Upgrade to OpenVPN 1.2.5 (iOS): issues

[danquel]

For those who want to roll back to v1.1.1, you don’t need to jailbreak your phone. You can accomplish the roll back with these steps. First of all you will need to download these tools:

iTunes 12.6.3 (the latest version of iTunes no longer has App Store so you will need install an older version):
http://osxdaily.com/2017/10/09/get-itun ... app-store/

Fiddler (to trick App Store to give you an older version of iPhone/iPad app):
https://www.telerik.com/fiddler

And follow this generic tutorial:
https://m.youtube.com/watch?v=LBNHia-lqs8

You will also need to disable auto update for apps in iPhone settings (Settings -> iTunes & App Store -> Updates -> toggle to OFF).

Good luck!

Has it worked for you? Can you send it to me? (danquel@hotmail.com) thank you, we are desperate

[oat_bondmen]

Given the absolute shambles surrounding this release and chronically bad response to it, what is the update on progress made to fix error 'OpenVPN profile not enabled' when multiple profiles are configured?

[oat_bondmen]

Has it worked for you? Can you send it to me? (danquel@hotmail.com) thank you, we are desperate

It won't work. The App is signed specific to an iTunes account. You need to pressure the amateurs at OpenVPN who released this hogwash of a release to fix their application. How this EVER made it past QA is absolutely beyond me (still no explanation on that either from OVPN).

[TinCanTech]

@oat_bondman

Please see this:
https://docs.openvpn.net/openvpn-connec ... os-issues/

Please note: Feed back with details about problems is very helpful, publicly insulting people is not.
Please don't make us ban you again ..

[danquel]

could you please put a link to ipa (openvpn 1.1.1) to install it manually or through our MDM and deactivating the automatic updates ?, we are desperate, thanks

I have opened internal tickets for them and we are working on fixing them as soon as possible. Unfortunately, AppStore does not allow us to easily rollback.

[mdeneen]

I also had a problem with the update to 1.2.5. Versions 1.2.4 (somehow on an iPad) and 1.1.1 worked fine. It would connect successfully but not pass traffic. This is a split-tunnel situation where not all traffic is destined for the tunnel.

I did a packet capture on the openvpn-2.4.4 server and noticed that no traffic, besides the periodic pings, was being sent between the client and server. I then did a ping from the server to the client and received responses. The tunnel was working, but I suspected that the routing table on the client was not correct.

I had to add:

Code: Select all

push "route 192.168.20.0 255.255.255.0"

to my server config. It appears as if the network as defined by the "server" directive is not being added to the routing table of the iOS device. Adding the manual route push fixed my problem.

Hopefully this is helpful to others.

[markymarrow]

My on-demand profiles created with Apple Configurator also stopped working. I cannot connect at all, not within the iPhone Settings and not within the OpenVPN Connect app. The flip switch just jumps back to disconnected. The log window is completely empty, and the server logs sees no traffic as well

Today I've gone from here to up and working again - adding the key 'vpn-on-demand' with the value 0 in the Custom Data section should allow you to attempt connection within the OpenVPN Connect app (without having to remove the on demand status of the mobileconfig). Doing it this way should give you some log info to work with.

Of note - I have user authentication set to Certificate but I have no certificates in the mobile config (as they end up in the ios keychain which OpenVPN can't get to anymore)
All my certificates & keys are bundled in the Custom data section & needed to be changed from:

Code: Select all

-----BEGIN PRIVATE KEY------
xxxxxxxxxxxxxx
xxxxxxxxxxxxxx
xxxxxxxxxxxxxx
-----END PRIVATE KEY-----

to

Code: Select all

-----BEGIN PRIVATE KEY------\nxxxxxxxxxxxxxx\n...\n-----END PRIVATE KEY-----

[nullbandit]

Iphone X and Iphone 8 Plus are showing off these logs. Hope these help.

Code: Select all

NetworkExtensionTUN/10.7.7.2/ gw=[/]
2018-01-10 15:28:52 TCP recv EOF
2018-01-10 15:28:52 Transport Error: Transport error on 'us.
*****.com: NETWORK_EOF_ERROR
2018-01-10 15:28:52 EVENT: TRANSPORT_ERROR Transport error on 'us.*******.com: NETWORK_EOF_ERROR [ERR]
2018-01-10 15:28:52 Client terminated, restarting in 5000 ms...
2018-01-10 15:28:52 Raw stats on disconnect:
  BYTES_IN : 5830650
  BYTES_OUT : 738494
  PACKETS_IN : 3719
  PACKETS_OUT : 4101
  TUN_BYTES_IN : 360113
  TUN_BYTES_OUT : 5327768
  TUN_PACKETS_IN : 4315
  TUN_PACKETS_OUT : 4807
  NETWORK_EOF_ERROR : 1
  TRANSPORT_ERROR : 1
  TCP_OVERFLOW : 200
  N_PAUSE : 36
  N_RECONNECT : 36
2018-01-10 15:28:52 Performance stats on disconnect:
  CPU usage (microseconds): 2331462
  Tunnel compression ratio (uplink): 2.05073
  Tunnel compression ratio (downlink): 1.09439
  Network bytes per CPU second: 2817607
  Tunnel bytes per CPU second: 2439619

[nullbandit]

If it helps anyone, here is one trick that helps me hold the connection for longer. In the openvpn ios APP, click on "connected" which opens up the log window. Now when I switch over the app (not force closing the app) to background my connection sticks for quite a long time. Somehow this works "only" when I set the "SSL Log Level" to 4 or 5 in the settings->openvpn

As soon as any push notifications are received the tunnel breaks without indicating anything in the logs. This has been consistent throughout.

Is there an ETA for the upgraded release with fixes ?

[iPhrankie]

We tried reinstalling an OpenVPN.ipa file we had via our MDM. Got stuck in a loop of Apple Store login and the app not installing. I imagine installing the app manually this way instead of it coming via the App store requires a dev login to authenticate the app installations. Just a guess.

[bearever]

For those who want to roll back to v1.1.1, you don’t need to jailbreak your phone. You can accomplish the roll back with these steps. First of all you will need to download these tools:

iTunes 12.6.3 (the latest version of iTunes no longer has App Store so you will need install an older version):
http://osxdaily.com/2017/10/09/get-itun ... app-store/

Fiddler (to trick App Store to give you an older version of iPhone/iPad app):
https://www.telerik.com/fiddler

And follow this generic tutorial:
https://m.youtube.com/watch?v=LBNHia-lqs8

You will also need to disable auto update for apps in iPhone settings (Settings -> iTunes & App Store -> Updates -> toggle to OFF).

Good luck!

Has it worked for you? Can you send it to me? (danquel@hotmail.com) thank you, we are desperate

The above method does work (FYI I rolled back my openvpn app to v1.1.1) but you need to follow the above youtube tutorial by yourself. I cannot share my ipa file with you as the app is tied to my iTunes account.

[asiaexplorer]

For those who want to roll back to v1.1.1, you don’t need to jailbreak your phone. You can accomplish the roll back with these steps. First of all you will need to download these tools:

iTunes 12.6.3 (the latest version of iTunes no longer has App Store so you will need install an older version):
http://osxdaily.com/2017/10/09/get-itun ... app-store/

Fiddler (to trick App Store to give you an older version of iPhone/iPad app):
https://www.telerik.com/fiddler

And follow this generic tutorial:
https://m.youtube.com/watch?v=LBNHia-lqs8

You will also need to disable auto update for apps in iPhone settings (Settings -> iTunes & App Store -> Updates -> toggle to OFF).

Good luck!

Has it worked for you? Can you send it to me? (danquel@hotmail.com) thank you, we are desperate

The above method does work (FYI I rolled back my openvpn app to v1.1.1) but you need to follow the above youtube tutorial by yourself. I cannot share my ipa file with you as the app is tied to my iTunes account.

I also can confirm that. It's working. Just rolled back to v1.1.1.

I followed the youtube link and the following tutorial: https://medium.com/@iosight/how-to-lega ... 45559b8357

The correct string for the version 1.1.1 is:

Code: Select all

819500456

With this information you can follow the tutorial from step 15. All steps above are only to find out the right string.

Of course you need the right iTunes version mentioned above to enter the app store and fiddler installed.

[diepvries]

Okay, the downgrade trick worked!

But this is not a perfect solution for us, we have about 20 users (worldwide) using the OpenVPN app. The app is now in my (older) iTunes but I can't just connect other iPhones to my computer and reinstall the older version because iTunes states that the other iPhone is on a different iCloud account... It would probably work if I logout my iTunes en login with the users iCloud account and do the trick once over but it would take a lot of time to do this, I got all my hope on version 1.2.6...

Is there going to be an update for this issue?

[dmq]

No, downgrade can't be the solution.

[PhC]

Hi all,

same problem here, with lots of users in many countries ... no way to get them following the above downgrade procedure.

Question to OpenVPN dev team : could we imagine to take the source code of version 1.1.1 (wich worked fine) and recompile it with version number 1.2.6 (or whatever above 1.2.5) then urgently push this "new" version to the App store, in order to have the client installing it and hopefully working again ?

Kind regards,
PhC.

[Flu0ki]

Has it worked for you? Can you send it to me? (danquel@hotmail.com) thank you, we are desperate

The above method does work (FYI I rolled back my openvpn app to v1.1.1) but you need to follow the above youtube tutorial by yourself. I cannot share my ipa file with you as the app is tied to my iTunes account.

I also can confirm that. It's working. Just rolled back to v1.1.1.

I followed the youtube link and the following tutorial: https://medium.com/@iosight/how-to-lega ... 45559b8357

The correct string for the version 1.1.1 is:

Code: Select all

819500456

With this information you can follow the tutorial from step 15. All steps above are only to find out the right string.

Of course you need the right iTunes version mentioned above to enter the app store and fiddler installed.

Thanks for the version number. This method works! IOS 11.2.2 iphone 6 (openvpn set 1.1.1) thanks again

[ordex]

Hi all,

same problem here, with lots of users in many countries ... no way to get them following the above downgrade procedure.

Question to OpenVPN dev team : could we imagine to take the source code of version 1.1.1 (wich worked fine) and recompile it with version number 1.2.6 (or whatever above 1.2.5) then urgently push this "new" version to the App store, in order to have the client installing it and hopefully working again ?

Kind regards,
PhC.

Sorry but this is not possible due to the requirements of the old App not supported by Apple anymore.

[ordex]

Hi all,

same problem here, with lots of users in many countries ... no way to get them following the above downgrade procedure.

Question to OpenVPN dev team : could we imagine to take the source code of version 1.1.1 (wich worked fine) and recompile it with version number 1.2.6 (or whatever above 1.2.5) then urgently push this "new" version to the App store, in order to have the client installing it and hopefully working again ?

Kind regards,
PhC.

Sorry but this is not possible due to the requirements of the old App not supported by Apple anymore.

What problem are you having exactly?

[diepvries]

I can connect the VPN and everything works but I cannot get my mails to work.
When I downgrade to a previous version everything works perfect!

[yankee77]

Greetings,

I just wanted to mention that if anyone is in a pinch using mobileconfig files to provision On Demand VPN, the workaround that seems to have helped me is to add the "CERT" and "KEY" strings into the mobileconfig file.

Just as an example, my mobileconfig file previously only had my encrypted certificate bundle and the "CA" cert for the OpenVPN vendor specific settings listed as a key and string value. I added the base64 encoded versions of the certificate and the private key the same way that I added the "CA" in the OpenVPN settings.

This allowed my mobileconfig file to provision and use VPN On-Demand as before.

So if you were to edit the mobileconfig directly you would add the following (note: I'm just using some random keystrokes to simulate the base64 string for illustration purposes) :

<key>cert</key>
<string>-----BEGIN CERTIFICATE-----\n
Mkkjslkjslkjsnenlkjsnnldkckjslknslks\n
kjkllksndnsljnsndslnsnklsflsknsfdlnsd\n
...
-----END CERTIFICATE-----\n
</string>

<key>key</key>
<string>-----BEGIN PRIVATE KEY-----\n
jkljafdljljlkjdaflksjlkjlkjslkjslkjensef\n
ljlkjdkjskjskjslkjslkjslkjsldjlkjsjlsljsd\n
...
-----END PRIVATE KEY -----\n
</string>

If you do this through Apple Configurator 2 it's easier, just add the Key and paste the value (as plain text) under "Custom Data" (do NOT forget to add the "\n" at the end of each new line)

I realize this won't be practical for everyone but if you are in a pinch it might help.

To the developers, I think all of us have struggled with this update to some degree but I don't want to forget that OpenVPN itself (and this app in particular) has been a blessing and very useful to me. I know you all are likely frustrated (as many of us are) but hey, we appreciate the software, we appreciate your work, and we appreciate you. Hang in there, we know you'll get it worked out.

I tried this initially, but couldn't get it to work. Do I need to change any of the other mobileconfig settings? For example, do I need to remove the P12 from the payload section? If so I get the error message in Configurator about missing credentials, but if I change the user authentication type to password, there is no option for On Demand. Thanks for your help