[Solved] Trying to work with Synology...

Kptainflintt

Hello,

I post just to see if someone have same troubles.

The fact :

I've number of NAS on remote site. To securize syslog sends, I build an OpenVPN server with script from GitHub (https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwjw8rXt2uHuAhUk2-AKHdAUBL4QFjAAegQICRAC&url=https%3A%2F%2Fgithub.com%2Fangristan%2Fopenvpn-install&usg=AOvVaw1Z3bsr2GPKXoX6gDf2XvZd).

Everithing just working fine with Qnap NAS but Synology want's to do things like nobody so, "tls-crypt" isn't recognize by their systems.

I've tried lot of change, server side and client side with no success.

My question : is it possible to have both tls-crypt and tls-auth working?
If yes, how?

Server config :

port 1443
proto tcp
dev tun
user nobody
group nogroup
persist-key
persist-tun
keepalive 10 120
topology subnet
server some7_ip
ifconfig-pool-persist ipp.txt
dh none
ecdh-curve prime256v1
tls-crypt tls-crypt.key
crl-verify crl.pem
ca ca.crt
cert server_ODxBOdhR2kOHc7Mk.crt
key server_ODxBOdhR2kOHc7Mk.key
auth SHA256
cipher AES-128-GCM
ncp-ciphers AES-128-GCM
tls-server
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
client-config-dir /etc/openvpn/ccd
status /var/log/openvpn/status.log
verb 3
key-direction 0

Thanks!

TinCanTech

Kptainflintt wrote My question : is it possible to have both tls-crypt and tls-auth working?

There was some flexibility to using different TLS keys but it is not documented and I can't remember which were allowed.

If you really need something like that you probably need two servers. But you could try asking the developers on their mailing list or IRC.

Kptainflintt

Yes, or waiting to Synology for update their OpenVPN version!

Thank you

Pippin

Yes, or waiting to Synology for update their OpenVPN version!

Keep dreaming 😉

cbraxton

Synology does have the ability for you to use your own OpenVPN configuration. Here's a couple of links that I've used as a guide. The first is the most detailed but is in Dutch so if you don't speak that language you'll need to run it through something like Google Translate:

https://www.synology-forum.nl/vpn-server/beter-beveiligde-openvpn/
https://bpmsg.com/how-to-make-your-synology-disk-station-nas-more-secure/

Another approach would be to install Entware (the successor to Optware) on the Synology and set up OpenVPN the same way you would on any other Linux system. Looking at OpenVPN binary packages available for Entware it looks like it's currently at version 2.4.4. Not exactly the latest but possibly newer than what's in the Synology.

I've set up OpenVPN on Synology boxes using both of the above methods (their default setup is not very secure), but it's been a few years and I don't recall all the details.

Kptainflintt

Dreaming is my favorite hobby 😃

Kptainflintt

cbraxton wrote Synology does have the ability for you to use your own OpenVPN configuration. Here's a couple of links that I've used as a guide. The first is the most detailed but is in Dutch so if you don't speak that language you'll need to run it through something like Google Translate:

https://www.synology-forum.nl/vpn-server/beter-beveiligde-openvpn/
https://bpmsg.com/how-to-make-your-synology-disk-station-nas-more-secure/

Another approach would be to install Entware (the successor to Optware) on the Synology and set up OpenVPN the same way you would on any other Linux system. Looking at OpenVPN binary packages available for Entware it looks like it's currently at version 2.4.4. Not exactly the latest but possibly newer than what's in the Synology.

I've set up OpenVPN on Synology boxes using both of the above methods (their default setup is not very secure), but it's been a few years and I don't recall all the details.

Nice! I'll look at this ASAP!

Hope's back!

Pippin

That Dutch tutorial looks familiar...

Entware is currently on version 2.4.9:
https://github.com/Entware/Entware/blob/master/package/network/services/openvpn/Makefile

It's easier to use Easy Bootstrap Installer together with iPKGui:
https://www.cphub.net/?id=40&pid=920
https://www.cphub.net/?p=ipkgui

Can add cphub.net to Package Manager and see if your model is suppoerted.

Kptainflintt

Hi, thank you for all the responses
Just tried with Easy Bootstrap with IPKG, OpenVPn is on version 2.3.X so no tls-crypt...

Will try with Entware next

Kptainflintt

Up,

Installed Bootstrap witch Entware, IPKGui and package "openvpn-openssl".

But, when I launch :

openvpn --config myfile.ovpn

I get :

Options error: Unrecognized option or missing parameter(s) in /volume1/nexio/adv-com.ovpn:23: tls-crypt (2.3.17)

But, if i control openvpn version installed, it say 2.4.9-5...

So I think that I have to give a path in order to use the one I've install and not the one already available in Synology...

Pippin

Look in opt directory

Kptainflintt

Just one thing :

What I do :

1. Add cphub.net to Package Manager
2. Install Bootstrap Installer (with Entware) and IPKGui
3. Launch IPKGui and find openvpn-openssl package and mark to install
4. Waiting for install
5. Upload via SCP ovpn file on NAS
6. connect to nas via SSH and insert command

/opt/sbin/openvpn --config mysuperfile.ovpn

Everithing is working fine now.

Otherwise, personal thought, it's still crazy that a company like Synology doesn't do anything about it. On Qnap NAS, even old ones, the packages are still newer. Just put the file and voilà!

Thanks to all of you