[SOLVED] OpenVPN Server Fatal Error

Post new topic   Reply to topic    DD-WRT Forum Index -> Advanced Networking
Author Message
fdumont
DD-WRT Novice


Joined: 23 Apr 2012
Posts: 42

PostPosted: Thu Jul 18, 2024 18:53    Post subject: [SOLVED] OpenVPN Server Fatal Error Reply with quote
Hello eveyone,

I configure OpenVPN Server (CA, Public/Private Key, etc ..).

OpenVPN Server start normally, but when clien try to etablished connction : OpenVPN server goes down (fatal error)

Below, /var/log/messages :
Code:
Jul 18 20:48:15 NGX10 daemon.notice openvpn[2371]: TCP connection established with [AF_INET]192.168.1.103:60859
Jul 18 20:48:15 NGX10 daemon.notice openvpn[2371]: 192.168.1.103:60859 TLS: Initial packet from [AF_INET]192.168.1.103:60859, sid=12a1f13d da8a417e
Jul 18 20:48:15 NGX10 daemon.notice openvpn[2371]: 192.168.1.103:60859 NOTE: --mute triggered...
Jul 18 20:48:15 NGX10 daemon.notice openvpn[2371]: 192.168.1.103:60859 2 variation(s) on previous 3 message(s) suppressed by --mute
Jul 18 20:48:15 NGX10 daemon.notice openvpn[2371]: 192.168.1.103:60859 peer info: IV_VER=2.6.11
Jul 18 20:48:15 NGX10 daemon.notice openvpn[2371]: 192.168.1.103:60859 peer info: IV_PLAT=win
Jul 18 20:48:15 NGX10 daemon.notice openvpn[2371]: 192.168.1.103:60859 peer info: IV_TCPNL=1
Jul 18 20:48:15 NGX10 daemon.notice openvpn[2371]: 192.168.1.103:60859 peer info: IV_MTU=1600
Jul 18 20:48:15 NGX10 daemon.notice openvpn[2371]: 192.168.1.103:60859 peer info: IV_CIPHERS=CHACHA20-POLY1305:AES-256-GCM
Jul 18 20:48:15 NGX10 daemon.notice openvpn[2371]: 192.168.1.103:60859 peer info: IV_PROTO=990
Jul 18 20:48:15 NGX10 daemon.notice openvpn[2371]: 192.168.1.103:60859 peer info: IV_LZO_STUB=1
Jul 18 20:48:15 NGX10 daemon.notice openvpn[2371]: 192.168.1.103:60859 peer info: IV_COMP_STUB=1
Jul 18 20:48:15 NGX10 daemon.notice openvpn[2371]: 192.168.1.103:60859 peer info: IV_COMP_STUBv2=1
Jul 18 20:48:15 NGX10 daemon.notice openvpn[2371]: 192.168.1.103:60859 peer info: IV_GUI_VER=OpenVPN_GUI_11.49.0.0
Jul 18 20:48:15 NGX10 daemon.notice openvpn[2371]: 192.168.1.103:60859 peer info: IV_SSO=openurl,webauth,crtext
Jul 18 20:48:15 NGX10 daemon.notice openvpn[2371]: 192.168.1.103:60859 TLS: move_session: dest=TM_ACTIVE src=TM_INITIAL reinit_src=1
Jul 18 20:48:15 NGX10 daemon.notice openvpn[2371]: 192.168.1.103:60859 NOTE: --mute triggered...
Jul 18 20:48:15 NGX10 daemon.notice openvpn[2371]: 192.168.1.103:60859 2 variation(s) on previous 3 message(s) suppressed by --mute
Jul 18 20:48:15 NGX10 daemon.notice openvpn[2371]: 192.168.1.103:60859 [client1] Peer Connection Initiated with [AF_INET]192.168.1.103:60859
Jul 18 20:48:15 NGX10 daemon.notice openvpn[2371]: client1/192.168.1.103:60859 MULTI_sva: pool returned IPv4=10.0.90.2, IPv6=(Not enabled)
Jul 18 20:48:15 NGX10 daemon.notice openvpn[2371]: client1/192.168.1.103:60859 OPTIONS IMPORT: reading client specific options from: /tmp/openvpn/ccd/client1
Jul 18 20:48:15 NGX10 daemon.notice openvpn[2371]: client1/192.168.1.103:60859 NOTE: --mute triggered...
Jul 18 20:48:15 NGX10 daemon.notice openvpn[2371]: client1/192.168.1.103:60859 1 variation(s) on previous 3 message(s) suppressed by --mute
Jul 18 20:48:15 NGX10 daemon.notice openvpn[2371]: client1/192.168.1.103:60859 MULTI: Learn: 10.0.90.41 -> client1/192.168.1.103:60859
Jul 18 20:48:15 NGX10 daemon.notice openvpn[2371]: client1/192.168.1.103:60859 NOTE: --mute triggered...
Jul 18 20:48:15 NGX10 daemon.notice openvpn[2371]: client1/192.168.1.103:60859 1 variation(s) on previous 3 message(s) suppressed by --mute
Jul 18 20:48:15 NGX10 daemon.err openvpn[2371]: client1/192.168.1.103:60859 dco_new_key: netlink reports error (-10): Operation not supported
Jul 18 20:48:15 NGX10 daemon.notice openvpn[2371]: client1/192.168.1.103:60859 dco_new_key: failed to send netlink message: Not supported (-95)
Jul 18 20:48:15 NGX10 daemon.err openvpn[2371]: client1/192.168.1.103:60859 Impossible to install key material in DCO: Not supported
Jul 18 20:48:15 NGX10 daemon.notice openvpn[2371]: client1/192.168.1.103:60859 Exiting due to fatal error
Jul 18 20:48:15 NGX10 daemon.notice openvpn[2371]: client1/192.168.1.103:60859 /tmp/openvpn/route-down.sh tun2 1400 0 10.0.90.1 255.255.255.0 init
Jul 18 20:48:16 NGX10 daemon.notice openvpn[2371]: client1/192.168.1.103:60859 Closing DCO interface
Jul 18 20:48:16 NGX10 daemon.notice openvpn[2371]: client1/192.168.1.103:60859 net_addr_v4_del: 10.0.90.1 dev tun2
Jul 18 20:48:16 NGX10 daemon.notice openvpn[2371]: client1/192.168.1.103:60859 net_iface_del: delete tun2


DD-WRT build r56941 / Netgear R9000
Sponsor
eibgrad
DD-WRT Guru


Joined: 18 Sep 2010
Posts: 9357

PostPosted: Thu Jul 18, 2024 19:32    Post subject: Reply with quote
I don't believe the dd-wrt implementation of OpenVPN server currently supports DCO (Data Channel Offload). But only @egc can confirm. It seems your OpenVPN client is attempting to use it, so the server complains. If using the OpenVPN Connect client, do NOT check the DCO option on the config.
_________________
ddwrt-bind-static-routes-to-wan.sh (UPDATED! 11/12/24) * ddwrt-blacklist-domains.sh * ddwrt-dns-monitor.sh * ddwrt-ovpn-client-backup.sh * ddwrt-ovpn-client-killswitch.sh * ddwrt-ovpn-client-watchdog.sh * ddwrt-ovpn-server-watchdog.sh * ddwrt-ovpn-split-advanced.sh * ddwrt-ovpn-split-basic.sh * ddwrt-mount-usb-drives.sh * ddwrt-wol-port-forward.sh
fdumont
DD-WRT Novice


Joined: 23 Apr 2012
Posts: 42

PostPosted: Thu Jul 18, 2024 21:27    Post subject: Reply with quote
I think I was able to isolate the problem : It comes from my Certificates & Private Key File.
But I don't understand why !

When I put old Certificates & Key I don't have this fatal error of death ;)

I use EasyRSA & openssl 1.1.1v

So what could be wrong in my certificates ? What should I check ?
kernel-panic69
DD-WRT Guru


Joined: 08 May 2018
Posts: 17417
Location: Texas, USA

PostPosted: Fri Jul 19, 2024 4:44    Post subject: Reply with quote
Moved to Advanced Networking as this topic relates to OpenVPN. Please read the documentation:

Sticky: OpenVPN guides and documentation

And I do believe that DCO being enabled is the problem Wink Cool

_________________
"Life is but a fleeting moment, a vapor that vanishes quickly; All is vanity"
Contribute To DD-WRT
Pogo - A minimal level of ability is expected and needed...
RSS feed for DD-WRT releases (2025)
RSS feed for DD-WRT releases (2024)
RSS feed for DD-WRT releases (2023)

----------------------
Linux User #377467 counter.li.org / linuxcounter.net
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 13879
Location: Netherlands

PostPosted: Fri Jul 19, 2024 6:12    Post subject: Reply with quote
Just came across this thread, I usually dwell in this forum Smile

Thanks @KP69 for transferring this thread to the correct forum.

Unfortunately there is not enough information give a definitive answer to the question of the OP.

Start with sharing your router model and build number.

The OpenVPN client setup guide has a paragraph about trouble shouting but if you provide the following information we can better assist you:

• Enable "Syslogd" on Services page
• Add in OpenVPN Additional config: verb 5 and Save and Apply
• From the CLI (telnet/Putty) view/send openvpn log: grep -i openvpn /var/log/messages
• From the CLI (telnet/Putty) view/send: cat /tmp/openvpncl/openvpn.conf
• Post pictures of OpenVPN Setup page and Status page (whole page)
• Post content of Additional Config on OpenVPN Setup page
• For PBR send output of:
o ip rule show
o ip route show
o ip route show table 10
o cat /tmp/openvpncl/policy_ips

It helps if we can also see the OpenVPN client config file

_________________
Routers:Netgear R7000, R6400v1, R6400v2, EA6900 (XvortexCFE), E2000, E1200v1, WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 13879
Location: Netherlands

PostPosted: Fri Jul 19, 2024 7:11    Post subject: Reply with quote
About DCO

This is from the troubleshooting guide:
Quote:
DCO (Data Channel Offload) connection problems after build 53787
DCO (Data Channel Offload) is present in DDWRT builds with kernel 4.4 and higher starting with build 53787.
It uses a special tun kernel module which uses the kernel to handle traffic instead of constantly switching to userspace, furthermore it can use multithreading.
This can speed up OpenVPN throughput up to 100 %.
DCO is not compatible with a number of options and if those are chosen DCO will be disabled so always review your log file.
Note that DCO will use DATA_V2 packets in P2P mode, therefore, this implies that peers must be running 2.6.0+ in order to have P2P-NCP which brings DATA_V2 packet support.
It is still a WIP and can cause hangs/restarts/connection problems especially on Kernel 4.X (OpenVPN only supports DCO on Kernel 5.x but BS has backported it to our Kernel 4.X), when in doubt disable it.
To disable DCO add in the OpenVPN additional config:
disable-dco

_________________
Routers:Netgear R7000, R6400v1, R6400v2, EA6900 (XvortexCFE), E2000, E1200v1, WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
fdumont
DD-WRT Novice


Joined: 23 Apr 2012
Posts: 42

PostPosted: Fri Jul 19, 2024 9:41    Post subject: Reply with quote
Thank you egc,

I read the forum to quickly, I don't notice the issue about DCO in newer builds.
I was used to have openvpn, with another dd-wrt build, that don't have this issue

I also try to put "disable-dco" on client's side ; but not from server ...

Problem solved !
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 13879
Location: Netherlands

PostPosted: Fri Jul 19, 2024 10:09    Post subject: Reply with quote
👍
_________________
Routers:Netgear R7000, R6400v1, R6400v2, EA6900 (XvortexCFE), E2000, E1200v1, WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Index -> Advanced Networking All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum