all my .ovpn config that work properly with 3.3.4 in ios 16.6 & 16.7 is not working in openvpn 3.4.0 in ios

Official client software for OpenVPN Access Server and OpenVPN Cloud.
f1assistance
OpenVpn Newbie
Posts: 6
Joined: Fri Nov 17, 2023 11:59 am

Re: all my .ovpn config that work properly with 3.3.4 in ios 16.6 & 16.7 is not working in openvpn 3.4.0 in ios

Post by f1assistance » Fri Nov 17, 2023 1:12 pm

How can I or can I resolve this on the server?

EVENT: COMPRESSION_ENABLED Asymmetric compression enabled. Server may send compressed data. This may be a potential security issue.
Session invalidated: KEEPALIVE_TIMEOUT
Client terminated, restarting in 2000 ms...
EVENT: RECONNECTING
EVENT: RESOLVE

SomeGuy
OpenVPN Power User
Posts: 64
Joined: Sat Dec 17, 2016 1:58 am

Re: all my .ovpn config that work properly with 3.3.4 in ios 16.6 & 16.7 is not working in openvpn 3.4.0 in ios

Post by SomeGuy » Sat Nov 18, 2023 2:42 am

f1assistance wrote:
Fri Nov 17, 2023 1:12 pm
How can I or can I resolve this on the server?

EVENT: COMPRESSION_ENABLED Asymmetric compression enabled. Server may send compressed data. This may be a potential security issue.
Session invalidated: KEEPALIVE_TIMEOUT
Client terminated, restarting in 2000 ms...
EVENT: RECONNECTING
EVENT: RESOLVE
Several approaches.

First, try commenting out any mention of compression (on or off) in your *client* config. I found the iOS Connect VPN Client would lie and claim the server was pushing compression, when it was mis-attributing a client config to disable compression as the server trying to push compression.

Next, on the server config you can *try* to disable all of the compression related options, but from discussions read online, this was not enough for those that tested it, to have the server actually disable all compression. (I did not test or verify this.)

From those discussions a while back, rebuilding the server from source with "--disable-lzo --disable-lz4 --disable-comp-stub" (along with whatever configure flags/options you use which don't contradict those) were enough to truly disable compression on the server, so much that the server will not start if you mention any of those compression options in the server config, even to "turn off" compression. This approach made sense to me. I've been running my openvpn servers with compression disabled for many, many years, so why not?

If you go the route of rebuilding openvpn from source and use those flags, be ready to comment out any and all server config which mention compression, even if to disable. If your miss any, the next service start should log which options it does not like.

Some of what I found I documented here:
viewtopic.php?t=40505 (where I mentioned disabling dco was not a required step in my testing, but I was struggling to find what server pushed options might cause the iOS client to claim the server was pushing compression options; at the time I didn't know the client was making a false claim.)

I've tested with OpenVPN server 2.6.7 and 2.6.8 , and worked with an iOS OpenVPN Connect app using the source-code-built server.
(Also worked on Android, Mac OS, Linux, FreeBSD, Linux with 2.6.8)

Since these changes, my OpenVPN Connect iOS app can connect to my VPN server with the new (options ->Settings -> Advanced Settings -> "Preferred(Recommended)" instead of relying on "Legacy"

f1assistance
OpenVpn Newbie
Posts: 6
Joined: Fri Nov 17, 2023 11:59 am

Re: all my .ovpn config that work properly with 3.3.4 in ios 16.6 & 16.7 is not working in openvpn 3.4.0 in ios

Post by f1assistance » Mon Nov 20, 2023 11:36 pm

So yes, openVPN support had me [exclude] the 'compress' option in both the server and client configurations on the server https://imgur.com/a/DA0qR5l, download and re-deploy the new configuration file on all remote devices, everything worked as expected with 9 iPads, 2 Windows laptops, and 1 Chromebook. BAM! 8-) 8-) 8-)

Post Reply