OpenVPN 2.5

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Advanced Networking
Goto page 1, 2  Next
Author Message
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 6983
Location: Netherlands

PostPosted: Tue Oct 20, 2020 7:47    Post subject: OpenVPN 2.5 Reply with quote
Open VPN 2.5

OpenVPN 2.5 is here in build 44627 and is a major update.

I will try to bundle what is known and what you should do to work with 2.5 and will try to summarize it in this thread, but there are still a lot of things to discover so your input is wanted.
PM me with your questions and remarks.

After you upgraded and if you are lucky and connect to newer servers/clients it may just work, but you probably have to revise and adapt your (encryption) cipher settings and the new data-ciphers settings.

The most important changes are in the cipher settings, OpenVPN 2.5 works with data-ciphers which is a new and improved version of ncp-ciphers.

From the manual:
Quote:
OpenVPN clients will now signal all supported ciphers from the data-ciphers option to the server via IV_CIPHERS.
OpenVPN servers will select the first common cipher from the data-ciphers list instead of blindly pushing the first cipher of the list.
This allows to use a configuration like data-ciphers ChaCha20-Poly1305:AES-256-GCM on the server that prefers ChaCha20-Poly1305 but uses it only if the client supports it.

The old (Encryption) cipher settings that we know and which is implemented in DDWRT will be deprecated, but is now kept for compatibility reasons.

For both OpenVPN Server and Client you can set up to three Data Ciphers in the DDWRT GUI.

WARNING
There might be bugs in the first builds, although until now no major problems have been reported so everything looks good.

If you decide to upgrade do the following:

Before upgrading
For the OpenVPN Server and OpenVPN client make a note of your current Encryption Cipher setting


After upgrading
If the GUI shows some settings with undefined then refresh your browser cache (usually CTRL + F5)

OpenVPN server
Check Encryption Cipher and set back if it is changed.

Set a value for the Data Ciphers 1,2 and 3.
There are default settings if you are unsure keep it at their default settings, but set the third data cipher the same as your Encryption Cipher

The clients for your server will try to use the first of the servers Data Ciphers they have in common.
Very old clients will try to use the Encryption cipher setting.

If your clients cannot connect because they are pre OpenVNP 2.4 you can add in the Additional Config:
Code:
data-ciphers-fallback BF-CBC
Instead of BF-CBC set your own encryption cipher

Note: be sure to reboot your router after setting up or restart the firewall!

OpenVPN Client
Check Encryption Cipher and set back if it is changed.

Set a value for the Data Ciphers 1,2 and 3.
Set the first data cipher the same as your Encryption Cipher, set the second Data Cipher at AES-128-GCM and the third Data Cipher at AES-256-GCM

If your client cannot connect, you can force the use of the Encryption Cipher instead of the Data Ciphers by adding the following to the Additional Config of the OpenVPN client:
Code:
ncp-disable
(this setting will be deprecated in the future)


References:
https://build.openvpn.net/man/openvpn-2.5/openvpn.8.html
https://github.com/OpenVPN/openvpn/blob/release/2.5/Changes.rst

The OpenVPN Server setup guide (see link in my signature at the bottom is being updated)

Stay tuned

_________________
Routers:Netgear R7800, R6400v1, R6400v2, Linksys EA8500, EA6900 (XvortexCFE), E2000 (converted WRT320N), WRT54GS v1.
OpenVPN Policy Based Routing: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=321686
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN Server Setup:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Wireguard Server setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1183135
Wireguard Client setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324624
Wireguard Advanced setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324787
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087


Last edited by egc on Sat Dec 05, 2020 10:43; edited 13 times in total
Sponsor
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 6983
Location: Netherlands

PostPosted: Tue Oct 20, 2020 7:49    Post subject: Reply with quote
for future use
_________________
Routers:Netgear R7800, R6400v1, R6400v2, Linksys EA8500, EA6900 (XvortexCFE), E2000 (converted WRT320N), WRT54GS v1.
OpenVPN Policy Based Routing: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=321686
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN Server Setup:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Wireguard Server setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1183135
Wireguard Client setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324624
Wireguard Advanced setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324787
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
05dyna
DD-WRT Guru


Joined: 25 Jan 2008
Posts: 929

PostPosted: Thu Oct 22, 2020 23:37    Post subject: Reply with quote
egc wrote:
There will be bugs in the first builds so if you are dependant on OpenVPN, you might consider postponing upgrading till the dust settles.


Thanks, based on your post I just looked for the new client software, its still at 25-rc3 (release candidate). I’ll take your advice and hold off

https://openvpn.net/community-downloads/
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 6983
Location: Netherlands

PostPosted: Fri Oct 23, 2020 5:37    Post subject: Reply with quote
I have tested it and it works for me but YMMV Smile
_________________
Routers:Netgear R7800, R6400v1, R6400v2, Linksys EA8500, EA6900 (XvortexCFE), E2000 (converted WRT320N), WRT54GS v1.
OpenVPN Policy Based Routing: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=321686
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN Server Setup:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Wireguard Server setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1183135
Wireguard Client setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324624
Wireguard Advanced setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324787
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
05dyna
DD-WRT Guru


Joined: 25 Jan 2008
Posts: 929

PostPosted: Fri Oct 23, 2020 17:34    Post subject: Reply with quote
after thinking about it I spoke (posted) too soon Embarassed What I will do is take another router and configure it with the new build and test it. That way if it fails it just a matter of putting the working router & build back in place. Currently using r42856 as OpenVPN client on EA8500 and its rock solid, been up 55 days and NO issues.
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 6983
Location: Netherlands

PostPosted: Fri Oct 23, 2020 17:41    Post subject: Reply with quote
That is an excellent track record Smile

Keep us posted, if you need assistance setting up let me know.

_________________
Routers:Netgear R7800, R6400v1, R6400v2, Linksys EA8500, EA6900 (XvortexCFE), E2000 (converted WRT320N), WRT54GS v1.
OpenVPN Policy Based Routing: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=321686
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN Server Setup:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Wireguard Server setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1183135
Wireguard Client setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324624
Wireguard Advanced setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324787
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
05dyna
DD-WRT Guru


Joined: 25 Jan 2008
Posts: 929

PostPosted: Fri Oct 23, 2020 18:44    Post subject: Reply with quote
I think we are good, see image. I run my OpenVPN client router behind my pfsense box on a vlan so that is the reason for the private IP on the wan.

I'll post back if something goes wrong with the OpenVPN otherwise I'll post in KP's new build thread. Thanks for the heads-up
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 6983
Location: Netherlands

PostPosted: Fri Oct 23, 2020 19:13    Post subject: Reply with quote
Thanks!
_________________
Routers:Netgear R7800, R6400v1, R6400v2, Linksys EA8500, EA6900 (XvortexCFE), E2000 (converted WRT320N), WRT54GS v1.
OpenVPN Policy Based Routing: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=321686
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN Server Setup:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Wireguard Server setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1183135
Wireguard Client setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324624
Wireguard Advanced setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324787
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
Wildlion
DD-WRT Guru


Joined: 24 May 2016
Posts: 988

PostPosted: Fri Oct 23, 2020 22:51    Post subject: Reply with quote
Just wanted to say thanks for posting this. I remember last time I setup openvpn it was not on dd-wrt but took a long time reading through the openvpn documentation pages.
05dyna
DD-WRT Guru


Joined: 25 Jan 2008
Posts: 929

PostPosted: Sun Oct 25, 2020 2:55    Post subject: Reply with quote
@ egc, FWIW all was good until I tried Netflix and received this error, see image. I put the other router back in place with build r42856 and no problems with Netflix. Netflix is suppose to work with NordVPN
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 6983
Location: Netherlands

PostPosted: Sun Oct 25, 2020 6:36    Post subject: Reply with quote
I cannot relate that to the changes.
Those are for making a connection and you seem connected.

Maybe you connect to a different Nord server or do not route DNS through the vpn?

_________________
Routers:Netgear R7800, R6400v1, R6400v2, Linksys EA8500, EA6900 (XvortexCFE), E2000 (converted WRT320N), WRT54GS v1.
OpenVPN Policy Based Routing: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=321686
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN Server Setup:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Wireguard Server setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1183135
Wireguard Client setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324624
Wireguard Advanced setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324787
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
05dyna
DD-WRT Guru


Joined: 25 Jan 2008
Posts: 929

PostPosted: Fri Oct 30, 2020 19:20    Post subject: Reply with quote
@ egc just did a clean install of r44700, so far no issue with Netflix.
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 6983
Location: Netherlands

PostPosted: Fri Oct 30, 2020 20:09    Post subject: Reply with quote
05dyna wrote:
@ egc just did a clean install of r44700, so far no issue with Netflix.


Good to know it is working Smile

_________________
Routers:Netgear R7800, R6400v1, R6400v2, Linksys EA8500, EA6900 (XvortexCFE), E2000 (converted WRT320N), WRT54GS v1.
OpenVPN Policy Based Routing: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=321686
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN Server Setup:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Wireguard Server setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1183135
Wireguard Client setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324624
Wireguard Advanced setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324787
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
ymurawski
DD-WRT Novice


Joined: 30 Jan 2018
Posts: 20

PostPosted: Mon Nov 02, 2020 16:11    Post subject: OpenVPN Server does not start anymore Reply with quote
Hi, today i did a clean install of r44700 after upgrading from an old version...

Now my OpenVPN Server wont start. i tried many thinks with that new Cipher settings but nothing works.

In Attachment is the old working VPN setting and the New not working version.

(The white version is the working one)

Any advise Sad
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 6983
Location: Netherlands

PostPosted: Mon Nov 02, 2020 16:35    Post subject: Reply with quote
I assume the white one is a screenshot of your old build.

On the new setting your Server Network is changed from 192.168.10.0 to 10.10.10.0

You mention the server does not start but what does the OVPN status page shows?
Show a picture of the whole page but take note of the forum guidelines:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087

Pictures not wider than 800 pixels (so resize your pictures you already uploaded).

also what router are you using?

_________________
Routers:Netgear R7800, R6400v1, R6400v2, Linksys EA8500, EA6900 (XvortexCFE), E2000 (converted WRT320N), WRT54GS v1.
OpenVPN Policy Based Routing: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=321686
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN Server Setup:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Wireguard Server setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1183135
Wireguard Client setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324624
Wireguard Advanced setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324787
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
Goto page 1, 2  Next Display posts from previous:    Page 1 of 2
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Advanced Networking All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum