Topic: OpenVPN Client for Hide.me

The content of this topic has been archived on 29 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Page 1 of 1

Post #1

ravenlost2

9 Feb 2017, 18:31

Hello ! Im trying to setup OpenVPN on a OpenWRT/DGN3500 router to use as a client vpn to connect to Hideme.

I followed a tutorial entitled "OpenVPN with OpenWrt" on the Hide.me community forum exactly as is (community.hide.me/tutorials/openvpn-with-openwrt.38/), but it just doesn't work and I don't get any error in my log.

If anyone would be so kind to give me a hand to try and find out what's going on ??

My respective config files....

/etc/config/openvpn:

root@OpenWrt:~# ls -la /etc/config/openvpn
-rw-r--r--    1 root     root           402 Feb  9 16:04 /etc/config/openvpn

root@OpenWrt:~# cat /etc/config/openvpn
## PROY ADDED
config openvpn 'Hide_me'
    option dev 'tun314'
    option proto 'udp'
    option dev_type 'tun'
    option nobind '1'
    option client '1'
    option reneg_sec '0'
    option remote 'nl.hide.me'
    option persist_tun '1'
    option persist_key '1'
    option port '3478'
    option verb '3'
    option ca '/etc/openvpn/Hideme.cert.pem'
    list auth_user_pass '/etc/openvpn/Hideme.login.auth'
    option cipher 'AES-128-CBC'

Certificate:

root@OpenWrt:~# ls -la /etc/openvpn/Hideme.cert.pem
-rw-r--r--    1 root     root          1338 Feb  9 16:43 /etc/openvpn/Hideme.cert.pem

root@OpenWrt:~# cat /etc/openvpn/Hideme.cert.pem
-----BEGIN CERTIFICATE-----
MIIDrzCCApegAwIBAgIQCDvgVpBCRrGhdWrJWZHHSjANBgkqhkiG9w0BAQUFADBh
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD
QTAeFw0wNjExMTAwMDAwMDBaFw0zMTExMTAwMDAwMDBaMGExCzAJBgNVBAYTAlVT
MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j
b20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IENBMIIBIjANBgkqhkiG
9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4jvhEXLeqKTTo1eqUKKPC3eQyaKl7hLOllsB
CSDMAZOnTjC3U/dDxGkAV53ijSLdhwZAAIEJzs4bg7/fzTtxRuLWZscFs3YnFo97
nh6Vfe63SKMI2tavegw5BmV/Sl0fvBf4q77uKNd0f3p4mVmFaG5cIzJLv07A6Fpt
43C/dxC//AH2hdmoRBBYMql1GNXRor5H4idq9Joz+EkIYIvUX7Q6hL+hqkpMfT7P
T19sdl6gSzeRntwi5m3OFBqOasv+zbMUZBfHWymeMr/y7vrTC0LUq7dBMtoM1O/4
gdW7jVg/tRvoSSiicNoxBN33shbyTApOB6jtSj1etX+jkMOvJwIDAQABo2MwYTAO
BgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUA95QNVbR
TLtm8KPiGxvDl7I90VUwHwYDVR0jBBgwFoAUA95QNVbRTLtm8KPiGxvDl7I90VUw
DQYJKoZIhvcNAQEFBQADggEBAMucN6pIExIK+t1EnE9SsPTfrgT1eXkIoyQY/Esr
hMAtudXH/vTBH1jLuG2cenTnmCmrEbXjcKChzUyImZOMkXDiqw8cvpOp/2PV5Adg
06O/nVsJ8dWO41P0jmP6P6fbtGbfYmbW0W5BjfIttep3Sp+dWOIrWcBAI+0tKIJF
PnlUkiaY4IBIqDfv8NZ5YBberOgOzW6sRBc4L0na4UU+Krk2U886UAb3LujEV0ls
YSEY1QSteDwsOoBrp+uvFRTp2InBuThs4pFsiv9kuXclVzDAGySj4dzp30d8tbQk
CAUw7C29C79Fv1C5qfPrmAESrciIxpg0X40KPMbp1ZWVbd4=
-----END CERTIFICATE-----

User authentification file :

root@OpenWrt:~# ls -la /etc/openvpn/Hideme.login.auth
-rw-r--r--    1 root     root            19 Feb  9 15:13 /etc/openvpn/Hideme.login.auth

root@OpenWrt:~# cat /etc/openvpn/Hideme.login.auth
USERNAME
PASSWORD

Network Configs:

root@OpenWrt:~# ls -la /etc/config/network
-rw-r--r--    1 root     root          1086 Feb  9 15:53 /etc/config/network

root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
    option ifname 'lo'
    option proto 'static'
    option ipaddr '127.0.0.1'
    option netmask '255.0.0.0'

config globals 'globals'
    option ula_prefix 'fdbf:da22:9d3e::/48'

config interface 'lan'
    option force_link '1'
    option type 'bridge'
    option proto 'static'
    option ipaddr '192.168.1.1'
    option netmask '255.255.255.0'
    option ip6assign '60'
    option ifname 'eth0.1'
    option dns '208.67.220.220 208.67.222.222'

config switch
    option name 'switch0'
    option reset '1'
    option enable_vlan '1'

config switch_vlan
    option device 'switch0'
    option vlan '1'
    option ports '3 2 1 0 5t'

config atm-bridge 'atm'
    option encaps 'llc'
    option payload 'bridged'
    option vci '35'
    option vpi '8'

config interface 'wan'
    option ifname 'nas0'
    option proto 'pppoe'
    option ipv6 '1'
    option username 'INET_USERNAME'
    option password 'INET_PASSWORD'

config interface 'wan6'
    option ifname '@wan'
    option proto 'dhcpv6'

config adsl 'dsl'
    option annex 'mm'
    option firmware '/lib/firmware/adsl.bin'

config interface 'Hide_me'
    option proto 'none'
    option ifname 'tun314'

Firewall Configs:

root@OpenWrt:~# ls -la /etc/config/firewall
-rw-r--r--    1 root     root          3585 Feb  9 16:08 /etc/config/firewall

root@OpenWrt:~# tail -n 8 /etc/config/firewall
config zone
    option name 'hide_me'
    option input 'REJECT'
    option output 'ACCEPT'
    option forward 'REJECT'
    option masq '1'
    option mtu_fix '1'
    option network 'Hide_me'

So, when I hit the "Start" in the Hide_me VPN instance in Luci, it just does nothing. Keeping an eye on 'logread -f' in my console doesn't show me any errors either. And just to make sure, I've also tried by first turning off the firewall with '/etc/init.d/firewall stop'; and still, nothing. I would of thought I would of had an interface named "tun***" in my ifconfig output, but nada!

I also tried putting in logging configs in my openvpn config as follows, but the log file wont even get created!

option log         /var/log/openvpn.log                               
option log_append  /var/log/openvpn.log                               
option verb 9

After running '/etc/init.d/openvpn start', I get no errors, nothing, and 'ps | grep openvpn' doesnt show openvpn running... Im very confused here. This is what I had previously installed :

root@OpenWrt:~# opkg list-installed | grep openvpn
luci-app-openvpn - git-16.018.33482-3201903-1
openvpn-easy-rsa - 2013-01-30-2
openvpn-openssl - 2.3.6-5

Any help with this would be very much appreciated!! Thanks a lot.

Regards, Pat

(Last edited by ravenlost2 on 9 Feb 2017, 18:33)

Post #2

RangerZ

9 Feb 2017, 19:40

I have not looked at the link, but believe that there should be more than just a zone configured in your firewall.

Post #3

ravenlost2

9 Feb 2017, 21:54

RangerZ wrote:

I have not looked at the link, but believe that there should be more than just a zone configured in your firewall.

But then again, I tried turning off the FW completely and still it wouldnt work... So I doubt that's the problem ?

Post #4

ulmwind

9 Feb 2017, 22:12

option enabled '1'

Why 'list' instead of 'option' with auth file?
But initially I recommend you to run openvpn from command line directly with natural config file, not with uci-based config. You can also see my manual concerning airvpn: https://airvpn.org/topic/20303-airvpn-c … de-tunnel/

(Last edited by ulmwind on 9 Feb 2017, 22:14)

Post #5

Bluenote

10 Feb 2017, 00:53

ulmwind wrote:

option enabled '1'
Why 'list' instead of 'option' with auth file?
But initially I recommend you to run openvpn from command line directly with natural config file, not with uci-based config. You can also see my manual concerning airvpn: https://airvpn.org/topic/20303-airvpn-c … de-tunnel/

Sorry to hijack! That is a fairly indepth guide. Could you comment on how I might go about forwarding DSCP (let's say DSCP 9, I can't remember what I'm using) tagged traffic to tun0 , if openvpn is not set up to pull a default route. ie; not all traffic goes through the openvpn, only certain DSCP tags? Even some pointers would be good because I am stuck right now.
thanks

Post #6

marktomlinson32

10 Feb 2017, 06:39

Ravenlost2 i also run hide.me tunnels from mt openwrt router with none of these issues you are showing.,
and i followed their guide with no issue.

so from what you are saying the openvpn process is not even showing that it is attempting to run.. failure or not.?
silly question.. but it is enabled yeah? when installing mine you have to enable and start it..

also i see you have renamed the trustedroot.pem to another name with two full stops in the filename.. again probably nothing but i am using trustedroot.pem and login.auth and i have no issues.

what i am trying to do is run two hide.me connections from my router.. one to america and one to amsterdam.. and route specific machine on my internal network through the desired routes.
if you need any help pm me and i will share my setup info etc..

Post #7

marktomlinson32

10 Feb 2017, 06:40

also in a shell session when you start openvpn run logread -f then try and start your tunnel..
see what ( if anything ) you get in the log then.

Post #8

webtron

10 Feb 2017, 08:54

For testing purposes change the verb '3' to verb '9' in /etc/config/openvpn and add a log file to see whats happening.

    option verb '9'
    option log '/tmp/openvpn.log'

Post #9

ravenlost2

12 Feb 2017, 16:46

It seems I had a few things wrong. Not sure if this changed anything, but I started of by renaming my "Hideme.login.auth" and "Hideme.cert.pem" so they would only a single dot in the names. Then I added the option enabled '1' (which I was sure I had tried before), and a few other renames to make it more clear (i.e. renamed the FW zone "hide_me" to "vpn", etc).

All that being said, everything started BUT I now kept getting an AUTH_FAILED in my log. I contacted the hide.me website about it, and it seems they are telling me I'm trying to connect using a protocol you normaly need to pay for... Their msgs :

Hello,
it seems that you are trying to connect your device using a protocol reserved for our Plus and Premium members only. You can choose a different protocol in the "Step 2" of the easy setup. I would recommend that you try IKEv1, IKEv2, SSTP or PPTP native client.
Let me know if this helps.

They tell me this, eventhough they didn't write on their tutorial that is was for paying customers (

That's a real freakin bummer !

Apparently, you can use their free service if you use IPSec IVEk2.. This brings me to my next question and I dont know if I should start a new post or continu on this one. Think I'll start a new one, since I can't find a simple ipsec / openwrt tutorial for a client connection.. I've been trying to follow this guide from the VPN service hideme : community.hide.me/tutorials/ipsec-ikev2-with-strongswan-non-gui-method.43/ but so far, no luck....

The discussion might have continued from here.

Page 1 of 1