Help with connection warnings please

christen

Hello everyone and a Happy New year to all!

I've just started using the OpenVPN on Windows to connect to an Asus router in order to access some files on my home network.

It's all been working great so far, happily connects and I can access my files. Only thing is that it keeps showing these warnings below, are these warnings anything to be concerned about?

WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.

Fri Dec 31 23:37:02 2021 DEPRECATED OPTION: --cipher set to 'AES-128-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM). Future OpenVPN version will ignore --cipher for cipher negotiations. Add 'AES-128-CBC' to --data-ciphers or change --cipher 'AES-128-CBC' to --data-ciphers-fallback 'AES-128-CBC' to silence this warning.

Fri Dec 31 23:37:05 2021 WARNING: --ns-cert-type is DEPRECATED. Use --remote-cert-tls instead.

Fri Dec 31 23:37:12 2021 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this.

As it connects and works without any problem, but I wasn't sure if I needed to resolve these or can leave them be.

Thank you in advance for any info regarding these.

TinCanTech

You will need to make some changes to your server. Do you use Openvpn Community Edition ?

christen

Hi TinCanTech,

Thank you for your reply.

I'm connecting to an OpenVPN server on a Asus RT-AC51U router, the settings listed below are available to be changed in router configuration for OpenVPN server.

Interface Type - TAP
Protocol - UDP
Server Port - 1194
Firewall- Auto
Autorization Mode - TLS
Username/Password Auth.Only - No
Extra HMAC authorization - Disable
Allocate from DHCP - Yes
Poll Interval - 0
Direct clients to redirect Internet traffic - No
Respond to DNS - No
Ecryption cipher - AES-128-CBC
Compression - Adaptive
TLS Renegotiation Time -1
Manage Client-Specific Options - No

Custom Configuration - (can enter a custom script here.)

Can I just ask is the VPN safe to use without making changes? As all is working okay connection wise. As will stop using it for the time being if not, until I can resolve the warnings.

Thank you again in advance for any help you can offer.

christen

I disabled compression in the Asus router settings and the compression warning below no longer shows now.

WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.

Also changed the encryption to AES-256-CBC but couldn't see AES-256-GCM as an option unfortunately, as thought if it were available then it might perhaps resolve the other warning regarding the deprecated option.

TinCanTech

christen wrote WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.

You should disable compression at your server and client.

christen wrote DEPRECATED OPTION: --cipher set to 'AES-128-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM). Future OpenVPN version will ignore --cipher for cipher negotiations. Add 'AES-128-CBC' to --data-ciphers or change --cipher 'AES-128-CBC' to --data-ciphers-fallback 'AES-128-CBC' to silence this warning

Update your router to the latest openvpn.

--data-ciphers replaces --cipher.

Your current cipher is safe.

christen wrote WARNING: --ns-cert-type is DEPRECATED. Use --remote-cert-tls instead

You may need to create a new server certificate for this but it is safe enough for now.

christen wrote WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this.

No need to worry about this.

christen wrote Can I just ask is the VPN safe to use without making changes?

Yes.

christen

Hi TinCanTech,

Just wanted to say thank you for your help with this. Been a real game changer being able to access my home network from anywhere, only wish I tried it sooner.

I had a look at updating the router to the latest Openvpn, but I think my router is EOL and there won't be any further firmware updates. I came across this Openvpn .net forum post below while browsing for info and I assume it's only Asus who can update it.

https://forums.openvpn.net/viewtopic.php?t=28173

In the meantime will look into going about disabling compression on the client, but again thank you for your help very much appreciate it.

christen

I had a look over the client config (hoping the use of Notepad was correct to view these files properly), in order to remove compression. Checked in &USERPROFILE&\OpenVPN\config\client

I also came across these OpenVPN .net forum posts below to help.

https://community.openvpn.net/openvpn/wiki/Compression

https://forums.openvpn.net/viewtopic.php?t=28097

"Update to OpenVPN 2.5 and remove comp-lzo and compress from ALL of your configuration files."

However I couldn't see a "comp-lzo" or "compress" line listed in my client config to remove unfortunately.

I wasn't sure if my router didn't generate this line or if I'm looking in the wrong place perhaps?

Or if the following was correct and the below line needed to be added in this scenario-

"If you have any difficulty then add allow-compression asym to your Client config Only."

so that-

Client use --allow-compression asym and --compress lz4
This will cause the Server to send compressed data but the Client will only send uncompressed data.

Thank you in advance for any further help.

TinCanTech

Just edit your server and client config and remove all compression settings.

Your server probably does not support asymmetric compression either.