Configuring OpenVPN Server on OpenWrt and accessing with Windows OpenVPN Client

Fperuso · December 30, 2019, 8:43pm

===============================

Hi everyone!

I'm noob user and would like to Setup OpenVPN in my router like a Server and connect with my router using one PC with OpenVPN GUI.

================================

Premises

OpenWrt 18.06.5 r7897-9d401013fc / LuCI openwrt-18.06 branch (git-19.309.48729-bc17ef6) on Linksys WRT32X
I used the documentation https://openwrt.org/docs/guide-user/services/vpn/openvpn/basic
In the Windows PC the OpenVPN GUI worked with the VPNBook
English is not my first language

Problem OpenVPN Client Side:

Mon Dec 30 17:36:55 2019 OpenVPN 2.4.8 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Oct 31 2019
Mon Dec 30 17:36:55 2019 Windows version 6.2 (Windows 8 or greater) 64bit
Mon Dec 30 17:36:55 2019 library versions: OpenSSL 1.1.0l  10 Sep 2019, LZO 2.10
Enter Management Password:
Mon Dec 30 17:36:55 2019 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Mon Dec 30 17:36:55 2019 Need hold release from management interface, waiting...
Mon Dec 30 17:36:55 2019 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Mon Dec 30 17:36:55 2019 MANAGEMENT: CMD 'state on'
Mon Dec 30 17:36:55 2019 MANAGEMENT: CMD 'log all on'
Mon Dec 30 17:36:55 2019 MANAGEMENT: CMD 'echo all on'
Mon Dec 30 17:36:55 2019 MANAGEMENT: CMD 'bytecount 5'
Mon Dec 30 17:36:55 2019 MANAGEMENT: CMD 'hold off'
Mon Dec 30 17:36:55 2019 MANAGEMENT: CMD 'hold release'
Mon Dec 30 17:37:07 2019 MANAGEMENT: CMD 'password [...]'
Mon Dec 30 17:37:07 2019 MANAGEMENT: Client disconnected
Mon Dec 30 17:37:07 2019 Insufficient key material or header text not found in file '[[INLINE]]' (0/128/256 bytes found/min/max)
Mon Dec 30 17:37:07 2019 Exiting due to fatal error

Doubts

How can I test if OpenVPN (Server Side ) is working fine?
How can I solve this problem in OpenVPN Client?

Thx!

ulmwind · December 30, 2019, 8:48pm

Please, provide your configuration files. It looks like your certificate doesn't possess necessary security for OpenVPN 2.4.8

Fperuso · December 30, 2019, 9:00pm

Sorry @ulmwind if I make stupid questions I know almost nothing about OpenVPN... setup I just follow the steps in the guidance... You talking about the "client.ovpn"?

Here you are!

verb 3
dev tun
nobind
client
remote XXX.XXX.XXX.XXX 1194 udp
auth-nocache
remote-cert-tls server
<tls-crypt>

</tls-crypt>
<ca>
-----BEGIN CERTIFICATE-----

MIIDITCC....

-----END CERTIFICATE-----
</ca>

<cert>
-----BEGIN CERTIFICATE-----

MIIDQDCCA....

-----END CERTIFICATE-----
</cert>

<key>
-----BEGIN ENCRYPTED PRIVATE KEY-----

MIIFDj......

-----END ENCRYPTED PRIVATE KEY-----
</key>

ulmwind · December 30, 2019, 10:39pm

Yes, and server's one. Check length of inline files.

Fperuso · December 30, 2019, 10:55pm

Server.conf

"

verb 3
user nobody
group nogroup
dev tun0
port 1194
proto udp
server 192.168.8.0 255.255.255.0
topology subnet
client-to-client
keepalive 10 120
persist-tun
persist-key
duplicate-cn
push "dhcp-option DNS 8.8.8.8"
push "redirect-gateway def1"
push "persist-tun"
push "persist-key"
<dh>
-----BEGIN DH PARAMETERS-----

MIIBCAK...

-----END DH PARAMETERS-----
</dh>
<tls-crypt>

</tls-crypt>
<ca>
-----BEGIN CERTIFICATE-----

MIIDITCC....

-----END CERTIFICATE-----
</ca>

<cert>
-----BEGIN CERTIFICATE-----

MIIDVz....
-----END CERTIFICATE-----
</cert>

<key>
-----BEGIN PRIVATE KEY-----

MIIEvgIBA...

-----END PRIVATE KEY-----
</key>

"

ulmwind · December 30, 2019, 10:56pm

Check length of inline files.

Fperuso · December 30, 2019, 10:58pm

Sorry, but what are the inline files? I'm a noob user...

ulmwind · December 30, 2019, 11:02pm

For client file:

copy contents between tags <ca> and </ca> to file ca.crt, place it in the same directory, where client.ovpn, include it by ca ca.crt
similar to other files, see result.

mk24 · December 30, 2019, 11:14pm

Yes it looks like the core of this problem is that something about the server certificates is garbled and unusable. I usually put them in files rather than inline in the config file.

Your client is configured with an encrypted private key, this requires the additional step to prompt the user for the passphrase needed to decrypt the key.

I would think you could have two instances of OpenVPN on a router one the server and one a client to see if you can at least auth with yourself.

Fperuso · December 30, 2019, 11:34pm

So I need to create 3 files in the same directory of client.ovpn:

ca ca.crt
cert client.crt
key client.key

Am I correct?

So now my new Client.ovpn is like this:

verb 3

dev tun

nobind

client

remote XXX.XXX.XXX.XXX 1194 udp

auth-nocache

remote-cert-tls server

ca ca.crt

cert client.crt

key client.key

I tryied but the result was:

Mon Dec 30 20:57:52 2019 OpenVPN 2.4.8 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Oct 31 2019
Mon Dec 30 20:57:52 2019 Windows version 6.2 (Windows 8 or greater) 64bit
Mon Dec 30 20:57:52 2019 library versions: OpenSSL 1.1.0l 10 Sep 2019, LZO 2.10
Enter Management Password:
Mon Dec 30 20:57:52 2019 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Mon Dec 30 20:57:52 2019 Need hold release from management interface, waiting...
Mon Dec 30 20:57:53 2019 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Mon Dec 30 20:57:53 2019 MANAGEMENT: CMD 'state on'
Mon Dec 30 20:57:53 2019 MANAGEMENT: CMD 'log all on'
Mon Dec 30 20:57:53 2019 MANAGEMENT: CMD 'echo all on'
Mon Dec 30 20:57:53 2019 MANAGEMENT: CMD 'bytecount 5'
Mon Dec 30 20:57:53 2019 MANAGEMENT: CMD 'hold off'
Mon Dec 30 20:57:53 2019 MANAGEMENT: CMD 'hold release'
Mon Dec 30 20:57:53 2019 MANAGEMENT: Client disconnected
Mon Dec 30 20:57:53 2019 Insufficient key material or header text not found in file '[[INLINE]]' (0/128/256 bytes found/min/max)
Mon Dec 30 20:57:53 2019 Exiting due to fatal error

One thing that I noticed is now is not asking the password...

Fperuso · December 30, 2019, 11:39pm

"I would think you could have two instances of OpenVPN on a router one the server and one a client to see if you can at least auth with yourself"

I don't know how can I do this yet, but I could try with your help...

mk24 · December 31, 2019, 1:19am

Put the full path to each certificate file on its line in the ovpn file.

Why is it still looking [INLINE] after you took the inline certs out? Are you sure it is running the config file you think it is? Make sure there are no stray files .conf in the openvpn directory because OpenVPN will try to parse them.

Fperuso · January 1, 2020, 12:05am

My Client.ovpn is this:

verb 3
dev tun
nobind
client
remote XXX.XXX.XXX.XXX 1194 udp
auth-nocache
remote-cert-tls server
<tls-crypt>

</tls-crypt>
ca ca.crt
cert client.crt
key client.key

And the files in the directory is this:

ulmwind · January 1, 2020, 5:15pm

Make separate file tls-crypt also (it looks like problem in it).

Fperuso · January 2, 2020, 11:03am

You are correct. I don't have this key... Is empty... How can I solve this?

ulmwind · January 2, 2020, 12:54pm

I don't know, try to generate manually from script:
OVPN_TC="$(sed -e "/^#/d;/^\w/N;s/\n//" ${OVPN_PKI}/tc.pem)"

Try also common method: openvpn --genkey --secret ta.key
It is for tls-auth, I haven't found example for tls-crypt, I think, it is the same.

Fperuso · January 2, 2020, 1:25pm

The correct path for this file is be in "/root/EasyRSA-v3.0.6/pki" or "/etc/easy-rsa/pki"? What's the difference?

So I get this key and put between the "<tls-crypt" "</tls-crypt" in Client.ovpn?

#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
9e221.....ec
-----END OpenVPN Static key V1-----
~

mk24 · January 2, 2020, 1:59pm

Yes it is stored like that. The generation phase produces a random key that needs to be loaded into the server and deployed to all the clients that use that server.

The TLS-crypt is an optional additional layer of encryption on top of everything else. If the server is configured not to use it, the client would not use it either.

Fperuso · January 2, 2020, 2:13pm

Which one?

"/root/EasyRSA-v3.0.6/pki" or "/etc/easy-rsa/pki"? In my case the script( https://openwrt.org/docs/guide-user/services/vpn/openvpn/basic) that I'm using used "/etc/easy-rsa/pki"

ulmwind · January 2, 2020, 7:12pm

Check filesystem of your router. Generate file manually, as it is written above.