Connections can be made by an Android phone and a tablet but Windows 7, 8.1 and Ubuntu cannot get a handshake. The error for each connection is identical' The client.ovpn was prepared by the router and as I said, works for some. The OutpostPro firewall is disabled as is the AVFree. Openvpn client is run by administrator. Extra HMAC authorization is disbled. Router log: [code] Jul 31 23:33:03 openvpn[28828]: 192.168.1.16:53494 TLS: Initial packet from [AF_INET]192.168.1.16:53494, sid=16ea052d 94bea224 Jul 31 23:33:06 openvpn[28828]: 192.168.1.16:53496 TLS: Initial packet from [AF_INET]192.168.1.16:53496, sid=b65c6184 84e2cef7 Jul 31 23:33:08 openvpn[28828]: 192.168.1.16:53497 TLS: Initial packet from [AF_INET]192.168.1.16:53497, sid=e7ff1d15 1f51a579 Jul 31 23:33:10 openvpn[28828]: 192.168.1.16:53499 TLS: Initial packet from [AF_INET]192.168.1.16:53499, sid=7e33ea38 5cdcea69 Jul 31 23:34:03 openvpn[28828]: 192.168.1.16:53494 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) Jul 31 23:34:03 openvpn[28828]: 192.168.1.16:53494 TLS Error: TLS handshake failed Jul 31 23:34:03 openvpn[28828]: 192.168.1.16:53494 SIGUSR1[soft,tls-error] received, client-instance restarting Jul 31 23:34:06 openvpn[28828]: 192.168.1.16:53496 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) Jul 31 23:34:06 openvpn[28828]: 192.168.1.16:53496 TLS Error: TLS handshake failed Jul 31 23:34:06 openvpn[28828]: 192.168.1.16:53496 SIGUSR1[soft,tls-error] received, client-instance restarting Jul 31 23:34:08 openvpn[28828]: 192.168.1.16:53497 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) Jul 31 23:34:08 openvpn[28828]: 192.168.1.16:53497 TLS Error: TLS handshake failed Jul 31 23:34:08 openvpn[28828]: 192.168.1.16:53497 SIGUSR1[soft,tls-error] received, client-instance restarting Jul 31 23:34:10 openvpn[28828]: 192.168.1.16:53499 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) Jul 31 23:34:10 openvpn[28828]: 192.168.1.16:53499 TLS Error: TLS handshake failed Jul 31 23:34:10 openvpn[28828]: 192.168.1.16:53499 SIGUSR1[soft,tls-error] received, client-instance restarting [/code] Client log: [code] Fri Jul 31 23:32:51 2015 OpenVPN 2.3.7 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Jul 9 2015 Fri Jul 31 23:32:51 2015 library versions: OpenSSL 1.0.1p 9 Jul 2015, LZO 2.08 Enter Management Password: Fri Jul 31 23:33:04 2015 UDPv4 link local: [undef] Fri Jul 31 23:33:04 2015 UDPv4 link remote: [AF_INET]94.175.54.203:1194 Fri Jul 31 23:33:04 2015 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this Fri Jul 31 23:33:04 2015 TLS_ERROR: BIO read tls_read_plaintext error: error:14082174:SSL routines:SSL3_CHECK_CERT_AND_ALGORITHM:dh key too small Fri Jul 31 23:33:04 2015 TLS Error: TLS object -> incoming plaintext read error Fri Jul 31 23:33:04 2015 TLS Error: TLS handshake failed Fri Jul 31 23:33:04 2015 SIGUSR1[soft,tls-error] received, process restarting Fri Jul 31 23:33:06 2015 UDPv4 link local: [undef] Fri Jul 31 23:33:06 2015 UDPv4 link remote: [AF_INET]94.175.54.203:1194 Fri Jul 31 23:33:06 2015 TLS_ERROR: BIO read tls_read_plaintext error: error:14082174:SSL routines:SSL3_CHECK_CERT_AND_ALGORITHM:dh key too small Fri Jul 31 23:33:06 2015 TLS Error: TLS object -> incoming plaintext read error Fri Jul 31 23:33:06 2015 TLS Error: TLS handshake failed Fri Jul 31 23:33:06 2015 SIGUSR1[soft,tls-error] received, process restarting Fri Jul 31 23:33:08 2015 UDPv4 link local: [undef] Fri Jul 31 23:33:08 2015 UDPv4 link remote: [AF_INET]94.175.54.203:1194 Fri Jul 31 23:33:08 2015 TLS_ERROR: BIO read tls_read_plaintext error: error:14082174:SSL routines:SSL3_CHECK_CERT_AND_ALGORITHM:dh key too small Fri Jul 31 23:33:08 2015 TLS Error: TLS object -> incoming plaintext read error Fri Jul 31 23:33:08 2015 TLS Error: TLS handshake failed Fri Jul 31 23:33:08 2015 SIGUSR1[soft,tls-error] received, process restarting Fri Jul 31 23:33:10 2015 UDPv4 link local: [undef] Fri Jul 31 23:33:10 2015 UDPv4 link remote: [AF_INET]94.175.54.203:1194 Fri Jul 31 23:33:10 2015 TLS_ERROR: BIO read tls_read_plaintext error: error:14082174:SSL routines:SSL3_CHECK_CERT_AND_ALGORITHM:dh key too small Fri Jul 31 23:33:10 2015 TLS Error: TLS object -> incoming plaintext read error Fri Jul 31 23:33:10 2015 TLS Error: TLS handshake failed Fri Jul 31 23:33:10 2015 SIGUSR1[soft,tls-error] received, process restarting Fri Jul 31 23:33:11 2015 SIGTERM[hard,init_instance] received, process exiting [/code]

[list]NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create [b]routing conflicts[/b] if you connect to the VPN server from public locations such as internet cafes that use the same subnet.[/list]

[quote="Traffic"][list]NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create [b]routing conflicts[/b] if you connect to the VPN server from public locations such as internet cafes that use the same subnet.[/list][/quote] I cannot see a way to change the addresses which according to DHCP are 241-250. If I make DCHP default 2-254 I get the error: 'In conflict with the VPN server settings:192.168.1.241-250' So I change to 2-240 which appears to be the only change I can make. [edit] Of course I could start the base address higher. Will try that. However, I have been unable to connect whilst at home.

[quote="makem"]I cannot see a way to change the addresses[/quote]then you are going to have problems .. Please post configs.

[quote="Traffic"][quote="makem"]I cannot see a way to change the addresses[/quote]then you are going to have problems .. Please post configs.[/quote] Asus Wireless Route RT-AC68U - VPN Server using integral OpenVPN Enable VPN server: ON VPN Details: Advanced settings Interface: TUN Protocol: UDP Server Port: 1194 Firewall: Auto Authorization Mode: TLS Username/Password Auth. Only: No Extra HMAC aothorization: Disable VPN Subnet/Netmask: 10.8.0.0 255.255.255.0 Poll Interval: 0 minutes Push LAN to clients: Yes Direct clients to redirect internet traffic: No Respond to DNS: No Encryption Cipher: AES-256-CBC TLS Renegotition Time: -1 seconds Manage client specific options: No Client OpenVPN Client on Windows 7, 8.1 client.ovpn file produced by router added to OpenVPN config folder. No config. necessary New router log: [code] Aug 3 14:25:13 openvpn[12554]: 192.168.1.33:54542 TLS: Initial packet from [AF_INET]192.168.1.33:54542, sid=d6dc0874 99b629f3 Aug 3 14:25:18 openvpn[12554]: 192.168.1.33:60106 TLS: Initial packet from [AF_INET]192.168.1.33:60106, sid=e0b11716 30a71d61 Aug 3 14:25:23 openvpn[12554]: 192.168.1.33:51981 TLS: Initial packet from [AF_INET]192.168.1.33:51981, sid=d7a7d163 ad4d5f3c Aug 3 14:25:29 openvpn[12554]: 192.168.1.33:58447 TLS: Initial packet from [AF_INET]192.168.1.33:58447, sid=b1d623c5 2bc39559 Aug 3 14:25:34 openvpn[12554]: 192.168.1.33:56968 TLS: Initial packet from [AF_INET]192.168.1.33:56968, sid=24ae8530 733dab4a Aug 3 14:26:13 openvpn[12554]: 192.168.1.33:54542 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) Aug 3 14:26:13 openvpn[12554]: 192.168.1.33:54542 TLS Error: TLS handshake failed Aug 3 14:26:13 openvpn[12554]: 192.168.1.33:54542 SIGUSR1[soft,tls-error] received, client-instance restarting Aug 3 14:26:19 openvpn[12554]: 192.168.1.33:60106 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) Aug 3 14:26:19 openvpn[12554]: 192.168.1.33:60106 TLS Error: TLS handshake failed Aug 3 14:26:19 openvpn[12554]: 192.168.1.33:60106 SIGUSR1[soft,tls-error] received, client-instance restarting Aug 3 14:26:23 openvpn[12554]: 192.168.1.33:51981 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) Aug 3 14:26:23 openvpn[12554]: 192.168.1.33:51981 TLS Error: TLS handshake failed Aug 3 14:26:23 openvpn[12554]: 192.168.1.33:51981 SIGUSR1[soft,tls-error] received, client-instance restarting Aug 3 14:26:29 openvpn[12554]: 192.168.1.33:58447 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) Aug 3 14:26:29 openvpn[12554]: 192.168.1.33:58447 TLS Error: TLS handshake failed Aug 3 14:26:29 openvpn[12554]: 192.168.1.33:58447 SIGUSR1[soft,tls-error] received, client-instance restarting Aug 3 14:26:34 openvpn[12554]: 192.168.1.33:56968 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) Aug 3 14:26:34 openvpn[12554]: 192.168.1.33:56968 TLS Error: TLS handshake failed Aug 3 14:26:34 openvpn[12554]: 192.168.1.33:56968 SIGUSR1[soft,tls-error] received, client-instance restarting [/code] New client log: [code] Mon Aug 03 14:25:12 2015 UDPv4 link local: [undef] Mon Aug 03 14:25:12 2015 UDPv4 link remote: [AF_INET]xx.xxx.xx.xxx:1194 Mon Aug 03 14:25:12 2015 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this Mon Aug 03 14:25:12 2015 TLS_ERROR: BIO read tls_read_plaintext error: error:14082174:SSL routines:SSL3_CHECK_CERT_AND_ALGORITHM:dh key too small Mon Aug 03 14:25:12 2015 TLS Error: TLS object -> incoming plaintext read error Mon Aug 03 14:25:12 2015 TLS Error: TLS handshake failed Mon Aug 03 14:25:12 2015 SIGUSR1[soft,tls-error] received, process restarting Mon Aug 03 14:25:18 2015 UDPv4 link local: [undef] Mon Aug 03 14:25:18 2015 UDPv4 link remote: [AF_INET]xx.xxx.xx.xxx:1194 Mon Aug 03 14:25:18 2015 TLS_ERROR: BIO read tls_read_plaintext error: error:14082174:SSL routines:SSL3_CHECK_CERT_AND_ALGORITHM:dh key too small Mon Aug 03 14:25:18 2015 TLS Error: TLS object -> incoming plaintext read error Mon Aug 03 14:25:18 2015 TLS Error: TLS handshake failed Mon Aug 03 14:25:18 2015 SIGUSR1[soft,tls-error] received, process restarting Mon Aug 03 14:25:23 2015 UDPv4 link local: [undef] Mon Aug 03 14:25:23 2015 UDPv4 link remote: [AF_INET]xx.xxx.xx.xxx:1194 Mon Aug 03 14:25:23 2015 TLS_ERROR: BIO read tls_read_plaintext error: error:14082174:SSL routines:SSL3_CHECK_CERT_AND_ALGORITHM:dh key too small Mon Aug 03 14:25:23 2015 TLS Error: TLS object -> incoming plaintext read error Mon Aug 03 14:25:23 2015 TLS Error: TLS handshake failed Mon Aug 03 14:25:23 2015 SIGUSR1[soft,tls-error] received, process restarting Mon Aug 03 14:25:28 2015 UDPv4 link local: [undef] Mon Aug 03 14:25:28 2015 UDPv4 link remote: [AF_INET]xx.xxx.xx.xxx:1194 Mon Aug 03 14:25:28 2015 TLS_ERROR: BIO read tls_read_plaintext error: error:14082174:SSL routines:SSL3_CHECK_CERT_AND_ALGORITHM:dh key too small Mon Aug 03 14:25:28 2015 TLS Error: TLS object -> incoming plaintext read error Mon Aug 03 14:25:28 2015 TLS Error: TLS handshake failed Mon Aug 03 14:25:28 2015 SIGUSR1[soft,tls-error] received, process restarting Mon Aug 03 14:25:34 2015 UDPv4 link local: [undef] Mon Aug 03 14:25:34 2015 UDPv4 link remote: [AF_INET]xx.xxx.xx.xxx:1194 Mon Aug 03 14:25:34 2015 TLS_ERROR: BIO read tls_read_plaintext error: error:14082174:SSL routines:SSL3_CHECK_CERT_AND_ALGORITHM:dh key too small Mon Aug 03 14:25:34 2015 TLS Error: TLS object -> incoming plaintext read error Mon Aug 03 14:25:34 2015 TLS Error: TLS handshake failed Mon Aug 03 14:25:34 2015 SIGUSR1[soft,tls-error] received, process restarting Mon Aug 03 14:25:35 2015 SIGTERM[hard,init_instance] received, process exiting [/code] Thank you

[quote="makem"]client.ovpn file produced by router added to OpenVPN config folder. No config. necessary[/quote]Routers made by third parties have a history of doing this wrong .. please post your client config.

[quote="Traffic"][quote="makem"]client.ovpn file produced by router added to OpenVPN config folder. No config. necessary[/quote]Routers made by third parties have a history of doing this wrong .. please post your client config.[/quote] The client.ovpn produced by the router contains three keys which I don't feel inclined to publish here as they would enable access to anyone? Am I right in that? I can publish those parts of the client.ovpn other than the actual keys. I hope this is sufficient. [code] client dev tun proto udp remote makem-goes.xx.xx 1194 float cipher AES-256-CBC comp-lzo adaptive keepalive 15 60 auth-user-pass ns-cert-type server -----BEGIN CERTIFICATE-----xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx-----END CERTIFICATE----- -----BEGIN CERTIFICATE-----xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx-----END CERTIFICATE----- -----BEGIN PRIVATE KEY-----xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx-----END PRIVATE KEY----- resolv-retry infinitenobind [/code] The same entries are used in Ubuntu which also cannot connect and in which case I use the above entries minus the in each of the three files I prepare which are needed to configure the client. (I did not mention Ubuntu in this post question to keep it to just Windows) I also do not include the in the ca.cert, perhaps I should?

[quote="makem"]The client.ovpn produced by the router contains three keys which I don't feel inclined to publish here as they would enable access to anyone? Am I right in that?[/quote]Correct .. there is no need to include key details. Your client config looks reasonable ... I do not understand your last comment above .. You must have the ca/cert/key configured correctly either inline (as above) or by loading the files directly. eg:[code]ca /path/to/ca.crt cert /path/to/client.crt key /path/to/client.key[/code]

[quote="Traffic"][quote="makem"]The client.ovpn produced by the router contains three keys which I don't feel inclined to publish here as they would enable access to anyone? Am I right in that?[/quote]Correct .. there is no need to include key details. Your client config looks reasonable ... I do not understand your last comment above .. You must have the ca/cert/key configured correctly either inline (as above) or by loading the files directly. eg:[code]ca /path/to/ca.crt cert /path/to/client.crt key /path/to/client.key[/code][/quote] Please ignore that last comment as I now understand. I have read somewhere that I should put the following at the start of the client.crt file manually: [code]ca /path/to/ca.crt cert /path/to/client.crt key /path/to/client.key[/code] I have also found that by clicking a link in the router advanced config. I can access the crt and key contents directly and am able to copy them to correctly named files. I have tried this but it still gave the same error message in Windows and Ubuntu. Because the client is communicating directly with the router, pc firewalls shoud not interfere? I have tried disabling the Win ones but not the Ubuntu ones as I don't know how (yet). Do you think including the code above in the client crt is necessary? I am really at a loss having tried many combinations with the same error result. I am beginning to wonder if the router has a software problem. I do notice the the keys produced by clicking the router link are formatted correctly but when extracting from the ovpn, only one key is formatted, the other two run into each other. I read that the data should have Windows ctrl M at the end of each line. Router link: Authorization Mode - Content modification of Keys & Certification. (In yellow) Produces the separate key files. I am wondering if I should make a manual client config from the examples (it looks daunting) but OpenVPN says just dump the ovpn in its config folder.

[quote="makem"]I have read somewhere that I should put the following at the start of the [u]client.crt[/u] file manually: Code: ca /path/to/ca.crt cert /path/to/client.crt key /path/to/client.key[/quote]Not the [i]client cert[/i] the [i]client config[/i] (client.ovpn or client.conf)

Read above first ! [quote="makem"]Router link: Authorization Mode - Content modification of Keys & Certification. (In yellow) Produces the separate key files.[/quote]Use that method to get the ca.crt & cert/key pair for your client. [quote="makem"]I am wondering if I should make a manual client config from the examples (it looks daunting) [/quote]Use your existing client CONFIG file and simply use the new ca/cert/key (from step above) with that config .. use the files directly as I showed before. [url]https://forums.openvpn.net/topic19384.html#p53836[/url]

Asus RT-A68U router with OpenVpn (dh key too small)

Ametz

erzulie wrote
makem wroteThe problem with this error DH key to small lies in a recent security update from openSSL. The new version no longer accepts keys smaller than 768bits.
I have reverted to an older version of the OpenVPN client to get around this problem until Asus provide a new firmware. However, I'd like to have the newest version of OpenVPN possible.

Does anyone know what version of the OpenVPN client for Windows first had this update from OpenSSL?

Thanks!

First time i try VPN and i got stuck, been fiddeling with it all day, and it seems i have the same problem on an ASUS RT-N66U Firmware Version:3.0.0.4.378_4850

Is there some dh generator online that i can use or do i need to wait for ASUS to get a new firmware?
I been looking at the openssl, but that is too advanced for me it looks like...

[deleted]

Hi,

I'm new here. have asus RT-N66U and I'm trying to get OpenVPN working inbound to my network.

Remote client is mac OSX using tunnelblick.

Is there an older version of tunnelblick that will work or another recommendation?

I'm considering upgrading the router software but at this time I do not have a working backup so that is too risky.

any advice or suggestions to handle this on the client side until Asus provides an update?

tnx

« Previous Page