Eureka!
Aug 21 02:46:28 myvpn systemd[1]: Started OpenVPN connection to server.
Aug 21 02:46:28 myvpn ovpn-server[32352]: GID set to nogroup
Aug 21 02:46:28 myvpn ovpn-server[32352]: UID set to nobody
Aug 21 02:46:28 myvpn ovpn-server[32352]: UDPv4 link local (bound): [AF_INET]22.33.44.55:1194
Aug 21 02:46:28 myvpn ovpn-server[32352]: UDPv4 link remote: [undef]
Aug 21 02:46:28 myvpn ovpn-server[32352]: MULTI: multi_init called, r=256 v=256
Aug 21 02:46:28 myvpn ovpn-server[32352]: IFCONFIG POOL: base=10.8.0.2 size=252, ipv6=0
Aug 21 02:46:28 myvpn ovpn-server[32352]: IFCONFIG POOL LIST
Aug 21 02:46:28 myvpn ovpn-server[32352]: Initialization Sequence Completed
Aug 21 02:46:43 myvpn ovpn-server[32352]: 44.55.66.77:34663 TLS: Initial packet from [AF_INET]44.55.66.77:34663, sid=5c28c286 90da20da
Aug 21 02:46:46 myvpn ovpn-server[32352]: 44.55.66.77:34663 CRL CHECK OK: CN=ChangeMe
Aug 21 02:46:46 myvpn ovpn-server[32352]: 44.55.66.77:34663 VERIFY OK: depth=1, CN=ChangeMe
Aug 21 02:46:46 myvpn ovpn-server[32352]: 44.55.66.77:34663 CRL CHECK OK: CN=raven
Aug 21 02:46:46 myvpn ovpn-server[32352]: 44.55.66.77:34663 VERIFY OK: depth=0, CN=raven
Aug 21 02:46:46 myvpn ovpn-server[32352]: 44.55.66.77:34663 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1569', remote='link-mtu 1573'
Aug 21 02:46:46 myvpn ovpn-server[32352]: 44.55.66.77:34663 WARNING: 'mtu-dynamic' is present in remote config but missing in local config, remote='mtu-dynamic'
Aug 21 02:46:46 myvpn ovpn-server[32352]: 44.55.66.77:34663 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Aug 21 02:46:46 myvpn ovpn-server[32352]: 44.55.66.77:34663 Data Channel Encrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
Aug 21 02:46:46 myvpn ovpn-server[32352]: 44.55.66.77:34663 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Aug 21 02:46:46 myvpn ovpn-server[32352]: 44.55.66.77:34663 Data Channel Decrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
Aug 21 02:46:46 myvpn ovpn-server[32352]: 44.55.66.77:34663 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Aug 21 02:46:46 myvpn ovpn-server[32352]: 44.55.66.77:34663 [raven] Peer Connection Initiated with [AF_INET]44.55.66.77:34663
Aug 21 02:46:46 myvpn ovpn-server[32352]: raven/44.55.66.77:34663 MULTI_sva: pool returned IPv4=10.8.0.2, IPv6=(Not enabled)
Aug 21 02:46:46 myvpn ovpn-server[32352]: raven/44.55.66.77:34663 MULTI: Learn: 10.8.0.2 -> raven/44.55.66.77:34663
Aug 21 02:46:46 myvpn ovpn-server[32352]: raven/44.55.66.77:34663 MULTI: primary virtual IP for raven/44.55.66.77:34663: 10.8.0.2
Aug 21 02:46:49 myvpn ovpn-server[32352]: raven/44.55.66.77:34663 PUSH: Received control message: 'PUSH_REQUEST'
Aug 21 02:46:49 myvpn ovpn-server[32352]: raven/44.55.66.77:34663 send_push_reply(): safe_cap=940
Aug 21 02:46:49 myvpn ovpn-server[32352]: raven/44.55.66.77:34663 SENT CONTROL [raven]: 'PUSH_REPLY,dhcp-option DNS 80.68.80.24,dhcp-option DNS 80.68.80.25,redirect-gateway def1 bypass-dhcp,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.2 255.255.255.0' (status=1)
Eleven days after I set out to try and get this to work, god knows how many hours I've spent on it, how many litres of coffee I've drunk, how elaborately I have been turning the air blue with profanities - but it now works. And as usual with the most painful class of computer related problems, it all came down to one single line of code: namely the addition of
set_var EASYRSA_NS_SUPPORT yes
to easy-rsa's "vars" file before generating the server certfificate. Boom, Netscape extensions are now present:
X509v3 Extended Key Usage:
TLS Web Server Authentication
X509v3 Key Usage:
Digital Signature, Key Encipherment
Netscape Comment:
Easy-RSA Generated Certificate
Netscape Cert Type:
SSL Server
As weird as it is to see a name I associate mainly with the previous
century, and as p****d off as I am at Sierra for shipping crappy firmware, I'm just going to sit here for a little while and look at that "Connected" status on the RV50's admin UI, content with having beaten this thing into submission.
