Issues receiving packets on Android Phone

[rossdargan]

I have openvpn AS installed on two VPS's (one at home, and one hosted). Both work great when accessed via a mac client, but only the home one works on my Android phone (I'm using the same client profile on both).

My ovpn file looks like this (I've removed all certs, and hidden the fqdn)

client
server-poll-timeout 4
nobind
remote fqdn.co.uk 1194 udp
remote fqdn.co.uk 1194 udp
remote fqdn.co.uk 1194 tcp
remote fqdn.co.uk 1194 udp
remote fqdn.co.uk 1194 udp
remote fqdn.co.uk 1194 udp
remote fqdn.co.uk 1194 udp
remote fqdn.co.uk 1194 udp
dev tun
dev-type tun
ns-cert-type server
reneg-sec 604800
sndbuf 100000
rcvbuf 100000
# NOTE: LZO commands are pushed by the Access Server at connect time.
# NOTE: The below line doesn't disable LZO.
comp-lzo no
verb 3
setenv PUSH_PEER_INFO

<ca>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
</ca>

<cert>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
</cert>

<key>
-----BEGIN PRIVATE KEY-----
...
-----END PRIVATE KEY-----
</key>

key-direction 1
<tls-auth>
#
# 2048 bit OpenVPN static key (Server Agent)
#
-----BEGIN OpenVPN Static key V1-----
...
-----END OpenVPN Static key V1-----
</tls-auth>

Now I have had a lot of issues with openvpn running on that server - it used to work great (admittedly on another android phone), but due to something changing (my VPS provider was saying it was a dist upgrade I had done months earlier, I was convinced it was an issue with the host... eventually they ran some command to fix it ("vzctl set 114 --devnodes net/tun:rw --capability net_admin:on --save"). Anyway whilst trying to get it fixed I uninstalled iptables, and openvpn and re-installed everything... but I don't really know what I'm doing so it's totally possible this is a silly thing I've missed.

Like I said at the start I can connect just fine with the mac. On Android I can connect fine, but no traffic appears to get routed (I never receive more than 2.8kb on the phone).

Any ideas?

[rossdargan]

I've noticed this in the log a lot - pretty sure this is probably the issue:

2016-04-07 09:44:45+0100 [-] OVPN 1 OUT: 'Thu Apr 7 08:44:45 2016 vpn_AUTOLOGIN/82.124.123.29:44565 Bad compression stub decompression header byte: 251'

[Traffic]

Bad compression stub

This is probably caused by --comp-lzo no .. try just --comp-lzo alone ..

[rossdargan]

Thanks!

I'm pretty new to linux so I'm not quite sure where I should change that (I'm guessing it's a parameter that is passed to the daemon when it's started?)

I suspect I might have to add it to /etc/default/openvpn here:

# Optional arguments to openvpn's command line
OPTARGS=""

Is that correct?

[rossdargan]

I've pulled this from the log that might also help:

SENT CONTROL [vpn_AUTOLOGIN]: 'PUSH_REPLY,explicit-exit-notify,topology subnet,route-delay 5 30,dhcp-pre-release,dhcp-renew,dhcp-release,route-metric 101,ping 12,ping-restart 50,compress snappy,redirect-gateway def1,redirect-gateway bypass-dhcp,redirect-gateway autolocal,route-gateway 5.5.8.1,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,register-dns,block-ipv6,peer-id 0,cipher BF-CBC,ifconfig 5.5.8.4 255.255.248.0' (status=1)

Could it be the compress snappy thing thats causing the problem?

[rossdargan]

I also found this in the log;

OVPN 1 OUT: 'Thu Apr 7 11:11:29 2016 81.144.193.79:49728 peer info: IV_SNAPPY=1'

OVPN 1 OUT: 'Thu Apr 7 11:11:29 2016 vpn_AUTOLOGIN/81.144.193.79:49728 Options error: bad comp option: snappy'


Looks like maybe the client supports snappy, but the server doesn't.

Looks like I'm running version 2.0.25 so I'm hoping an upgrade will fix it.

[rossdargan]

:/ It looks like that's the latest version for ubuntu: https://openvpn.net/index.php/access-se ... ily=Ubuntu.

Guess it's something else

[EDIT]

topic21247.html

Looks like I'm not the only one. Sorry for the duplicate post.

[rossdargan]

Rolling back to 2.0.0.24 Fixes this issue for me.

I'll stick with that for now as I'm so far out of my depth it's unreal!

[Traffic]

It is simple .. do not use snappy .. configure this:

Server configuration:

Code: Select all

comp-lzo no
push "comp-lzo no"

Client configuration:

Code: Select all

comp-lzo no

[rossdargan]

Happily... I just don't know where to put those settings! Is it in the server.conf and the client.conf files that I copied out from the samples?