Hello everyone,
I had to update my ipfire and of course the openvpn to 2.4.5
Because of old keys and certs I had to renew all of it.
I choosed for the OpenVPN Server the following settings:
#OpenVPN Server conf
daemon openvpnserver
writepid /var/run/openvpn.pid
#DAN prepare OpenVPN for listening on blue and orange
;local **myhostname**
dev tun
proto udp
port 8098
script-security 3
ifconfig-pool-persist /var/ipfire/ovpn/ovpn-leases.db 3600
client-config-dir /var/ipfire/ovpn/ccd
tls-server
ca /var/ipfire/ovpn/ca/cacert.pem
cert /var/ipfire/ovpn/certs/servercert.pem
key /var/ipfire/ovpn/certs/serverkey.pem
dh /var/ipfire/ovpn/ca/dh1024.pem
server 10.16.253.128 255.255.255.128
tun-mtu 1500
push "route *"
push "route *"
push "route *"
route 10.16.253.0 255.255.255.192
route *
route 10.16.253.96 255.255.255.224
client-to-client
mssfix
fragment 1400
keepalive 10 60
status-version 1
status /var/run/ovpnserver.log 30
ncp-disable
cipher AES-256-GCM
auth SHA512
push "redirect-gateway def1"
push "dhcp-option DOMAIN company.local"
push "dhcp-option DNS IP"
max-clients 100
tls-verify /usr/lib/openvpn/verify
crl-verify /var/ipfire/ovpn/crls/cacrl.pem
user nobody
group nobody
persist-key
persist-tun
verb 1
All computer/notebook clients are working great with the openvpn client 2.4.6 and on macos Tunnelblick.
But my synology with the DSM 6.2.1 have some issues. There is the installed version 2.3.11 of openvpn. I figured out that synology does not know the cipher cipher AES-256-GCM.
#OpenVPN Client conf
tls-client
client
nobind
dev tun
proto udp
tun-mtu 1500
remote **myhostname** 8098
;ca cacert.pem
;cert backup.pem
;key backup.key
cipher AES-256-GCM
auth SHA512
verb 3
remote-cert-tls server
verify-x509-name ipfire.company.local name
mssfix
fragment 1400
So I changed the cipher for the synology client to: cipher AES-256-CBC
and added the lines to my server.conf
cipher AES-256-CBC
ncp-ciphers AES-256-GCM
But is working really unstable, I have many disconnects and long timeouts.
What can I do to get a stable connection? So I saw, I cannot update the openvpn on synolgy manually.
The logs on the openvpn server are showing often this lines:
Feb 21 11:29:28 ipfire openvpnserver[18152]: public-ip:port peer info: IV_VER=2.3.11
Feb 21 11:29:28 ipfire openvpnserver[18152]: public-ip:port peer info: IV_PLAT=linux
Feb 21 11:29:28 ipfire openvpnserver[18152]: public-ip:port peer info: IV_PROTO=2
Feb 21 11:29:28 ipfire openvpnserver[18152]: public-ip:port [synologybackup] Peer Connection Initiated with [AF_INET]public-ip:port
With best regards
sebbla
