I've been able to remove some errors trying to configure Windows 10 OpenVPN client with a OpenVPN server running on Netgear Orbi LBR20. It seems this error comes up a fair amount of times, but I do not find a particular solution for resolving the issue. [b]The error: Wed Nov 17 21:39:20 2021 WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.[/b] Does anyone know how to get this error resolved? Is there a config command you need to add or is this issue with the Netgear implementation? OpenVPN client will not connect to the server. [b]Config file info:[/b] client dev tap proto udp dev-node NETGEAR-VPN remote ####blanked##### 12974 resolv-retry infinite nobind persist-key persist-tun ca ca.crt cert client.crt key client.key cipher AES-128-CBC comp-lzo verb 0 sndbuf 393216 rcvbuf 393216 route-method exe

You may check If port 12974 is allowed from your network or at least you can telnet(TCP) or PortQry(for TCP & UDP) to know If It's accessible. https://www.microsoft.com/en-us/download/details.aspx?id=17148 Would it be better also to share the full logs of your OpenVPN Client :) Regards, never-stop-learning

[quote=embossbj post_id=103241 time=1637203467 user_id=55422] WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set. [/quote]This is the Openvpn recommended setting and you should [u]not[/u] change it. [b]Details[/b]: [list]There is a cyber-attack called [url=https://community.openvpn.net/openvpn/wiki/VORACLE]VORACLE[/url], which captures up-stream packets that have been compressed and is able to extract data from those packets. The setting above mitigates the VORACLE attack by not sending any packets upstream that have been compressed. Only down stream compression is allowed, which is not susceptible to this attack.[/list]

[quote=M4rt1n85 post_id=120552 time=1707670729 user_id=61388] is it possible to remove the warning [/quote]Yes - Do [b]not[/b] use compression.

WARNING: Compression for receiving enabled

embossbj

I've been able to remove some errors trying to configure Windows 10 OpenVPN client with a OpenVPN server running on Netgear Orbi LBR20.

It seems this error comes up a fair amount of times, but I do not find a particular solution for resolving the issue.

The error:
Wed Nov 17 21:39:20 2021 WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.

Does anyone know how to get this error resolved? Is there a config command you need to add or is this issue with the Netgear implementation?

OpenVPN client will not connect to the server.

Config file info:
client
dev tap
proto udp
dev-node NETGEAR-VPN
remote ####blanked##### 12974
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
cipher AES-128-CBC
comp-lzo
verb 0
sndbuf 393216
rcvbuf 393216
route-method exe

never-stop-learning

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

TinCanTech

embossbj wrote WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.

This is the Openvpn recommended setting and you should not change it.

Details:

There is a cyber-attack called VORACLE, which captures up-stream packets that have been compressed and is able to extract data from those packets.

The setting above mitigates the VORACLE attack by not sending any packets upstream that have been compressed. Only down stream compression is allowed, which is not susceptible to this attack.

[deleted]

Hallo, is it possible to remove the warning since there is nothing to do (Sent packets are not compressed). It does confuse user.

TinCanTech

M4rt1n85 wrote is it possible to remove the warning

Yes - Do not use compression.

PetervdM

remove "comp-lzo" from the config file, preferably at both sides of the tunnel.

becm

But you will have to remove comp-lzo from server and all client configs!
Connecting may otherwise be impossible and a hard to diagnose issue (leads to incompatible packet formats I think).

Also, if the client can not connect to the server this is likely not the issue, just a hint to use a better setup.