OpenVPN #1: Beter beveiligen

[Pippin]

De developers proberen ervoor te zorgen dat "oude" instellingen blijven werken, dat is best nog een complex iets, dat compatibel blijven.
Er zal echter een moment komen waar dit niet meer lukt, of voor bepaalde functies niet meer.

Langzaam aan worden bepaalde opties verwijderd:
https://community.openvpn.net/openvpn/wiki/DeprecatedOptions

Er worden ook weer verbeterde en nieuwe opties toegevoegd.

[André PE1PQX]

We kunnen niet anders dan afwachten dus... (In april ga ik 11 dagen naar Gran Canaria, en een beetje beveiliging is wel prettig)

[Xmas]

Hello!
I've followed the guide in first page.
When I open OpenVPN GUI, I can connect to VPN (I see the green icon) and connect to NAS but in Synology VPNServer panel I find 0 client connected (as you can see in image attached).


Also, under VPN I can't visit other websites because I receive this error:
DNS_PROBE_FINISHED_BAD_CONFIG

When I created VPN with classic Synology official guide, I saw "1 client connected" in VPNServer panel and I could also visit other websites.

Is normal this difference?

Sorry for my bas English! I hope to be clear.

Thanks!

[cowstreet]

Het lukt me na toch een hele tijd zoeken niet om de verbinding op te zetten. Handleiding gevolgd en zowel via telefoon (android) als laptop (wifi hotspot) geprobeerd. Foutmeldingen zijn wel verschillend. In bijlage die van de laptop en van telefoon geeft telkens de melding:
TLS error: cannot locate HMAC in incoming packet from [AF_INET]IP: Poort

In router portforward aangezet, betreft router achter ziggo modem dat in bridge staat. Bij check via diverse websites wordt aangegeven dat poort nog steeds dichtstaat maar dat schijn niet betrouwbaar te zijn met UDP. Twijfel dus of dat het probleem is.

NAS geeft geen log info van mijn pogingen van zojuist.

Heeft er iemand suggesties hoe verder te gaan?

[cowstreet]

Ik weet niet wat er gebeurd is maar toen ik het vandaag nogmaals probeerde, zonder iets gewijzigd te hebben, werkte het wel! Opgelost dus.

[André PE1PQX]

Even ter info: VPN server heeft onlangs een update gehad naar 1.3.12-2780.
Helaas betekend dit ook dat de beveiligingsaanpassingen van dit topic bij deze update niet meer werken.
Of dit een BUG is weet ik zelf niet. Mijn ICT kennis schiet hierin te kort.

[GravityRZ]

mijn kennis ook.
voor de mensen die hier verstand van hebben
Normaliter verschijnt in de log de user die ik gebruik om in te loggen(extra security naast de certificaten)
na upgrade naar package 2780  werkt niets meer en verschijnt er user UNDEF in de log.

ook had ik na upgrade de melding dat eth0 niet beschikbaar was.
het selecteren van eth1 hielp niet en ook na terugswitchen werkte het niet.
na een reboot was die error melding weg maar ook dit kan er op duiden dat er toch iets ingrijpends veranderd is

wellicht is het dus een simpel probleem dat de user credentials niet worden doorgegeven aan openvpn

[jav231]

Hi,

I used this guide and have had a successful VPN connection and never had a problem until the recent update. I restored the package prior and i am back up and running. Not sure if anyone else has this issue, but when my clients are connected to the vpn they do not show under connected users. On the package vpn server>conected users, it only shows the clients connected up until a minute or so after thhat they are gone from the list, but the connect stays active until i close it. I saw online that if you had proto udp6 to the server conf file that will fix this error and show connected users. I did that and left the client config file as is and it works. The problem is that if i use that same account to login on my mac and iphone simultaneously, both connections timeout, disconnect and reconnect. I was hoping someone knows how to fix this issue the right way. So i am able to see what clients are connected to the vpn. Thank you all for this incredible guide!

[André PE1PQX]

@jav231 We had that issue also here. My post on April 4th (post #425) also warns for this.
this is also the reason I do not update the VPN package for now.

[jav231]

@ André PE1PQX

Hi,

The update just broke the whole connection, what i was referring too has been happening since i followed this guide from like 4 years ago or so. I figured being that the new update broke the connection and i restored to the package prior too, i figured i would mention to see if anyone knew how to fix the connected users issue.

Thanks!

[kmuehlemann]

Hi

I am new to this forum. I speak German and English (but unfortunately no Dutch).

I had installed an openVPN on my Synology DS1019+. It worked fine until the update at the beginning of April 2021. Since then I have been stuggling to get back on-line. I can successfully achieve this with the basic installation provided by Synology, but no longer with tls-authentication.

I tried multiple times to install openVPN again as I had done it before, and I always end up with the message "TLS Error: cannot locate HMAC in incoming packet from [AF_INET]xxx.xxx.xx.xx:1194 (where xxx.xxx.xx.xx is my current WAN-IP). I have of course analyzed the problem to the best of my ability, and I have googled the issue: No solution found.

When I was out of ideas, I tried this tutorial to get back on track (only deviation: I used the latest version of XCA). I generated all the certificates and keys and installed them. However, when I connect my client, I get the same error message once again.

Who out there had the same problem and solved it? Who has an idea for a systematic approach to track the problem down? I would really appreciate your support.

I am attaching my server (openvpn.conf.user.txt) and client (openvpn-client.ovpn.txt) files. I added the txt-extentions so that the forum accepts the upload.

Kind regards

Kurt

[Geerten]

@jav231:
How did you manage to roll back the VPN-server to a version prior to 30 march??
Is there a possibility to download these old version packages somewhere? Or should I have made a back-up somehow? I just installed the package from the package centre.

Since my knowledge and time for this is limited, until (if at all) this gets fixed by synology, I really would like to roll back the package. 

Thanks and kind regards,

Geerten

[GravityRZ]

you need to unistall the current package
then download the old package from this site

https://archive.synology.com/download/Package/VPNCenter/1.3.11-2777

after that restore the customized files or follow the complete manual again

[Geerten]

Super, thanks!!

It works again! I did not need to redo any of the configuration. During the removal of the package, just do not check the option to delete the database. After installing the old package again, and enabling the OpenVPN, all just runs like it always did. The only thing: the settings shown in the OpenVPN tab in the GUI are not correct (The GUI apparently does not update with the openvpn.conf.user file, but openVPN does use the file to override the settings in the GUI).

Thanks again for the help,

Geerten

[JosF]

Ik ben ook getroffen door deze VPN Server versie "upgrade".
Dat had ik 'n maand geleden gedaan en toen niet getest

Lesson learned: Don't fix what ain't broken (tenzij er een security update in zit)

Het terugrollen van de oude package was uiteindelijk makkelijk
(net zoals gemeld bij de vorige post, inclusief het melden door de VPN Server van
verkeerde data in de GUI,  in mijn geval had ik ooit een andere Poort geconfigureerd)