openvpn will not connect to client (macos)

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Advanced Networking
Author Message
brody1
DD-WRT Novice


Joined: 10 May 2020
Posts: 11

PostPosted: Wed Jan 20, 2021 21:32    Post subject: openvpn will not connect to client (macos) Reply with quote
I just installed the latest dd-wrt (11/03/20), just can't connect to the openvpn server. Any advice would be appreciated.

I am using the openvpn connect client for MacOS

openVPN desktop client log

Code:

⏎1/20/2021, 1:46:44 PM Connecting to [10.8.0.1]:1194 (10.8.0.1) via UDPv4
⏎1/20/2021, 1:46:44 PM EVENT: WAIT ⏎1/20/2021, 1:46:54 PM Server poll timeout, trying next remote entry...
⏎1/20/2021, 1:46:54 PM EVENT: RECONNECTING ⏎1/20/2021, 1:46:54 PM EVENT: RESOLVE ⏎1/20/2021, 1:46:54 PM Contacting 10.8.0.1:1194 via UDP
⏎1/20/2021, 1:46:54 PM UnixCommandAgent: transmitting bypass route to /var/run/agent_ovpnconnect.sock
{
   "host" : "10.8.0.1",
   "ipv6" : false,
   "pid" : 8027
}

⏎1/20/2021, 1:46:54 PM EVENT: WAIT ⏎1/20/2021, 1:46:54 PM Connecting to [10.8.0.1]:1194 (10.8.0.1) via UDPv4
⏎1/20/2021, 1:47:04 PM Server poll timeout, trying next remote entry...
⏎1/20/2021, 1:47:04 PM EVENT: RECONNECTING ⏎1/20/2021, 1:47:04 PM EVENT: RESOLVE ⏎1/20/2021, 1:47:04 PM Contacting 10.8.0.1:1194 via UDP
⏎1/20/2021, 1:47:04 PM UnixCommandAgent: transmitting bypass route to /var/run/agent_ovpnconnect.sock
{
   "host" : "10.8.0.1",
   "ipv6" : false,
   "pid" : 8027
}



Here is my configuration in dd-wrt




and this is the dd-wrt openvpn status page




my client .ovpn looks like this

Code:

client
dev tun
proto udp
remote 10.8.0.1 1194
resolv-retry infinite
nobind
persist-key
persist-tun
comp-lzo
verb 3

<key>
--------------------------
</key>

<cert>
-----------------------------
</cert>

<ca>
----------------------------
</ca>

<tls-auth>
-----------------------------------
</tls-auth>

Sponsor
eibgrad
DD-WRT Guru


Joined: 18 Sep 2010
Posts: 8598

PostPosted: Wed Jan 20, 2021 21:58    Post subject: Reply with quote
That client log suggests you are trying to connect the OpenVPN server @ 10.8.0.1, which makes no sense. That's the local IP of the tunnel (wrt the server), which only gets established once your remote OpenVPN client using its *public* IP to connect to your router's WAN using its *public* IP.

As a side note, not a good idea to use the well-known port of 1194 for your own OpenVPN server. That just makes it an obvious target for hackers. Better to use something more obscure, like 11327 or whatever.
brody1
DD-WRT Novice


Joined: 10 May 2020
Posts: 11

PostPosted: Wed Jan 20, 2021 23:41    Post subject: same results Reply with quote
I tried with wan ipv4 address but i get the same results


Code:

⏎1/20/2021, 4:38:43 PM EVENT: WAIT ⏎1/20/2021, 4:38:43 PM Connecting to [98.x.x.x]:2081 (98.x.x.x) via UDPv4
⏎1/20/2021, 4:38:53 PM Server poll timeout, trying next remote entry...
⏎1/20/2021, 4:38:53 PM EVENT: RECONNECTING ⏎1/20/2021, 4:38:53 PM EVENT: RESOLVE ⏎1/20/2021, 4:38:53 PM Contacting 98.x.x.x:2081 via UDP
⏎1/20/2021, 4:38:53 PM UnixCommandAgent: transmitting bypass route to /var/run/agent_ovpnconnect.sock
{
   "host" : "98.x.x.x",
   "ipv6" : false,
   "pid" : 10070
}




I also added these to my client .ovpn file, not sure if it makes a difference.

remote-cert-tls server
cipher AES-256-GCM
auth SHA256
eibgrad
DD-WRT Guru


Joined: 18 Sep 2010
Posts: 8598

PostPosted: Thu Jan 21, 2021 0:08    Post subject: Reply with quote
Does the dd-wrt OpenVPN server log at least show an *attempt* by the OpenVPN client to connect to the server, even if that ultimately fails? Because if it doesn't, then you're not even reaching the server for some reason. That's the first hurdle. Once reached, THEN you can worry about why the two sides can't complete the connection (e.g., misconfiguration by one side or the other).
brody1
DD-WRT Novice


Joined: 10 May 2020
Posts: 11

PostPosted: Thu Jan 21, 2021 2:53    Post subject: Reply with quote
I am getting this error now

which settings do I use?

Code:

20210120 19:44:50 N 192.168.1.100:49276 TLS Error: incoming packet authentication failed from [AF_INET]192.168.1.100:49276
20210120 19:44:51 N 192.168.1.100:49276 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1611197084) 2021-01-20 19:44:44 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
eibgrad
DD-WRT Guru


Joined: 18 Sep 2010
Posts: 8598

PostPosted: Thu Jan 21, 2021 3:30    Post subject: Reply with quote
The connection attempt by the OpenVPN client is coming from a *private* IP!

20210120 19:44:50 N 192.168.1.100:49276 TLS Error: incoming packet authentication failed from [AF_INET]192.168.1.100:49276

Why? This should normally be a *public* IP, from a client on the internet.

[remote ovpn client: public IP = 199.199.199.199]<-internet->[your router: wan/public ip = 188.188.188.188]

The connection attempt in the server log would then display 199.199.199.199 (using my arbitrary example) rather than 192.168.1.100

I'm getting the impression you're attempting to connect to the OpenVPN server from an OpenVPN client that is *inside* the same local network (specifically 192.168.1.100), which won't work! The OpenVPN client *must* be outside the local network, on the internet, w/ its own public IP.
brody1
DD-WRT Novice


Joined: 10 May 2020
Posts: 11

PostPosted: Thu Jan 21, 2021 3:52    Post subject: Reply with quote
yes , my laptop is connected to the wifi router, the same router that has openvpn enabled. Can I connect to openvpn from inside the network? or route all the traffic through the vpn in my network?
eibgrad
DD-WRT Guru


Joined: 18 Sep 2010
Posts: 8598

PostPosted: Thu Jan 21, 2021 4:57    Post subject: Reply with quote
brody1 wrote:
yes , my laptop is connected to the wifi router, the same router that has openvpn enabled. Can I connect to openvpn from inside the network? or route all the traffic through the vpn in my network?


Again, the OpenVPN client can NOT be accessing the OpenVPN server from inside the same local network. That client *must* be located outside that network, normally the internet. This is because a VPN is unique when it comes to remote access. The VPN changes the routing tables on the client, and you end up w/ the client having ambiguous routing information. The remote network the client is trying to reach (e.g., 192.168.1.x) via the VPN is the same one it's already on locally! So how should references to 192.168.1.x be routed? Locally or over the VPN? It's ambiguous. And so you're going to have endless problems if you insist on trying to access your OpenVPN server from the same local network.
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 7268
Location: Netherlands

PostPosted: Thu Jan 21, 2021 7:19    Post subject: Reply with quote
The main problem is already tackled by @eibgrad

So just some remarks.

You did not install the latest version (that is not the problem at this moment) but have a look at the forum guidelines which will tell you everything to know to get a good start at DDWRT (e.g. where to find the latest builds and that you should always state router model and build number to get the best support):
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087

There are also some settings which need attention.

I would start with Enabling "Redirect default Gateway" on the server side, at this moment you seem not have any route set.

Furthermore using compression is not safe so I would turn that off.

All these things can be found in the manuals and trouble shooting guide (also that you cannot test from inside your network)
So why not head over to the documentation Smile

You can find a lot of documentation in a sticky just a few posts above this one:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327398

_________________
Routers:Netgear R7800, R6400v1, R6400v2, Linksys EA8500, EA6900 (XvortexCFE), E2000 (converted WRT320N), WRT54GS v1.
WireGuard Documents & Guides:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327397
OpenVPN Documents & Guides: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327398
IPSET: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327261
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
foz111
DD-WRT User


Joined: 01 Oct 2017
Posts: 418
Location: Earth

PostPosted: Thu Jan 21, 2021 14:58    Post subject: Reply with quote
brody1 what are you trying to achieve?

A vpn server is used to connect back to your home network LAN when your outside, say sat on a beech, airport, pub etc to reach your home network for files etc.
seems to me you may have your wires crossed and want to encrypt you data to stop your isp seeing what your doing?
If that's the case most people would subscribe to a commercial vpn server eg NordVPN or others you then configure a vpn client.

_________________
Netgear R7800
Network IPV4 eth1 - Isolated Vlan eth1.3 on br1 for IoT devices With 2 x AP's (Amazon Echos, smart TV's, etc.) BT Whole Home 4 node Mesh Wi-Fi. OVPN Server with Paid OVPN client & Wireguard Client.
Gateway, DNSMasq, Static Leases & DHCP. Pi-Hole for DNS
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Advanced Networking All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum