all my .ovpn config that work properly with 3.3.4 in ios 16.6 & 16.7 is not working in openvpn 3.4.0 in ios

pooyam61

all my .ovpn config that work properly with 3.3.4 in ios 16.6 & 16.7 is not working in openvpn 3.4.0 in ios and iphone even changing security level and try all option in tls version , please add openvpn legacy or earlier version like 3.3.4 or 3.3.3 in apple store all user have problem and various error in new version 3.4.0 , please help us in ios there is no coming back to install older version like android

openvpn_inc

Hello pooyam61,

I would highly recommend that you look at the logs and let us know what these unsupported config options are.

If these are options that don't belong there, you can just remove them, and get things working again.

Kind regards,
Johan

sardari

I have the same problem
iOS 16.6, 16.7 users can no longer connect since they updated to open vpn version 3.4.0.
This means that they connect to the server, but they cannot even see their gateway, and their access to the Internet is completely cut off
Please help me friends

FabioCD

Hello,
I installed a OpenVPN server but I cannot connect my iPhone with the OpenVPN Server. I don't know why because I can connect with my Android smartphone but not with the iPhone. Maybe I made something wrong on iPhone. I use this OpenVPN conncet with Macbook Pro and iMac without any kind of problems.
Please someone can help me?
Thanks.
FabioCD

vental74

Have anyonetried connect your vpn server with turned Wi-Fi on your iphone? I have same situation, but i noticed that with wi-fi all works correctly

pooyam61

after check log and remove the line

tun-mtu-extra 32

in my .ovpn config file and set the security level to
Insecure(not recommended)

my conetion connect in iphone with openvpn 3.4.0 version
it is all about tls version 1.1 that remove from config i think
just have tls1 , tls 1.2 and tls 1.3 in setting so you can not choose tls 1.1 in any option setting , please rollback all tls version and options in next vesrion for ios

pooyam61

my tcp config now is :

client
dev tun
proto tcp
remote xxx.xxx.xxx.xxx 84
resolv-retry infinite
nobind
tun-mtu 1500
mssfix 1450
persist-key
persist-tun
auth-user-pass
comp-lzo
verb 3

[deleted]

Had to remove "tun-mtu-extra 32" here too.

While I understand this may be a useless parameter on iOS, many of us have carefully crafted our ovpn files to work optimally on various platforms. For OpenVPN Connect on iOS to suddenly break this one-size-fits-all ovpn file is, well, not cool. IMHO they should've left it at a warning in the log and not a fatal error.

I know it's just one line. But it's one line times X server profiles, times N other users that need hand-holding, etc. This small change can cause quite the headache.

If this was pre-announced somewhere, someone please point me where to look so I can subscribe to such notices.

513g3

I have the symptoms that match @sardari.

I do not have the "tun-mtu-extra" option. I also do not have the "unsupported option" log line.

I get "Session Invalidated: KEEPALIVE_TIMEOUT" and then "EVENT: RECONNECTING".

Same .opvn setting as I have had for years. Now on iOS 17 and OpenVPN Connect 3.4.0.

I can connect successfully but then no traffic flows and then about 20 seconds later the timeout hits.

ihf

I have the same problem and I cannot find which of my options is unsupported.
client
dev tun
proto udp
explicit-exit-notify
;verify-x509-name "C=NA, ST=NA, L=NA, O=NA, OU=NA, CN=Appliance_Certificate_x, emailAddress=na@example.com"
;route remote_host 255.255.255.255 net_gateway
resolv-retry infinite
nobind
persist-key
persist-tun
auth-user-pass
cipher AES-128-CBC
auth SHA256
comp-lzo no
;can_save no
;otp no
;run_logon_script no
;auto_connect
route-delay 4
verb 3
reneg-sec 86400
remote x.org 8443

mindsgrid

Actual Issue: IOS Client removed options which are not related to IOS client VPN connection

Fix: You need to remove unsupported options from your .ovpn file

Solution Steps:

1) Open OPenVPN client
2) click notepad like sign on top right corner in top menu bar
3) It will show logs, you can view or also export it by pressing email like icon on top right menu bar
4) Find options which are creating issues

you will get logs like this

Oct 21, 2023, 16:18:25 - NOTE: This configuration contains options that were not used:
Oct 21, 2023, 16:18:25 - Removed deprecated option
Oct 21, 2023, 16:18:25 - 3 [ncp-disable]
Oct 21, 2023, 16:18:25 - EVENT: CORE_THREAD_ERROR option_error: sorry, unsupported options present in configuration: Removed deprecated option [ERR]

one line before last error line shown, parameter which is shown in that line, you need to remove that parameter from your .ovpn file and profile again. here in this case that parameter is ncp-disable

Hopefully this will fix this issue, if vpn connection was working ok but after update to new ios version it stopped working.

Thanks

diegongi

Hello, I have the same problem. .ovpn files works in every version with 3.3.4 in an ipad but when I try them in the 3.4 version I keep the timeout connection error. Here I leave my the config of the .ovpn file, thanks for the help:

client
resolv-retry 20
keepalive 2 10
nobind
mute-replay-warnings
remote-cert-tls server
compress
verb 1
persist-key
persist-tun
explicit-exit-notify 1
dev tun
proto udp
port 1194
cipher AES-128-CBC

ihf

In my case, reviewing the log showed that the unsupported option was “route-delay 4” which does not appear to be in your list. Check the log and see which, if any, options are causing the problem.

militarymedic

same problem as others have noticed. When looking at the log though, only area that says anything about unsupported is for the word 'client' and the next line just says ignored.
Pretty much mirroring the scenario that 513g3 mentioned above.
Seems like this version is more or less unusable for us at the moment...

luca.bottini@bettinelli.it

Hi everyone,
after updating the app to version 3.4.0
with ios 17 users are able to connect to the server but are unable to access internal services, not even the gateway can be reached.
From Win and Android no problem.
There is no warning in the app logs while on the Pfsense firewall "Bad compression stub (swap) decompression header byte: 250"
Can someone help me?
Thank you
Luca Bottini

marcoeva

Hello,
I have the same problem with the new OpenVPN version 3.4.0. The same connection was working fine with OpenVPN version 3.3.4, but it does not work with 3.4.0.
The issue appears with the new iOS 16.6.1 and iOS 15.8. I cannot access internal services or I cannot ping my VPN IP or gateway IP.

Thanks,
Marco

militarymedic

I had chatted with OVPN support on this and we narrowed my scenario down to compression. They are not supporting compression in 3.4.x moving forward.
I had to uncheck the line item on BOTH the server and client end. I'm using Untangle/Arista for an appliance and this setting affects all openvpn connections. I didn't see a way to isolate just ios devices.

marcoeva

I solved the problem by removing compression from the server and client.
Thanks for the support!

openvpn_inc

Hello,

Just want to add my voice to removing compression from another angle; security. Ever since the Voracle vulnerability was found and published it was clear that compression and encryption combined has a security flaw. So compression is on the way out and should be removed or turned off for sure. Just thought that would help for future readers. If you want to learn more about Voracle, you can read up on it online.

Kind regards,
Johan

Anonymous4Ever

Hi all, my .ovpn client profile is:

client
dev tun
proto tcp
remote serverVPN.domain.com 443
verify-x509-name "C=com, L=City, O=Organization, CN=serverVPN, emailAddress=emailaddress@domain.com"
route remote_host 255.255.255.255 net_gateway
resolv-retry infinite
nobind
;persist-key
;persist-tun
auth-user-pass
cipher AES-128-CBC
auth MD5
comp-lzo no
route-delay 4
verb 3
reneg-sec 86400
<ca>
Certificate:
...
...
...

With this configuration the error is:

CONNECTION FAILED - There was an error attempting to connect the selected server.
Error message: option_error: sorry, unsupported options present in configuration: UNKNOWN/SUPPORTED OPTIONS
Please refer to connection logs for more details.

___________________________________________________________________

In the log I found the options that give the error, so I commented them out (route-delay 4), after that the error changes to:

CONNECTION TIMEOUT
Connection failed to establish within given time

In the log:

[Nov 01, 2023, 17:19:10] Sending Peer Info:
IV_VER=3.8.2connect1
IV_PLAT=ios
IV_NCP=2
IV_TCPNL=1
IV_PROTO=990
IV_MTU=1600
IV_CIPHERS=AES-128-CBC:AES-192-CBC:AES-256-CBC:AES-128-GCM:AES-192-GCM:AES-256-GCM:CHACHA20-POLY1305
IV_LZO=1
IV_LZO_SWAP=1
IV_LZ4=1
IV_LZ4v2=1
IV_COMP_STUB=1
IV_COMP_STUBv2=1
IV_GUI_VER=net.openvpn.connect.ios_3.4.0-5457
IV_SSO=webauth,openurl,crtext

[Nov 01, 2023, 17:19:10] VERIFY OK: depth=1, /C=com/L=City/O=Organization/CN=Common Name/emailAddress=emailaddress@domain.com, signature: RSA-SHA256
[Nov 01, 2023, 17:19:10] VERIFY OK: depth=1, /C=com/L=City/O=Organization/CN=Common Name/emailAddress=emailaddress@domain.com, signature: RSA-SHA256
[Nov 01, 2023, 17:19:10] SSL Handshake: peer certificate: CN=ServerVPN, 2048 bit RSA, cipher: DHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=DH Au=RSA Enc=AESGCM(256) Mac=AEAD

[Nov 01, 2023, 17:19:10] Session is ACTIVE
[Nov 01, 2023, 17:19:10] EVENT: GET_CONFIG
[Nov 01, 2023, 17:19:10] Sending PUSH_REQUEST to server...
[Nov 01, 2023, 17:19:10] OPTIONS:
0 [route] [remote_host] [255.255.255.255] [net_gateway]
1 [route-gateway] [10.110.8.4]
2 [route-gateway] [10.110.8.4]
3 [topology] [subnet]
4 [ping] [10]
5 [ping-restart] [120]
9 [route] [172.16.27.0] [255.255.255.0]
20 [dhcp-option] [DNS] [IP Server DNS 1]
21 [dhcp-option] [DNS] [IP Server DNS 2]
22 [dhcp-option] [DOMAIN] [domain.com]
23 [ifconfig] ["Pool address VPN"] [255.255.255.0]

[Nov 01, 2023, 17:19:10] PROTOCOL OPTIONS:
cipher: AES-128-CBC
digest: MD5
key-derivation: OpenVPN PRF
compress: ANY
peer ID: -1

[Nov 01, 2023, 17:19:10] EVENT: ASSIGN_IP
[Nov 01, 2023, 17:19:10] NIP: preparing TUN network settings
[Nov 01, 2023, 17:19:10] NIP: init TUN network settings with endpoint: serverVPN.domain.com
[Nov 01, 2023, 17:19:10] NIP: adding IPv4 address to network settings 10.110.8.100/255.255.255.0
[Nov 01, 2023, 17:19:10] NIP: adding (included) IPv4 route "Pool address VPN"
[Nov 01, 2023, 17:19:10] NIP: adding DNS "IP Server DNS 1"
[Nov 01, 2023, 17:19:10] NIP: adding DNS "IP Server DNS 2"
[Nov 01, 2023, 17:19:10] NIP: adding match domain domain.com
[Nov 01, 2023, 17:19:10] NIP: allowFamily(AF_INET, 1)
[Nov 01, 2023, 17:19:10] NIP: allowFamily(AF_INET6, 1)
[Nov 01, 2023, 17:19:10] NIP: adding DNS specific routes:
[Nov 01, 2023, 17:19:10] NIP: adding (included) IPv4 route "IP Server DNS 1"/32
[Nov 01, 2023, 17:19:10] NIP: adding (included) IPv4 route "IP Server DNS 2"/32
[Nov 01, 2023, 17:19:10] Connected via NetworkExtensionTUN
[Nov 01, 2023, 17:19:10] Client exception in transport_recv: crypto_alg: MD5: bad digest for data channel use
[Nov 01, 2023, 17:19:10] Client terminated, restarting in 2000 ms...
[Nov 01, 2023, 17:19:12] EVENT: RECONNECTING

[Nov 01, 2023, 17:19:12] EVENT: RESOLVE
[Nov 01, 2023, 17:19:12] Contacting "Public IP address":443 via TCP
[Nov 01, 2023, 17:19:12] EVENT: WAIT
[Nov 01, 2023, 17:19:12] Connecting to [serverVPN.domain.com]:443 (serverVPN.domain.com) via TCP
[Nov 01, 2023, 17:19:12] EVENT: CONNECTING
[Nov 01, 2023, 17:19:12] Tunnel Options:V4,dev-type tun,link-mtu 1556,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher AES-128-CBC,auth MD5,keysize 128,key-method 2,tls-client
[Nov 01, 2023, 17:19:12] Creds: Username/Password

___________________________________________________________________

and repeats connection attempts N times until it times out

What could be the error?

Thanks 1000 for any help.