OpenVPN Support Forum

I've been able to remove some errors trying to configure Windows 10 OpenVPN client with a OpenVPN server running on Netgear Orbi LBR20.

It seems this error comes up a fair amount of times, but I do not find a particular solution for resolving the issue.

The error:
Wed Nov 17 21:39:20 2021 WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.

Does anyone know how to get this error resolved? Is there a config command you need to add or is this issue with the Netgear implementation?

OpenVPN client will not connect to the server.

Config file info:
client
dev tap
proto udp
dev-node NETGEAR-VPN
remote ####blanked##### 12974
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
cipher AES-128-CBC
comp-lzo
verb 0
sndbuf 393216
rcvbuf 393216
route-method exe

embossbj wrote: ↑

Thu Nov 18, 2021 2:44 am

WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.

This is the Openvpn recommended setting and you should not change it.

Details:

• There is a cyber-attack called VORACLE, which captures up-stream packets that have been compressed and is able to extract data from those packets.
  
  The setting above mitigates the VORACLE attack by not sending any packets upstream that have been compressed. Only down stream compression is allowed, which is not susceptible to this attack.

Hallo, is it possible to remove the warning since there is nothing to do (Sent packets are not compressed). It does confuse user.

M4rt1n85 wrote: ↑

Sun Feb 11, 2024 4:58 pm

is it possible to remove the warning

Yes - Do not use compression.

remove "comp-lzo" from the config file, preferably at both sides of the tunnel.

But you will have to remove comp-lzo from server and all client configs!
Connecting may otherwise be impossible and a hard to diagnose issue (leads to incompatible packet formats I think).

Also, if the client can not connect to the server this is likely not the issue, just a hint to use a better setup.