND_ALGORITHM:dh key too small
Fri Jul 31 23:33:08 2015 TLS Error: TLS object -> incoming plaintext read error
Fri Jul 31 23:33:08 2015 TLS Error: TLS handshake failed
Fri Jul 31 23:33:08 2015 SIGUSR1[soft,tls-error] received, process restarting
Fri Jul 31 23:33:10 2015 UDPv4 link local: [undef]
Fri Jul 31 23:33:10 2015 UDPv4 link remote: [AF_INET]94.175.54.203:1194
Fri Jul 31 23:33:10 2015 TLS_ERROR: BIO read tls_read_plaintext error: error:14082174:SSL routines:SSL3_CHECK_CERT_AND_ALGORITHM:dh key too small
Fri Jul 31 23:33:10 2015 TLS Error: TLS object -> incoming plaintext read error
Fri Jul 31 23:33:10 2015 TLS Error: TLS handshake failed
Fri Jul 31 23:33:10 2015 SIGUSR1[soft,tls-error] received, process restarting
Fri Jul 31 23:33:11 2015 SIGTERM[hard,init_instance] received, process exiting

Traffic

NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

makem

Traffic wrote
NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

I cannot see a way to change the addresses which according to DHCP are 241-250.

If I make DCHP default 2-254 I get the error:

'In conflict with the VPN server settings:192.168.1.241-250'

So I change to 2-240 which appears to be the only change I can make.

[edit] Of course I could start the base address higher. Will try that. However, I have been unable to connect whilst at home.

Traffic

makem wroteI cannot see a way to change the addresses

then you are going to have problems ..

Please post configs.

makem

Traffic wrote
makem wroteI cannot see a way to change the addresses
then you are going to have problems ..

Please post configs.

Asus Wireless Route RT-AC68U - VPN Server using integral OpenVPN

Enable VPN server: ON
VPN Details: Advanced settings
Interface: TUN
Protocol: UDP
Server Port: 1194
Firewall: Auto
Authorization Mode: TLS
Username/Password Auth. Only: No
Extra HMAC aothorization: Disable
VPN Subnet/Netmask: 10.8.0.0 255.255.255.0
Poll Interval: 0 minutes
Push LAN to clients: Yes
Direct clients to redirect internet traffic: No
Respond to DNS: No
Encryption Cipher: AES-256-CBC
TLS Renegotition Time: -1 seconds
Manage client specific options: No

Client OpenVPN Client on Windows 7, 8.1

client.ovpn file produced by router added to OpenVPN config folder.

No config. necessary

New router log:

Aug  3 14:25:13 openvpn[12554]: 192.168.1.33:54542 TLS: Initial packet from [AF_INET]192.168.1.33:54542, sid=d6dc0874 99b629f3
Aug  3 14:25:18 openvpn[12554]: 192.168.1.33:60106 TLS: Initial packet from [AF_INET]192.168.1.33:60106, sid=e0b11716 30a71d61
Aug  3 14:25:23 openvpn[12554]: 192.168.1.33:51981 TLS: Initial packet from [AF_INET]192.168.1.33:51981, sid=d7a7d163 ad4d5f3c
Aug  3 14:25:29 openvpn[12554]: 192.168.1.33:58447 TLS: Initial packet from [AF_INET]192.168.1.33:58447, sid=b1d623c5 2bc39559
Aug  3 14:25:34 openvpn[12554]: 192.168.1.33:56968 TLS: Initial packet from [AF_INET]192.168.1.33:56968, sid=24ae8530 733dab4a
Aug  3 14:26:13 openvpn[12554]: 192.168.1.33:54542 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Aug  3 14:26:13 openvpn[12554]: 192.168.1.33:54542 TLS Error: TLS handshake failed
Aug  3 14:26:13 openvpn[12554]: 192.168.1.33:54542 SIGUSR1[soft,tls-error] received, client-instance restarting
Aug  3 14:26:19 openvpn[12554]: 192.168.1.33:60106 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Aug  3 14:26:19 openvpn[12554]: 192.168.1.33:60106 TLS Error: TLS handshake failed
Aug  3 14:26:19 openvpn[12554]: 192.168.1.33:60106 SIGUSR1[soft,tls-error] received, client-instance restarting
Aug  3 14:26:23 openvpn[12554]: 192.168.1.33:51981 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Aug  3 14:26:23 openvpn[12554]: 192.168.1.33:51981 TLS Error: TLS handshake failed
Aug  3 14:26:23 openvpn[12554]: 192.168.1.33:51981 SIGUSR1[soft,tls-error] received, client-instance restarting
Aug  3 14:26:29 openvpn[12554]: 192.168.1.33:58447 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Aug  3 14:26:29 openvpn[12554]: 192.168.1.33:58447 TLS Error: TLS handshake failed
Aug  3 14:26:29 openvpn[12554]: 192.168.1.33:58447 SIGUSR1[soft,tls-error] received, client-instance restarting
Aug  3 14:26:34 openvpn[12554]: 192.168.1.33:56968 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Aug  3 14:26:34 openvpn[12554]: 192.168.1.33:56968 TLS Error: TLS handshake failed
Aug  3 14:26:34 openvpn[12554]: 192.168.1.33:56968 SIGUSR1[soft,tls-error] received, client-instance restarting

New client log:

Mon Aug 03 14:25:12 2015 UDPv4 link local: [undef]
Mon Aug 03 14:25:12 2015 UDPv4 link remote: [AF_INET]xx.xxx.xx.xxx:1194
Mon Aug 03 14:25:12 2015 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Mon Aug 03 14:25:12 2015 TLS_ERROR: BIO read tls_read_plaintext error: error:14082174:SSL routines:SSL3_CHECK_CERT_AND_ALGORITHM:dh key too small
Mon Aug 03 14:25:12 2015 TLS Error: TLS object -> incoming plaintext read error
Mon Aug 03 14:25:12 2015 TLS Error: TLS handshake failed
Mon Aug 03 14:25:12 2015 SIGUSR1[soft,tls-error] received, process restarting
Mon Aug 03 14:25:18 2015 UDPv4 link local: [undef]
Mon Aug 03 14:25:18 2015 UDPv4 link remote: [AF_INET]xx.xxx.xx.xxx:1194
Mon Aug 03 14:25:18 2015 TLS_ERROR: BIO read tls_read_plaintext error: error:14082174:SSL routines:SSL3_CHECK_CERT_AND_ALGORITHM:dh key too small
Mon Aug 03 14:25:18 2015 TLS Error: TLS object -> incoming plaintext read error
Mon Aug 03 14:25:18 2015 TLS Error: TLS handshake failed
Mon Aug 03 14:25:18 2015 SIGUSR1[soft,tls-error] received, process restarting
Mon Aug 03 14:25:23 2015 UDPv4 link local: [undef]
Mon Aug 03 14:25:23 2015 UDPv4 link remote: [AF_INET]xx.xxx.xx.xxx:1194
Mon Aug 03 14:25:23 2015 TLS_ERROR: BIO read tls_read_plaintext error: error:14082174:SSL routines:SSL3_CHECK_CERT_AND_ALGORITHM:dh key too small
Mon Aug 03 14:25:23 2015 TLS Error: TLS object -> incoming plaintext read error
Mon Aug 03 14:25:23 2015 TLS Error: TLS handshake failed
Mon Aug 03 14:25:23 2015 SIGUSR1[soft,tls-error] received, process restarting
Mon Aug 03 14:25:28 2015 UDPv4 link local: [undef]
Mon Aug 03 14:25:28 2015 UDPv4 link remote: [AF_INET]xx.xxx.xx.xxx:1194
Mon Aug 03 14:25:28 2015 TLS_ERROR: BIO read tls_read_plaintext error: error:14082174:SSL routines:SSL3_CHECK_CERT_AND_ALGORITHM:dh key too small
Mon Aug 03 14:25:28 2015 TLS Error: TLS object -> incoming plaintext read error
Mon Aug 03 14:25:28 2015 TLS Error: TLS handshake failed
Mon Aug 03 14:25:28 2015 SIGUSR1[soft,tls-error] received, process restarting
Mon Aug 03 14:25:34 2015 UDPv4 link local: [undef]
Mon Aug 03 14:25:34 2015 UDPv4 link remote: [AF_INET]xx.xxx.xx.xxx:1194
Mon Aug 03 14:25:34 2015 TLS_ERROR: BIO read tls_read_plaintext error: error:14082174:SSL routines:SSL3_CHECK_CERT_AND_ALGORITHM:dh key too small
Mon Aug 03 14:25:34 2015 TLS Error: TLS object -> incoming plaintext read error
Mon Aug 03 14:25:34 2015 TLS Error: TLS handshake failed
Mon Aug 03 14:25:34 2015 SIGUSR1[soft,tls-error] received, process restarting
Mon Aug 03 14:25:35 2015 SIGTERM[hard,init_instance] received, process exiting

Thank you

Traffic

makem wroteclient.ovpn file produced by router added to OpenVPN config folder.

No config. necessary

Routers made by third parties have a history of doing this wrong .. please post your client config.

makem

Traffic wrote
makem wroteclient.ovpn file produced by router added to OpenVPN config folder.

No config. necessary
Routers made by third parties have a history of doing this wrong .. please post your client config.

The client.ovpn produced by the router contains three keys which I don't feel inclined to publish here as they would enable access to anyone? Am I right in that?

I can publish those parts of the client.ovpn other than the actual keys. I hope this is sufficient.

client
dev tun
proto udp
remote makem-goes.xx.xx 1194
float
cipher AES-256-CBC
comp-lzo adaptive
keepalive 15 60
auth-user-pass
ns-cert-type server

<ca>-----BEGIN CERTIFICATE-----xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx-----END CERTIFICATE-----</ca>

</ca><cert>-----BEGIN CERTIFICATE-----xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx-----END CERTIFICATE-----</cert>

<key>-----BEGIN PRIVATE KEY-----xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx-----END PRIVATE KEY-----</key>

resolv-retry infinitenobind

The same entries are used in Ubuntu which also cannot connect and in which case I use the above entries minus the <xx> </xx> in each of the three files I prepare which are needed to configure the client. (I did not mention Ubuntu in this post question to keep it to just Windows) I also do not include the <cert> in the ca.cert, perhaps I should?

Traffic

makem wroteThe client.ovpn produced by the router contains three keys which I don't feel inclined to publish here as they would enable access to anyone? Am I right in that?

Correct .. there is no need to include key details.

Your client config looks reasonable ...

I do not understand your last comment above .. You must have the ca/cert/key configured correctly either inline (as above) or by loading the files directly.

eg:

ca /path/to/ca.crt
cert /path/to/client.crt
key /path/to/client.key

makem

Traffic wrote
makem wroteThe client.ovpn produced by the router contains three keys which I don't feel inclined to publish here as they would enable access to anyone? Am I right in that?
Correct .. there is no need to include key details.

Your client config looks reasonable ...

I do not understand your last comment above .. You must have the ca/cert/key configured correctly either inline (as above) or by loading the files directly.

eg:
ca /path/to/ca.crt
cert /path/to/client.crt
key /path/to/client.key

Please ignore that last comment as I now understand.

I have read somewhere that I should put the following at the start of the client.crt file manually:

ca /path/to/ca.crt
cert /path/to/client.crt
key /path/to/client.key

I have also found that by clicking a link in the router advanced config. I can access the crt and key contents directly and am able to copy them to correctly named files. I have tried this but it still gave the same error message in Windows and Ubuntu.

Because the client is communicating directly with the router, pc firewalls shoud not interfere? I have tried disabling the Win ones but not the Ubuntu ones as I don't know how (yet).

Do you think including the code above in the client crt is necessary?

I am really at a loss having tried many combinations with the same error result. I am beginning to wonder if the router has a software problem.

I do notice the the keys produced by clicking the router link are formatted correctly but when extracting from the ovpn, only one key is formatted, the other two run into each other. I read that the data should have Windows ctrl M at the end of each line.

Router link: Authorization Mode - Content modification of Keys & Certification. (In yellow) Produces the separate key files.

I am wondering if I should make a manual client config from the examples (it looks daunting) but OpenVPN says just dump the ovpn in its config folder.

Traffic

makem wroteI have read somewhere that I should put the following at the start of the client.crt file manually:

Code:
ca /path/to/ca.crt
cert /path/to/client.crt
key /path/to/client.key

Not the client cert the client config (client.ovpn or client.conf)

Traffic

Read above first !

makem wroteRouter link: Authorization Mode - Content modification of Keys & Certification. (In yellow) Produces the separate key files.

Use that method to get the ca.crt & cert/key pair for your client.

makem wroteI am wondering if I should make a manual client config from the examples (it looks daunting)

Use your existing client CONFIG file and simply use the new ca/cert/key (from step above) with that config .. use the files directly as I showed before.
https://forums.openvpn.net/topic19384.html#p53836

makem

Traffic wroteRead above first !

makem wroteRouter link: Authorization Mode - Content modification of Keys & Certification. (In yellow) Produces the separate key files.
Use that method to get the ca.crt & cert/key pair for your client.

makem wroteI am wondering if I should make a manual client config from the examples (it looks daunting)
Use your existing client CONFIG file and simply use the new ca/cert/key (from step above) with that config .. use the files directly as I showed before.
https://forums.openvpn.net/topic19384.html#p53836

The problem is...................I don't have a config file!

What I posted here was the data that I input into the router advanced setup page. It is from that page the crts and key is made and other than changing the entries I have no control.

https://www.google.com/search?q=rt-68u+advanced+settings&source=lnms&tbm=isch&sa=X&ved=0CAoQ_AUoBGoVChMIo8u108mPxwIVCpUsCh1RBAL2&biw=1116&bih=690#imgrc=rvzMuVAAqv2ZuM%3A

What I meant was that I should make a manual config somehow and ignore the ovpn made by the router. However, when it comes to Ubuntu, that does need individual keys in the connection manager setup page.

makem

At the bottom, this shows some of the settings available:

http://www.asus.com/support/FAQ/1008713

Traffic

makem wrotethis shows some of the settings available:

http://www.asus.com/support/FAQ/1008713

a clear indication of how poor Asus docs are ..

makem wrotewhen it comes to Ubuntu, that does need individual keys in the connection manager setup page.

You can create a standard client.conf file with nano and start that from the console .. there is no need to use network manager.

The problems you have are related to your PKI .. For example:

makem wroteClient log:
Code:
Fri Jul 31 23:32:51 2015 OpenVPN 2.3.7 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Jul 9 2015
Fri Jul 31 23:32:51 2015 library versions: OpenSSL 1.0.1p 9 Jul 2015, LZO 2.08
Enter Management Password:
Fri Jul 31 23:33:04 2015 UDPv4 link local: [undef]
Fri Jul 31 23:33:04 2015 UDPv4 link remote: [AF_INET]94.175.54.203:1194
Fri Jul 31 23:33:04 2015 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Fri Jul 31 23:33:04 2015 TLS_ERROR: BIO read tls_read_plaintext error: error:14082174:SSL routines:SSL3_CHECK_CERT_AND_ALGORITHM:dh key too small

My guess is you should recreate your PKI using easy-rsa .. Use the .zip windows version.

To test your network you could create a simple test VPN:
static-key-mini-howto

makem

I created a working VPN using easy-rsa on a Raspberry pi and all machines were able to connect to it from anywhere so I know the network is fine.

It is annoying to think that I have a top of the range router and cannot get one working there as I want the pi for a portable project.

I will continue on the lines you suggest thank you.

Traffic

makem wroteI created a working VPN using easy-rsa on a Raspberry pi and all machines were able to connect to it

Then maybe you can upload your tested PKI to the router and work from those files.

makem

For those who may follow this thread:

email from Asus:

Thank you for providing the additional information.

The problem with this error DH key to small lies in a recent security update from openSSL. The new version no longer accepts keys smaller than 768bits.

As standard openVPN used to generate 512bit key, with this update some devices will not accept this key anymore.

You have reset to factory setting and reconfigured but it didn't seem to generate the right size key.

As it is currently not possible to manually add a new DH, we cannot resolve this as of yet, as we have to wait for a firmware update.

However, you could also look at a custom firmware version called Merlin which does allow for manual key input. Although we do not officially support it, it has been a solution for many people with this issue.

Should you wish to go this route take a look here for the solution for that custom firmware :

http://www.snbforums.com/threads/asus-rt-87u-merlin-openvpn-server-fails-diffie-helmann-dh-key-too-small.25326/

How to mark as solved in respect of the router? I hope that OpenVPN for Android can use the 768bits key. If not then it will not be possible to use the phones and Nexus to use the same VPN as the Windows and Ubuntu machines.

Traffic

That is good news .. at least you have an authoritative answer 8-)

makem wrotelook at a custom firmware version called Merlin which does allow for manual key input

and work with your new PKI.

Worth re-adding this final Link for easy-rsa:
https://github.com/OpenVPN/easy-rsa/releases

(Is it possible for a Mod to amend the Title to reflect the "dh key too small" error)

makem

Update:

I now have the latest merlin firmware working correctly on the Asus RT-AC68U router and I would advise anyone with this router to adopt that firmware. It is far more professional than that shipped with the router.

Manual dh key input is not required as the firmware is up-to-date so includes the recent security changes.

I had lot of trouble uploading any firmware for two days and eventually found out that it was Firefox history causing the problem, As soon as I used IE it installed immediately. Flush firefox history before uploading I would suggest.

In addition, I have confirmed that OpenVPN for Android operates correctly with the larger dh key.

So, I am a happy bunny 😃

erzulie

makem wroteThe problem with this error DH key to small lies in a recent security update from openSSL. The new version no longer accepts keys smaller than 768bits.

I have reverted to an older version of the OpenVPN client to get around this problem until Asus provide a new firmware. However, I'd like to have the newest version of OpenVPN possible.

Does anyone know what version of the OpenVPN client for Windows first had this update from OpenSSL?

Thanks!