How to disable comp-lzo and understand the logs?

pmcl77

Hi,

I am trying to disable comp-lzo on my openVPN connections, but somehow I can't get it to work, or I am not sure if it actually works, since the logs still talk about comp.

Here is my setup:

Server: OpenVPN 2.3.17 x86_64-pc-linux-gnu running on a synology NAS.
Clients: multiple clients, macbook, windows, other synology NAS.

Here I use openVPN Connect on my macbook (3.3.1 (4000))

Server config

push "route 10.11.12.0 255.255.255.0"
push "route 10.21.42.0 255.255.255.0"
comp-lzo no
dev tun
management 127.0.0.1 1195

client-to-client
client-config-dir ccd

server 10.11.12.0 255.255.255.0
topology subnet

dh       /usr/syno/etc/packages/VPNCenter/openvpn/keys/dh.pem
ca       /usr/syno/etc/packages/VPNCenter/openvpn/keys/ca.crt
cert     /usr/syno/etc/packages/VPNCenter/openvpn/keys/server.crt
key      /usr/syno/etc/packages/VPNCenter/openvpn/keys/server.key # This file should be kept secret
tls-auth /usr/syno/etc/packages/VPNCenter/openvpn/keys/ta.key 0 # This file is secret

max-clients 5
persist-tun
persist-key

verb 3
log-append /var/log/openvpn.log

keepalive 10 60
reneg-sec 0

plugin /var/packages/VPNCenter/target/lib/radiusplugin.so /var/packages/VPNCenter/target/etc/openvpn/radiusplugin.cnf
username-as-common-name
# duplicate-cn

status /tmp/ovpn_status_2_result 30
status-version 2
proto udp6
port 1194

cipher AES-256-CBC
auth SHA256

example of a client ccd file, trying to override clients that still might have comp-lzo set in their config.

ifconfig-push 10.11.12.10 255.255.255.0
push "comp-lzo no"

Client config (macbook)

client
dev tun
proto udp
remote <vpn_host> 1194

resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
comp-lzo no
auth-user-pass
key-direction 1
tls-version-min 1.2
cipher AES-256-CBC
auth SHA256

ca ca.crt
cert phil-macbook.crt
key phil-macbook.key

<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
...
-----END OpenVPN Static key V1-----
</tls-auth>

server logs


Thu Dec  9 10:37:00 2021 OpenVPN 2.3.11 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Sep 22 2021
Thu Dec  9 10:37:00 2021 library versions: OpenSSL 1.0.2u-fips  20 Dec 2019, LZO 2.09
Thu Dec  9 10:37:00 2021 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:1195
Thu Dec  9 10:37:00 2021 RADIUS-PLUGIN: Configfile name: /var/packages/VPNCenter/target/etc/openvpn/radiusplugin.cnf.
Thu Dec  9 10:37:00 2021 PLUGIN_INIT: POST /var/packages/VPNCenter/target/lib/radiusplugin.so '[/var/packages/VPNCenter/target/lib/radiusplugin.so] [/var/packages/VPNCenter/target/etc/openvpn/radiusplugin.cnf]' intercepted=PLUGIN_AUTH_USER_PASS_VERIFY|PLUGIN_CLIENT_CONNECT|PLUGIN_CLIENT_DISCONNECT
Thu Dec  9 10:37:00 2021 Diffie-Hellman initialized with 3072 bit key
Thu Dec  9 10:37:00 2021 Control Channel Authentication: using '/usr/syno/etc/packages/VPNCenter/openvpn/keys/ta.key' as a OpenVPN static key file
Thu Dec  9 10:37:00 2021 Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Thu Dec  9 10:37:00 2021 Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Thu Dec  9 10:37:00 2021 Socket Buffers: R=[212992->212992] S=[212992->212992]
Thu Dec  9 10:37:00 2021 TUN/TAP device tun0 opened
Thu Dec  9 10:37:00 2021 TUN/TAP TX queue length set to 100
Thu Dec  9 10:37:00 2021 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Dec  9 10:37:00 2021 /sbin/ifconfig tun0 10.11.12.1 netmask 255.255.255.0 mtu 1500 broadcast 10.11.12.255
Thu Dec  9 10:37:00 2021 UDPv6 link local (bound): [undef]
Thu Dec  9 10:37:00 2021 UDPv6 link remote: [undef]
Thu Dec  9 10:37:00 2021 MULTI: multi_init called, r=256 v=256
Thu Dec  9 10:37:00 2021 IFCONFIG POOL: base=10.11.12.2 size=252, ipv6=0
Thu Dec  9 10:37:00 2021 Initialization Sequence Completed
Thu Dec  9 10:37:48 2021 ::ffff:<clientip>(64315) TLS: Initial packet from [AF_INET6]::ffff:<clientip>:64315, sid=77286cbe 4d9898cb
Thu Dec  9 10:37:48 2021 ::ffff:<clientip>(64315) VERIFY OK: depth=1, CN=syno
Thu Dec  9 10:37:48 2021 ::ffff:<clientip>(64315) VERIFY OK: depth=0, CN=phil-macbook
Thu Dec  9 10:37:48 2021 RADIUS-PLUGIN: FOREGROUND THREAD: Auth_user_pass_verify thread started.
Thu Dec  9 10:37:48 2021 RADIUS-PLUGIN: FOREGROUND THREAD: New user.
Thu Dec  9 10:37:48 2021 RADIUS-PLUGIN: No attributes Acct Interim Interval or bad length.
Thu Dec  9 10:37:48 2021 RADIUS-PLUGIN: Client config file was not written, overwriteccfiles is false
.Thu Dec  9 10:37:48 2021 RADIUS-PLUGIN: FOREGROUND THREAD: Add user to map.
Thu Dec  9 10:37:48 2021 ::ffff:<clientip>(64315) PLUGIN_CALL: POST /var/packages/VPNCenter/target/lib/radiusplugin.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Thu Dec  9 10:37:48 2021 ::ffff:<clientip>(64315) TLS: Username/Password authentication succeeded for username 'phil-vpn' [CN SET]
Thu Dec  9 10:37:48 2021 ::ffff:<clientip>(64315) Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Thu Dec  9 10:37:48 2021 ::ffff:<clientip>(64315) Data Channel Encrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
Thu Dec  9 10:37:48 2021 ::ffff:<clientip>(64315) Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Thu Dec  9 10:37:48 2021 ::ffff:<clientip>(64315) Data Channel Decrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
Thu Dec  9 10:37:48 2021 ::ffff:<clientip>(64315) Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 3072 bit RSA
Thu Dec  9 10:37:48 2021 ::ffff:<clientip>(64315) [phil-vpn] Peer Connection Initiated with [AF_INET6]::ffff:<clientip>:64315
Thu Dec  9 10:37:48 2021 phil-vpn/::ffff:<clientip>(64315) OPTIONS IMPORT: reading client specific options from: ccd/phil-vpn
Thu Dec  9 10:37:48 2021 phil-vpn/::ffff:<clientip>(64315) PLUGIN_CALL: POST /var/packages/VPNCenter/target/lib/radiusplugin.so/PLUGIN_CLIENT_CONNECT status=0
Thu Dec  9 10:37:48 2021 phil-vpn/::ffff:<clientip>(64315) OPTIONS IMPORT: reading client specific options from: /tmp/openvpn_cc_6458975326c46e88538bb8a12525d714.tmp
Thu Dec  9 10:37:48 2021 phil-vpn/::ffff:<clientip>(64315) MULTI: Learn: 10.11.12.10 -> phil-vpn/::ffff:<clientip>(64315)
Thu Dec  9 10:37:48 2021 phil-vpn/::ffff:<clientip>(64315) MULTI: primary virtual IP for phil-vpn/::ffff:<clientip>(64315): 10.11.12.10
Thu Dec  9 10:37:48 2021 phil-vpn/::ffff:<clientip>(64315) PUSH: Received control message: 'PUSH_REQUEST'
Thu Dec  9 10:37:48 2021 phil-vpn/::ffff:<clientip>(64315) send_push_reply(): safe_cap=940
Thu Dec  9 10:37:48 2021 phil-vpn/::ffff:<clientip>(64315) SENT CONTROL [phil-vpn]: 'PUSH_REPLY,route 10.11.12.0 255.255.255.0,route 10.21.42.0 255.255.255.0,route-gateway 10.11.12.1,topology subnet,ping 10,ping-restart 60,comp-lzo no,ifconfig 10.11.12.10 255.255.255.0' (status=1)

client logs


⏎[Dec 9, 2021, 10:37:48] EVENT: RECONNECTING ⏎[Dec 9, 2021, 10:37:48] EVENT: RESOLVE ⏎[Dec 9, 2021, 10:37:48] Contacting <hostip>:1194 via UDP
⏎[Dec 9, 2021, 10:37:48] EVENT: WAIT ⏎[Dec 9, 2021, 10:37:48] UnixCommandAgent: transmitting bypass route to /var/run/agent_ovpnconnect.sock
{
	"host" : "<hostip>",
	"ipv6" : false,
	"pid" : 27580
}

⏎[Dec 9, 2021, 10:37:48] Connecting to [<hostname>]:1194 (<hostip>) via UDPv4
⏎[Dec 9, 2021, 10:37:48] EVENT: CONNECTING ⏎[Dec 9, 2021, 10:37:48] Tunnel Options:V4,dev-type tun,link-mtu 1570,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher AES-256-CBC,auth SHA256,keysize 256,tls-auth,key-method 2,tls-client
⏎[Dec 9, 2021, 10:37:48] Creds: Username/Password
⏎[Dec 9, 2021, 10:37:48] Peer Info:
IV_VER=3.git::d06e216e
IV_PLAT=mac
IV_NCP=2
IV_TCPNL=1
IV_PROTO=30
IV_CIPHERS=AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305:AES-256-CBC
IV_LZO_STUB=1
IV_COMP_STUB=1
IV_COMP_STUBv2=1
IV_GUI_VER=OCmacOS_3.3.1-4000
IV_SSO=openurl,crtext

⏎[Dec 9, 2021, 10:37:48] SSL Handshake: peer certificate: CN=server, 3072 bit RSA, cipher: DHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=DH       Au=RSA  Enc=AESGCM(256) Mac=AEAD

⏎[Dec 9, 2021, 10:37:48] Session is ACTIVE
⏎[Dec 9, 2021, 10:37:48] EVENT: GET_CONFIG ⏎[Dec 9, 2021, 10:37:48] Sending PUSH_REQUEST to server...
⏎[Dec 9, 2021, 10:37:48] OPTIONS:
0 [route] [10.11.12.0] [255.255.255.0]
1 [route] [10.21.42.0] [255.255.255.0]
2 [route-gateway] [10.11.12.1]
3 [topology] [subnet]
4 [ping] [10]
5 [ping-restart] [60]
6 [comp-lzo] [no]
7 [ifconfig] [10.11.12.10] [255.255.255.0]

⏎[Dec 9, 2021, 10:37:48] PROTOCOL OPTIONS:
  cipher: AES-256-CBC
  digest: SHA256
  key-derivation: OpenVPN PRF
  compress: LZO_STUB
  peer ID: -1
  control channel: tls-auth enabled
⏎[Dec 9, 2021, 10:37:48] TunPersist: short-term connection scope
⏎[Dec 9, 2021, 10:37:48] TunPersist: new tun context
⏎[Dec 9, 2021, 10:37:48] EVENT: ASSIGN_IP ⏎[Dec 9, 2021, 10:37:48] CAPTURED OPTIONS:
Session Name: <hostname>
Layer: OSI_LAYER_3
MTU: 1500
Remote Address: <hostip>
Tunnel Addresses:
  10.11.12.10/24 -> 10.11.12.1
Reroute Gateway: IPv4=0 IPv6=0 flags=[ IPv4 ]
Block IPv6: no
Add Routes:
  10.11.12.0/24
  10.21.42.0/24
Exclude Routes:
DNS Servers:
Search Domains:

⏎[Dec 9, 2021, 10:37:48] SetupClient: transmitting tun setup list to /var/run/agent_ovpnconnect.sock
{
	"config" :
	{
		"iface_name" : "",
		"layer" : "OSI_LAYER_3",
		"tun_prefix" : false
	},
	"pid" : 27580,
	"tun" :
	{
		"adapter_domain_suffix" : "",
		"add_routes" :
		[
			{
				"address" : "10.11.12.0",
				"gateway" : "",
				"ipv6" : false,
				"metric" : -1,
				"net30" : false,
				"prefix_length" : 24
			},
			{
				"address" : "10.21.42.0",
				"gateway" : "",
				"ipv6" : false,
				"metric" : -1,
				"net30" : false,
				"prefix_length" : 24
			}
		],
		"block_ipv6" : false,
		"layer" : 3,
		"mtu" : 1500,
		"remote_address" :
		{
			"address" : "<hostip>",
			"ipv6" : false
		},
		"reroute_gw" :
		{
			"flags" : 256,
			"ipv4" : false,
			"ipv6" : false
		},
		"route_metric_default" : -1,
		"session_name" : "<hostname>",
		"tunnel_address_index_ipv4" : 0,
		"tunnel_address_index_ipv6" : -1,
		"tunnel_addresses" :
		[
			{
				"address" : "10.11.12.10",
				"gateway" : "10.11.12.1",
				"ipv6" : false,
				"metric" : -1,
				"net30" : false,
				"prefix_length" : 24
			}
		]
	}
}
POST unix://[/var/run/agent_ovpnconnect.sock]/tun-setup : 200 OK
{
	"iface_name" : "utun2",
	"layer" : "OSI_LAYER_3",
	"tun_prefix" : true
}
/sbin/ifconfig utun2 down
/sbin/ifconfig utun2 10.11.12.10 10.11.12.1 netmask 255.255.255.0 mtu 1500 up
/sbin/route add -net 10.11.12.0 -netmask 255.255.255.0 10.11.12.10
add net 10.11.12.0: gateway 10.11.12.10
/sbin/route add -net 10.11.12.0 -netmask 255.255.255.0 10.11.12.1
route: writing to routing socket: File exists
add net 10.11.12.0: gateway 10.11.12.1: File exists
/sbin/route add -net 10.21.42.0 -netmask 255.255.255.0 10.11.12.1
add net 10.21.42.0: gateway 10.11.12.1
MacDNSAction: FLAGS=F RD=0 SO=5000 DNS= DOM= ADS=
open utun2 SUCCEEDED
⏎[Dec 9, 2021, 10:37:48] Connected via utun2
⏎[Dec 9, 2021, 10:37:48] LZO-ASYM init swap=0 asym=1
⏎[Dec 9, 2021, 10:37:48] Comp-stub init swap=0
⏎[Dec 9, 2021, 10:37:48] EVENT: CONNECTED phil-vpn@<hostname>:1194 (<hostip>) via /UDPv4 on utun2/10.11.12.10/ gw=[10.11.12.1/]⏎%

Appreciate any input on how to understand the logs and how not to use comp-lzo.

Thanks

TinCanTech

pmcl77 wrote Server: OpenVPN 2.3.17

Your server is ancient and no longer supported. Upgrade!

https://community.openvpn.net/openvpn/wiki/SupportedVersions

pmcl77

TinCanTech wrote Your server is ancient and no longer supported. Upgrade!

Well, it's what comes with Synology Package manager... but I guess I could override the installation manually, have to check.

TinCanTech

FYI: Add --comp-lzo no to your server config.

pmcl77

TinCanTech wrote FYI: Add --comp-lzo no to your server config.

I have, but do I need to prefix with a double-dash?

BTW: Once I will update my Synology to DSM 7, it will have 2.4.x. But I also found in other forums, that Synology updates the openVPN Server rarely. An option could be to run a docker container with the OpenVPN Server.

openvpn_inc

The double-dash "--" is for a command line option. It is not used inside a config file. I don't even know if that works.

I indeed would not want to trust an out-of-date server. As for docker, it would be better to use a physical or virtual machine behind (or on) the router.

regards, rob0

pmcl77

openvpn_inc wrote I indeed would not want to trust an out-of-date server. As for docker, it would be better to use a physical or virtual machine behind (or on) the router.

Thanks for the recommendations rob0. I will browse and consider different options.