Configuration Help - Tomato OpenVPN Server

blobby

Hi:
I am trying to set up a Linksys E1200 with Tomato (v1.28 by Shibby) as an OpenVPN server. I have the server up and running but the guides I found were not totally clear on how I should configure my client so I am hoping that someone here can point me in the right direction.

Here's my current non-working client config:
client
dev tun21
proto udp
remote 200.100.200.30 1194 udp
remote-cert-tls server
resolv-retry infinite
nobind
persist-key
persist-tun
verb 4
route 192.168.88.0 255.255.255.0
<ca>
-----BEGIN CERTIFICATE-----
<snip>
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
<snip>
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN ENCRYPTED PRIVATE KEY-----
<snip>
-----END ENCRYPTED PRIVATE KEY-----
</key> Here's the server.ovpn:
# Automatically generated configuration
daemon
server 10.8.0.0 255.255.255.0
proto udp
port 1194
dev tun21
keepalive 15 60
verb 3
push "route 192.168.17.0 255.255.255.0"
push "redirect-gateway def1"
ca ca.crt
dh dh.pem
cert server.crt
key server.key
status-version 2
status status

# Custom Configuration And here's what I'm seeing in the logs.

Apr 22 10:46:02 RT-c0562721fa12 daemon.err openvpn[18423]: 200.100.200.8:54634 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Apr 22 10:46:02 RT-c0562721fa12 daemon.err openvpn[18423]: 200.100.200.8:54634 TLS Error: TLS handshake failed
Apr 22 10:46:02 RT-c0562721fa12 daemon.notice openvpn[18423]: 200.100.200.8:54634 SIGUSR1[soft,tls-error] received, client-instance restarting
Apr 22 10:46:02 RT-c0562721fa12 daemon.notice openvpn[18423]: 200.100.200.8:39788 TLS: Initial packet from [AF_INET]200.100.200.8:39788, sid=25f34cdc 845845e3

I have tried various permutations of tls-auth in the client config, without success. Any advice would be much appreciated!

Thanks,
Blobby

blobby

I just noticed that there's a typo in what I posted (though I had corrected it on the server previously, so it's not the problem):
push "route 192.168.17.0 255.255.255.0" should be push "route 192.168.88.0 255.255.255.0"

Thanks,
Blobby

blobby

Would anyone be willing to share their working server & client configs? I'm pretty sure I could get this going with a working example.

Thanks,
Blobby

Traffic

blobby wroteI have tried various permutations of tls-auth in the client config

Why .. you are not using --tls-auth ?

blobby

Well, in the server logs there are TLS Error messages, and in the Tomato OpenVPN Server gui settings I have Authorization Mode set to TLS. So I assumed that the client would need to be using tls-auth.

Thanks,
Blobby

Traffic

blobby wroteSo I assumed ..

Better to read the HOWTO: For OpenVPN Community Edition than guess ..

blobby wrotethe client would need to be using tls-auth

Only if the server does .. which your posted server config does not ..

You may want to read about --tls-auth in The Manual v23x

Finally:

blobby wroteAny advice would be much appreciated
- Your log snippet is no help at all .. Please see the Forum rules (top of this page)

blobby

In case it can be of help to anyone, here's the client file I ended up with which works. Adding the cipher was the last issue I came across.

tls-client
client
dev tun
proto udp
remote xxx.xxx.xxx.xxx 1194 udp
remote-cert-tls server
resolv-retry infinite
nobind
persist-key
persist-tun
cipher AES-128-CBC

verb 4

route 192.168.1.0 255.255.255.0

redirect-gateway def1

#/home/user/openvpn/easy-rsa/easy-rsa3/pki/ca.crt
<ca>
-----BEGIN CERTIFICATE-----
<snip>
-----END CERTIFICATE-----
</ca>

#/home/user/openvpn/easy-rsa/easy-rsa3/pki/issued/CLIENTNAME.crt
# Bottom section only.
<cert>
-----BEGIN CERTIFICATE-----
<snip>
-----END CERTIFICATE-----
</cert>

#/home/user/openvpn/easy-rsa/easy-rsa3/pki/private/CLIENTNAME.key
<key>
-----BEGIN ENCRYPTED PRIVATE KEY-----
<snip>
-----END ENCRYPTED PRIVATE KEY-----
</key>

mummifiedclown

Thank you, blobby! I'm so glad you were able to get it working despite the rather condescending and pedantic response you received - your ovpn config example was just what I needed since yes, there are not a lot of good working examples out there of client configs for the current Tomato OpenVPN options. The only thing I found necessary to add - prompted by a very helpful log file message - is "float".

TinCanTech

mummifiedclown wrote I'm so glad you were able to get it working despite the rather condescending and pedantic response you received

At least a response was given by a volunteer .. far better than to be totally ignored :twisted:

mummifiedclown wrote The only thing I found necessary to add - prompted by a very helpful log file message - is "float".

Then you missed what was actually actually required .. :lol:

According to the OPs config files and the use of Linksys E1200 with Tomato (v1.28 by Shibby), which is not supported by this Forum but is supported by Linksys (although, from reading this Forum Not supported very well by Linksys), what was required is the use of --cipher AES-128-CBC