OpenVPN server: cannot have access to lan with android client, but have access with windows client

Installing and Using OpenWrt
1

Hi... I have openvpn server running and I have access from my windows pc to local lan and internet, but recently I tried to connect from my android phone, and although i make connection to server, internet and local lan is not available.

My server config is this:

config openvpn 'Server'
        option dev 'tun'
        option comp_lzo 'no'
        option dh '/etc/openvpn/dh2048.pem'
        option keepalive '10 120'
        option key '/etc/openvpn/server.key'
        option cert '/etc/openvpn/server.crt'
        option verb '4'
        option ca '/etc/openvpn/ca.crt'
        option server '192.168.12.0 255.255.255.0'
        option enabled '1'
        option port '1194'
        option proto 'udp'
        option tls_server '1'
        option route_gateway 'dhcp'
        option mode 'server'
        option persist_tun '1'
        option persist_key '1'
        option client_to_client '1'
        option tls_auth '/etc/openvpn/tls-auth.key 0'
        list data_ciphers 'CHACHA20-POLY1305'
        list data_ciphers 'AES-128-GCM'
        list data_ciphers 'AES-256-CBC'
        option log '/var/log/openvpn.log'
        list push 'redirect-gateway def1'
        list push 'route 192.168.11.0 255.255.255.0'
        list push 'route 192.168.11.0 255.255.255.0'

my windows client config is this:

client
dev tun
windows-driver wintun #Windows 10/11 y OpenVPN 2.5.x
proto udp
remote 181.55.XXX.XX 1194
nobind
persist-key
persist-tun
key-direction 1
remote-cert-tls server
auth-nocache
comp-lzo no
verb 3
float
data-ciphers CHACHA20-POLY1305:AES-256-GCM:AES-128-GCM:AES-256-CBC
<ca>
ca
</ca>
<cert>
server cert
</cert>
<key>
server key
</key>
<tls-auth>
openvpn tls key
</tls-auth>

and my android client config is this (virtually the same):

client
dev tun
#windows-driver wintun #Windows 10/11 y OpenVPN 2.5.x
proto udp
remote 181.55.XXX.XX 1194
nobind
persist-key
persist-tun
key-direction 1
remote-cert-tls server
auth-nocache
comp-lzo no
verb 6
float
data-ciphers CHACHA20-POLY1305:AES-256-GCM:AES-128-GCM:AES-256-CBC
<ca>
ca
</ca>
<cert>
server cert
</cert>
<key>
server key
</key>
<tls-auth>
openvpn tls key
</tls-auth>
2

What does the log shows?

3

server log:

2025-01-05 08:07:14 us=789745 LFAMCB-MotoGLFA/191.156.57.XX:60189 PUSH: Received control message: 'PUSH_REQUEST'
2025-01-05 08:11:14 us=983753 LFAMCB-MotoGLFA/191.156.57.XX:60189 [LFAMCB-MotoGLFA] Inactivity timeout (--ping-restart), restarting
2025-01-05 08:11:14 us=984382 LFAMCB-MotoGLFA/191.156.57.XX:60189 SIGUSR1[soft,ping-restart] received, client-instance restarting
2025-01-05 08:13:08 us=932584 MULTI: multi_create_instance called
2025-01-05 08:13:08 us=933328 191.156.53.129:51759 Re-using SSL/TLS context
2025-01-05 08:13:08 us=934422 191.156.53.129:51759 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
2025-01-05 08:13:08 us=935047 191.156.53.129:51759 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
2025-01-05 08:13:08 us=936488 191.156.53.129:51759 Control Channel MTU parms [ L:1622 D:1184 EF:66 EB:0 ET:0 EL:3 ]
2025-01-05 08:13:08 us=937037 191.156.53.129:51759 Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 AF:14/122 ]
2025-01-05 08:13:08 us=937794 191.156.53.129:51759 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
2025-01-05 08:13:08 us=938282 191.156.53.129:51759 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
2025-01-05 08:13:08 us=938969 191.156.53.129:51759 TLS: Initial packet from [AF_INET]191.156.53.129:51759, sid=548ac354 c6ae91a7
2025-01-05 08:13:09 us=241607 191.156.53.129:51759 VERIFY OK: depth=1, CN=Server-CA
2025-01-05 08:13:09 us=245826 191.156.53.129:51759 VERIFY OK: depth=0, CN=Server-MotoG
2025-01-05 08:13:09 us=252806 191.156.53.129:51759 peer info: IV_VER=3.10.1
2025-01-05 08:13:09 us=253313 191.156.53.129:51759 peer info: IV_PLAT=android
2025-01-05 08:13:09 us=253814 191.156.53.129:51759 peer info: IV_NCP=2
2025-01-05 08:13:09 us=254318 191.156.53.129:51759 peer info: IV_TCPNL=1
2025-01-05 08:13:09 us=254823 191.156.53.129:51759 peer info: IV_PROTO=2974
2025-01-05 08:13:09 us=255331 191.156.53.129:51759 peer info: IV_MTU=1600
2025-01-05 08:13:09 us=255866 191.156.53.129:51759 peer info: IV_CIPHERS=AES-128-CBC:AES-192-CBC:AES-256-CBC:AES-128-GCM:AES-192-GCM:AES-256-GCM:CHACHA20-POLY1305
2025-01-05 08:13:09 us=256457 191.156.53.129:51759 peer info: IV_LZO=1
2025-01-05 08:13:09 us=256965 191.156.53.129:51759 peer info: IV_LZO_SWAP=1
2025-01-05 08:13:09 us=257470 191.156.53.129:51759 peer info: IV_LZ4=1
2025-01-05 08:13:09 us=258036 191.156.53.129:51759 peer info: IV_LZ4v2=1
2025-01-05 08:13:09 us=258550 191.156.53.129:51759 peer info: IV_COMP_STUB=1
2025-01-05 08:13:09 us=259058 191.156.53.129:51759 peer info: IV_COMP_STUBv2=1
2025-01-05 08:13:09 us=259567 191.156.53.129:51759 peer info: IV_AUTO_SESS=1
2025-01-05 08:13:09 us=260087 191.156.53.129:51759 peer info: IV_GUI_VER=net.openvpn.connect.android_3.5.1-10255
2025-01-05 08:13:09 us=260601 191.156.53.129:51759 peer info: IV_SSO=webauth,crtext
2025-01-05 08:13:09 us=261111 191.156.53.129:51759 peer info: IV_BS64DL=1
2025-01-05 08:13:09 us=292534 191.156.53.129:51759 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_CHACHA20_POLY1305_SHA256, peer certificate: 2048 bit RSA, signature: RSA-SHA256
2025-01-05 08:13:09 us=293166 191.156.53.129:51759 [Server-MotoG] Peer Connection Initiated with [AF_INET]191.156.53.129:51759
2025-01-05 08:13:09 us=293847 Server-MotoG/191.156.53.XXX:51759 MULTI_sva: pool returned IPv4=192.168.12.6, IPv6=(Not enabled)
2025-01-05 08:13:09 us=294996 Server-MotoG/191.156.53.XXX:51759 MULTI: Learn: 192.168.12.6 -> LFAMCB-MotoGLFA/191.156.53.129:51759
2025-01-05 08:13:09 us=295518 Server-MotoG/191.156.53.129:51759 MULTI: primary virtual IP for LFAMCB-MotoGLFA/191.156.53.129:51759: 192.168.12.6
2025-01-05 08:13:09 us=296124 Server-MotoG/191.156.53.129:51759 Data Channel: using negotiated cipher 'CHACHA20-POLY1305'
2025-01-05 08:13:09 us=296978 Server-MotoG/191.156.53.129:51759 Data Channel MTU parms [ L:1535 D:1450 EF:35 EB:406 ET:0 EL:3 AF:14/122 ]
2025-01-05 08:13:09 us=298896 Server-MotoG/191.156.53.129:51759 Outgoing Data Channel: Cipher 'CHACHA20-POLY1305' initialized with 256 bit key
2025-01-05 08:13:09 us=299634 Server-MotoG/191.156.53.129:51759 Incoming Data Channel: Cipher 'CHACHA20-POLY1305' initialized with 256 bit key
2025-01-05 08:13:09 us=300723 Server-MotoG/191.156.53.129:51759 SENT CONTROL [LFAMCB-MotoGLFA]: 'PUSH_REPLY,redirect-gateway def1,route 192.168.11.0 255.255.255.0,route 192.168.11.0 255.255.255.0,route 192.168.12.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 192.168.12.6 192.168.12.5,peer-id 0,cipher CHACHA20-POLY1305' (status=1)
2025-01-05 08:13:09 us=301609 Server-MotoG/191.156.53.129:51759 PUSH: Received control message: 'PUSH_REQUEST'
2025-01-05 08:13:27 us=167017 TLS Error: cannot locate HMAC in incoming packet from [AF_INET]162.142.125.91:63183
2025-01-05 08:16:21 us=402182 TLS Error: cannot locate HMAC in incoming packet from [AF_INET]206.168.34.161:52828
2025-01-05 08:17:10 us=6044 Server-MotoG/191.156.53.129:51759 [LFAMCB-MotoGLFA] Inactivity timeout (--ping-restart), restarting
2025-01-05 08:17:10 us=6558 Server-MotoG/191.156.53.129:51759 SIGUSR1[soft,ping-restart] received, client-instance restarting
4

Are you sure the tls-auth key is correct?

I would remove the tls-auth key altogether from clients and server and also remove: comp-lzo no

If you want to use a static key use tls-crypt easier better and faster

5

yes... openvpn connects on android client so tls-auth key is ok, because I understand that only is used at conection to secure channel.

I put "comp-lzo no" because of VORACLE, the vulnerability associated with encryption in VPN tunnel.

7

Hi... an update... added this line to server config enabled local and internet connection:

option topology 'subnet'
8

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.