OpenVPN data channel not getting encrypted

JamesD

Good day,

Over the last few days I have been working on getting my OpenVPN client/server setup working.

Everything appears to be working correctly, but I don't think my data channel is being encrypted.

Here is the log from my DD-WRT client:

Jan 31 03:46:31 james user.info : openvpn : OpenVPN daemon (Client) starting/restarting...
Jan 31 03:46:31 james daemon.notice openvpn[8979]: OpenVPN 2.3.8 arm-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Dec 10 2015
Jan 31 03:46:31 james daemon.notice openvpn[8979]: library versions: OpenSSL 1.0.2e 3 Dec 2015, LZO 2.09
Jan 31 03:46:31 james daemon.notice openvpn[8984]: MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:16
Jan 31 03:46:31 james daemon.warn openvpn[8984]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Jan 31 03:46:31 james daemon.warn openvpn[8984]: WARNING: file '/tmp/openvpncl/client.key' is group or others accessible
Jan 31 03:46:31 james daemon.warn openvpn[8984]: WARNING: file '/tmp/openvpncl/ta.key' is group or others accessible
Jan 31 03:46:31 james daemon.notice openvpn[8984]: Control Channel Authentication: using '/tmp/openvpncl/ta.key' as a OpenVPN static key file
Jan 31 03:46:31 james daemon.notice openvpn[8984]: Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Jan 31 03:46:31 james daemon.notice openvpn[8984]: Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Jan 31 03:46:31 james daemon.notice openvpn[8984]: Socket Buffers: R=[180224->131072] S=[180224->131072]
Jan 31 03:46:31 james daemon.notice openvpn[8984]: UDPv4 link local: [undef]
Jan 31 03:46:31 james daemon.notice openvpn[8984]: UDPv4 link remote: [AF_INET]111.111.11.111:1194
Jan 31 03:46:31 james daemon.notice openvpn[8984]: TLS: Initial packet from [AF_INET]111.111.11.111:1194, sid=9a78ab1e 62fdrb17
Jan 31 03:46:32 james daemon.notice openvpn[8984]: VERIFY OK: depth=1, C=NA, ST=NA, L=NA, O=NA, OU=NA, CN=NA, name=NA, emailAddress=NA
Jan 31 03:46:32 james daemon.notice openvpn[8984]: Validating certificate key usage
Jan 31 03:46:32 james daemon.notice openvpn[8984]: NOTE: --mute triggered...
Jan 31 03:46:34 james daemon.notice openvpn[8984]: 11 variation(s) on previous 3 message(s) suppressed by --mute
Jan 31 03:46:34 james daemon.notice openvpn[8984]: [host] Peer Connection Initiated with [AF_INET]111.111.11.111:1194
Jan 31 03:46:36 james daemon.notice openvpn[8984]: SENT CONTROL [host]: 'PUSH_REQUEST' (status=1)
Jan 31 03:46:36 james daemon.notice openvpn[8984]: PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 111.11.111.111,dhcp-option DNS 111.11.111.11
Jan 31 03:46:36 james daemon.notice openvpn[8984]: OPTIONS IMPORT: timers and/or timeouts modified
Jan 31 03:46:36 james daemon.notice openvpn[8984]: NOTE: --mute triggered...
Jan 31 03:46:36 james daemon.notice openvpn[8984]: 3 variation(s) on previous 3 message(s) suppressed by --mute
Jan 31 03:46:36 james daemon.notice openvpn[8984]: TUN/TAP device tun1 opened
Jan 31 03:46:36 james daemon.notice openvpn[8984]: TUN/TAP TX queue length set to 100
Jan 31 03:46:36 james daemon.notice openvpn[8984]: do_ifconfig, tt->ipv6=1, tt->did_ifconfig_ipv6_setup=0
Jan 31 03:46:36 james daemon.notice openvpn[8984]: /sbin/ifconfig tun1 10.8.0.6 pointopoint 10.8.0.5 mtu 1500
Jan 31 03:46:36 james daemon.notice openvpn[8984]: /sbin/route add -net 111.111.11.111 netmask 255.255.255.255 gw 11.111.111.11
Jan 31 03:46:36 james daemon.notice openvpn[8984]: /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw 10.8.0.5
Jan 31 03:46:36 james daemon.notice openvpn[8984]: /sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw 10.8.0.5
Jan 31 03:46:36 james daemon.notice openvpn[8984]: /sbin/route add -net 10.8.0.1 netmask 255.255.255.255 gw 10.8.0.5
Jan 31 03:46:36 james daemon.notice openvpn[8984]: Initialization Sequence Completed
Jan 31 03:47:05 james daemon.err openvpn[8984]: write UDPv4: Message too large (code=90)
Jan 31 03:47:05 james daemon.err openvpn[8984]: write UDPv4: Message too large (code=90)
Jan 31 03:47:05 james daemon.err openvpn[8984]: write UDPv4: Message too large (code=90)
Jan 31 03:47:07 james daemon.notice openvpn[8984]: NOTE: --mute triggered...

And here is OpenVPN server log:

Sat Jan 30 20:50:10 2016 OpenVPN 2.3.2 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Dec  1 2014
Sat Jan 30 20:50:10 2016 Diffie-Hellman initialized with 2048 bit key
Sat Jan 30 20:50:10 2016 Control Channel Authentication: using '/etc/openvpn/ta.key' as a OpenVPN static key file
Sat Jan 30 20:50:10 2016 Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Sat Jan 30 20:50:10 2016 Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Sat Jan 30 20:50:10 2016 Socket Buffers: R=[212992->131072] S=[212992->131072]
Sat Jan 30 20:50:10 2016 ROUTE_GATEWAY 111.111.11.111/255.255.255.192 IFACE=eth1 HWADDR=00:00:00:00:00:00
Sat Jan 30 20:50:10 2016 TUN/TAP device tun0 opened
Sat Jan 30 20:50:10 2016 TUN/TAP TX queue length set to 100
Sat Jan 30 20:50:10 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sat Jan 30 20:50:10 2016 /sbin/ip link set dev tun0 up mtu 1500
Sat Jan 30 20:50:10 2016 /sbin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2
Sat Jan 30 20:50:10 2016 /sbin/ip route add 10.8.0.0/24 via 10.8.0.2
Sun Jan 31 03:50:10 2016 chroot to 'jail' and cd to '/' succeeded
Sun Jan 31 03:50:10 2016 GID set to nogroup
Sun Jan 31 03:50:10 2016 UID set to nobody
Sun Jan 31 03:50:10 2016 UDPv4 link local (bound): [undef]
Sun Jan 31 03:50:10 2016 UDPv4 link remote: [undef]
Sun Jan 31 03:50:10 2016 MULTI: multi_init called, r=256 v=256
Sun Jan 31 03:50:10 2016 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Sun Jan 31 03:50:10 2016 ifconfig_pool_read(), in='dd-wrt,10.8.0.4', TODO: IPv6
Sun Jan 31 03:50:10 2016 succeeded -> ifconfig_pool_set()
Sun Jan 31 03:50:10 2016 IFCONFIG POOL LIST
Sun Jan 31 03:50:10 2016 dd-wrt,10.8.0.4
Sun Jan 31 03:50:10 2016 Initialization Sequence Completed

Any help would be greatly appreciated.

Thank you,
James

Traffic

The default cipher is Blowfish.

JamesD

Traffic wroteThe default cipher is Blowfish.

Thanks for the reply.

I figured it out. All I had to do was change verb 3 to verb 6, and now the logs are showing way more detail. The logs are now showing both the data and control channels as being encrypted.

During this struggle, I found out that my DD-WRT router is using OpenVPN 2.3.8 and my server is using 2.3.2. I have very little experience installing packages from source, so hopefully you can answer a few more questions for me.

For starters, is this the correct download location: https://openvpn.net/index.php/download/community-downloads.html

Does it matter which directory I download/install from? Can I create a directory called /etc/install and install it from that location?

According to the read me, all I have to do is extract file -> ./configure -> make -> make install.

Sorry for the noob questions, I just don't want to break anything.

Thanks again for all the help.

Cheers,
James

Traffic

JamesD wroteI have very little experience installing packages from source

Use your Linux distro package manager.