Hi,
I setup openvpn server on my router running tomato firmware and I can't connect to it. One special thing about my setup is that the openvpn server is on my second router (192.168.10.1). I do have my first router(192.168.10.2) port forwarding the vpn server port to my second router. I don't think that is the issue because I am able to verify port is open and plus the error logs look like a connection is happening.
Server setup:
# Automatically generated configuration
daemon
server 10.8.0.0 255.255.255.0
proto tcp-server
port 1194
dev tun21
cipher AES-256-CBC
comp-lzo yes
keepalive 15 60
verb 3
push "route 192.168.10.0 255.255.255.0"
push "dhcp-option DOMAIN domainname.com"
push "dhcp-option DNS 192.168.10.1"
tls-auth static.key 0
ca ca.crt
dh dh.pem
cert server.crt
key server.key
status-version 2
status status
server error log:
Jan 21 00:25:09 sky daemon.notice openvpn[3684]: TCP connection established with [AF_INET6]::ffff:172.56.35.**:62992
Jan 21 00:25:10 sky daemon.notice openvpn[3684]: 172.56.35.41 TLS: Initial packet from [AF_INET6]::ffff:172.56.35.**:629
92, sid=38702f84 9282701b
Jan 21 00:25:11 sky daemon.err openvpn[3684]: 172.56.35.41 VERIFY ERROR: depth=1, error=certificate is not yet valid: C=
US, ST=NY, L=New York, O=DomainName, OU=vpn, CN=DomainName CA, name=server, emailAddress=vpn@domainname.com
Jan 21 00:25:11 sky daemon.err openvpn[3684]: 172.56.35.41 OpenSSL: error:14089086:lib(20):func(137):reason(134)
Jan 21 00:25:11 sky daemon.err openvpn[3684]: 172.56.35.41 TLS_ERROR: BIO read tls_read_plaintext error
Jan 21 00:25:11 sky daemon.err openvpn[3684]: 172.56.35.41 TLS Error: TLS object -> incoming plaintext read error
Jan 21 00:25:11 sky daemon.err openvpn[3684]: 172.56.35.41 TLS Error: TLS handshake failed
Jan 21 00:25:11 sky daemon.err openvpn[3684]: 172.56.35.41 Fatal TLS error (check_tls_errors_co), restarting
Jan 21 00:25:11 sky daemon.notice openvpn[3684]: 172.56.35.** SIGUSR1[soft,tls-error] received, client-instance restarti
ng
client config (android openvpn app):
# Enables connection to GUI
management /data/user/0/de.blinkt.openvpn/cache/mgmtsocket unix
management-client
management-query-passwords
management-hold
setenv IV_GUI_VER "de.blinkt.openvpn 0.6.73"
setenv IV_PLAT_VER "25 7.1.2 arm64-v8a google bullhead Nexus 5X"
machine-readable-output
allow-recursive-routing
ifconfig-nowarn
client
verb 4
connect-retry 2 300
resolv-retry 60
dev tun
remote domainname.com 1194 tcp-client
<ca>
-----BEGIN CERTIFICATE-----
edited out
-----END CERTIFICATE-----
</ca>
<key>
-----BEGIN PRIVATE KEY-----
edited out
-----END PRIVATE KEY-----
</key>
<cert>
-----BEGIN CERTIFICATE-----
edited out
-----END CERTIFICATE-----
</cert>
comp-lzo
<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
edited out
-----END OpenVPN Static key V1-----
</tls-auth>
key-direction 1
route-ipv6 ::/0
route 0.0.0.0 0.0.0.0 vpn_gateway
persist-tun
# persist-tun also enables pre resolving to avoid DNS resolve problem
preresolve
# Use system proxy setting
management-query-proxy
One possible issue is that I generated the keys with easy RSA which uses openssl 1.0.2g. While the android openvpn client uses openssl 1.1.0f. Is that my problem?
