Trouble getting ovpn file to work on my router when it does work in this software...

450nick

Hi there,

I am currently living in Malaysia but and from the UK. I have set up a Pi VPN server back in the UK at my parents house to access their network and generated an .ovpn file shown below (I've removed the sensitive information and replaced with XXXX). I had a friend test the connection in Malaysia before I left the UK, and it worked no problem. I also used it with the Open VPN software both on my phone and laptop in the UK and on my return to Malaysia and it works very well.

My problem came when I tried to add it onto my Asus GT-AX11000 router so that I could channel a portion of my network onto this VPN connection. I've used it before with another VPN connection and it worked fine, but when I try it with this file, I get an error. When I put this ovpn file into the OpenVPN software I put in a password but no username. When I try it on the Asus router, it has a box for User and Password so I put my password in but leave the user box empty. Here is the system log from my router:

Jun 21 16:56:10 rc_service: httpd 1235:notify_rc stop_vpnc
Jun 21 16:56:33 rc_service: httpd 1235:notify_rc restart_vpnc
Jun 21 16:56:35 vpnclient5[10561]: Multiple --up scripts defined. The previously configured script is overridden.
Jun 21 16:56:35 vpnclient5[10561]: Multiple --down scripts defined. The previously configured script is overridden.
Jun 21 16:56:35 vpnclient5[10561]: Multiple --route-up scripts defined. The previously configured script is overridden.
Jun 21 16:56:35 vpnclient5[10561]: OpenVPN 2.4.7 arm-buildroot-linux-gnueabi [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Apr 30 2020
Jun 21 16:56:35 vpnclient5[10561]: library versions: OpenSSL 1.0.2u 20 Dec 2019, LZO 2.03
Jun 21 16:56:35 vpnclient5[10562]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Jun 21 16:56:35 vpnclient5[10562]: neither stdin nor stderr are a tty device and you have neither a controlling tty nor systemd - can't ask for 'Enter Private Key Password:'. If you used --daemon, you need to use --askpass to make passphrase-protected keys work, and you can not use --auth-nocache.
Jun 21 16:56:35 vpnclient5[10562]: Exiting due to fatal error

I don't get this error when I use OpenVPN, so it must ignore the problem. Is there anything I can do to modify the OVPN file to prevent this error occurring? if not then how must I re-generate the OVPN file such that it would work? I would like to avoid this as I'll have to explain it to someone over the phone!

Nick

Contents of OVPN file:

client
dev tun
proto tcp
remote XXXX 443
resolv-retry infinite
nobind
remote-cert-tls server
tls-version-min 1.2
verify-x509-name XXXX name
cipher AES-256-CBC
auth SHA256
auth-nocache
verb 3

-----BEGIN CERTIFICATE-----
XXXX
-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----
XXXX
-----END CERTIFICATE-----

-----BEGIN ENCRYPTED PRIVATE KEY-----
XXXX
-----END ENCRYPTED PRIVATE KEY-----

#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
XXXX
-----END OpenVPN Static key V1-----

TinCanTech

450nick wrote neither stdin nor stderr are a tty device and you have neither a controlling tty nor systemd - can't ask for 'Enter Private Key Password:'. If you used --daemon, you need to use --askpass to make passphrase-protected keys work, and you can not use --auth-nocache.

450nick wrote how must I re-generate the OVPN file such that it would work?

Do not password protect your key file.

450nick

Hi there, thanks for the response! A couple of questions:

1) When you highlighted --askpass, does this mean I should be using this in the OVPN file in place of auth-user-pass or auth-nocache? If so how is it called?

2) Is there a way to remove the password from this opvn file through deletion of something, or do I need to generate a new one?

Thanks!

450nick

Just sending a little bump! Hopefully an easy answer for those who know and can point me in the right direction..

TinCanTech

Use EasyRSA to remove the password from your key.

https://github.com/OpenVPN/easy-rsa

450nick

Thanks for the suggestion - what is EasyRSA meant to be run on? It doesn't look like a windows installer...??

450nick

Is it possible to remove a the password from the key in windows?

TinCanTech

See the EasyRSA release page.

TinCanTech

I presume you used EasyRSA2 which comes with openvpn for Windows ?

If so, EasyRSA v307 (For Windows) has an upgrade function to upgrade your PKI automatically. It would be nice to have that user tested ..

TinCanTech

Also see:
https://github.com/TinCanTech/easy-tls

450nick

Hi no I used PiVPN to generate on my my Pi4 VPN server but that's back in the UK and I have no access to it. I have only my windows PC and the OPVN file so need a method to remove the password protection from here if possible... ?

TinCanTech

You can try using openssl, the example command is here:
https://github.com/OpenVPN/easy-rsa/blob/e68faed0a3832028ed2e9999cd2013d9664bd067/easyrsa3/easyrsa#L1485

450nick

Sorry I'm really struggling to understand what to do with this... How do I go about running it?

TinCanTech

You do not need to remove the password if you use the file under Windows. You only need to remove it because your router does not like a password. So just use Windows...

There is only so much I can do for free..

450nick

Yeah I'm on my windows computer trying to remove the password from the ovpn file so I can upload it to my router and use it. I'm not sure how to remove the password using the page of code you posted... There's no download link, just some code... Do I save it as an exe file in notepad and run it or something?

TinCanTech

Try a search for "remove private key passphrase"