Situation is windows server with Ubiquity Edgerouter X connecting as a client. Server error log, edgerouter has similar errors logged. [code]Wed Apr 10 10:02:19 2019 206.74.242.6:58768 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1560', remote='link-mtu 1552' Wed Apr 10 10:02:19 2019 206.74.242.6:58768 WARNING: 'cipher' is used inconsistently, local='cipher AES-256-CBC', remote='cipher AES-256-GCM' Wed Apr 10 10:02:19 2019 206.74.242.6:58768 WARNING: 'auth' is used inconsistently, local='auth SHA1', remote='auth [null-digest]'[/code] [b]MTU error; [/b] I'm not calling anything out in my config, but I haven't for ten other servers and I haven't noted this error before, one odd thing is the ERX GUI is showing the MTU for the VPN connection is 1500. [b]Cipher error;[/b] Both server and client config files show lines "cipher AES-256-CBC" where did GCM come from??? [b]Auth error;[/b] I'm using a ta.key and have done so on many other servers, again this baffles me as to why this is showing up as a problem here. Client config line tls-auth /config/auth/ta.key 1 server config line tls-auth "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\ta.key" 0

Need help with link-mtu, cipher, auth warnings in logs

maxburn

Situation is windows server with Ubiquity Edgerouter X connecting as a client.

Server error log, edgerouter has similar errors logged.

Wed Apr 10 10:02:19 2019 206.74.242.6:58768 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1560', remote='link-mtu 1552'
Wed Apr 10 10:02:19 2019 206.74.242.6:58768 WARNING: 'cipher' is used inconsistently, local='cipher AES-256-CBC', remote='cipher AES-256-GCM'
Wed Apr 10 10:02:19 2019 206.74.242.6:58768 WARNING: 'auth' is used inconsistently, local='auth SHA1', remote='auth [null-digest]'

MTU error;
I'm not calling anything out in my config, but I haven't for ten other servers and I haven't noted this error before, one odd thing is the ERX GUI is showing the MTU for the VPN connection is 1500.

Cipher error;
Both server and client config files show lines "cipher AES-256-CBC" where did GCM come from???

Auth error;
I'm using a ta.key and have done so on many other servers, again this baffles me as to why this is showing up as a problem here.

Client config line
tls-auth /config/auth/ta.key 1

server config line
tls-auth "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\ta.key" 0

maxburn

Client Config

# VPN type
client

# Connection setup
proto tcp-client
remote vpn.example.com 10005
nobind

# Encryption 
cipher AES-256-CBC
tls-client
remote-cert-eku "TLS Web Server Authentication"
# -Windows roadwarrior
;ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
;cert "C:\\Program Files\\OpenVPN\\config\\client#.crt"
;key "C:\\Program Files\\OpenVPN\\config\\client#.key"
# -Ubiquiti EdgeRouter
ca /config/auth/ca.crt
cert /config/auth/client1.crt
key /config/auth/client1.key

# Authentication
tls-auth /config/auth/ta.key 1

# Compression "compress" new standard, (not supported in edgerouter??)
# lz4 best performance, lzo backwards compatibility
;compress lz4
comp-lzo

# Network setup
dev tun

# Logging level
verb 3

server config

### This file compatible with topology SUBNET
### Remember to edit LAN addressing for server routing below, and client addressing in CCD files
### Server VPN IP is 10.8.0.1, bind to that IP.
### Set OpenVPN service to automatic startup (no delay) so that the IP will be there (with delayed start) asks.

### Connection info
proto tcp-server
port 1194
mode server
keepalive 10 120

### encryption info
tls-server
remote-cert-eku "TLS Web Client Authentication"
cipher AES-256-CBC
ca "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\server.crt"
key "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\server.key"
dh "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\dh4096.pem"

### authentication
tls-auth "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\ta.key" 0 # This file is secret

### Compression "compress" new standard, 
# lz4 best performance, lzo backwards compatibility
# Seems ER does not support new command or lz4
;compress lz4
comp-lzo

### Network 
# FYI; VPN DHCP server is on 10.8.0.254
# route gateway is 10.8.0.2
# server is on 10.8.0.1
# always avoid these addresses when addressing clients via CCD
dev tun
topology "subnet"
push "topology subnet"
server 10.8.0.0 255.255.255.0
# Push routes to connecting clients, they need to know how to route to other LANs
push "route 10.105.101.0 255.255.255.0"
push "route 10.105.102.0 255.255.255.0"
;push "route 10.105.103.0 255.255.255.0"
;push "route 10.105.104.0 255.255.255.0"
;push "route 10.105.105.0 255.255.255.0"
;push "route 10.105.106.0 255.255.255.0"
;push "route 10.105.107.0 255.255.255.0"
# Allow LAN routing between clients
client-to-client
# Allow the server to route traffic to client LANs
route 10.105.101.0 255.255.255.0
route 10.105.102.0 255.255.255.0
;route 10.105.103.0 255.255.255.0
;route 10.105.104.0 255.255.255.0
;route 10.105.105.0 255.255.255.0
;route 10.105.106.0 255.255.255.0
;route 10.105.107.0 255.255.255.0
# ovpn server pushes config info to clients from files in ccd dir. 
# Matches are based on CN in connecting key, so CN in key must match file name exactly. 
# Static VPN addressing and Client LAN routing is controlled in these files.
# client configuration directory (home is config dir, so rel path ok here)
client-config-dir ccd

### Logging
# OpenVPN log goes to C:\Program Files\OpenVPN\log\* whatever this ovpn file is named
# 0 is silent, except for fatal errors
# 3 default?
# 4 is reasonable for general usage
# 5 and 6 can help to debug connection problems
# 9 is extremely verbose
verb 3
# read this to see what clients are connected
status "C:\\Program Files\\OpenVPN\\log\\openvpn-status.log"

TinCanTech

maxburn wrote MTU error;
I'm not calling anything out in my config, but I haven't for ten other servers and I haven't noted this error before, one odd thing is the ERX GUI is showing the MTU for the VPN connection is 1500.

This is a known issue but it does not effect the VPN (at least should not)

maxburn wrote Cipher error;
Both server and client config files show lines "cipher AES-256-CBC" where did GCM come from???

This is a known issue but it does not effect the VPN (at least should not)

maxburn wrote Auth error;
I'm using a ta.key and have done so on many other servers, again this baffles me as to why this is showing up as a problem here.

This is a known issue but it does not effect the VPN (at least should not)

Note: Auth error refers to --auth not --tls-auth

maxburn

Understood, thank you.

Known issue for Ubiquiti or OpenVPN?

As a side note after comparing configs between this server and an older one and finding no difference I downgraded the Ubiquiti Edgerouter from 2.0.1 to 1.10.9 and the errors went away. Now that I look again the firmware 2.0.1 has been pulled from their download site, was there this morning when I started this though.

TinCanTech

maxburn wrote Known issue for Ubiquiti or OpenVPN?

Openvpn.

maxburn wrote As a side note after comparing configs between this server and an older one and finding no difference I downgraded the Ubiquiti Edgerouter from 2.0.1 to 1.10.9 and the errors went away. Now that I look again the firmware 2.0.1 has been pulled from their download site,

I cannot speak for Ubiquiti but I doubt these log errors are related to their issue.

Note: These issues should not effect the VPN, they are only incorrect log entries.
The reason they have not been fixed is because they are a very low priority.

maxburn

Thanks for your help!