0

While the process is supposed to be simple, I'm not getting any love from my router. I have created an OpenVPN profile, a username and password, but I cannot get a connection.

On android the OpenVPN client just says 'authentication failed'. On my mac, using 'Tunnelblick', I can get a bit more information. The logging says:

2015-10-18 12:24:14 *Tunnelblick: Established communication with OpenVPN
2015-10-18 12:24:19 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2015-10-18 12:24:19 UDPv4 link local: [undef]
2015-10-18 12:24:19 UDPv4 link remote: [AF_INET]snip:1194
2015-10-18 12:24:19 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2015-10-18 12:24:19 TLS_ERROR: BIO read tls_read_plaintext error: error:14082174:SSL routines:SSL3_CHECK_CERT_AND_ALGORITHM:dh key too small
2015-10-18 12:24:19 TLS Error: TLS object -> incoming plaintext read error
2015-10-18 12:24:19 TLS Error: TLS handshake failed
2015-10-18 12:24:19 SIGUSR1[soft,tls-error] received, process restarting

over and over again.

I suspect the part dh key too small, but I have no clue what to do?

Specs:

  • router: Asus RT-N66U
    • Firmware Version:3.0.0.4.376_3861
    • OpenVPN server ON
    • Tried a simple password so I know it is correct
    • Downloaded the .ovpn file from the router
  • Clients: openvpn client for android, tunnelblick for mac
  • Both clients have say that authentication will not work
  • trying to connect via 4g
Improve this question

1 Answer 1

Reset to default
0

I found an answer on this forum

The short version is:

  • Create a longer DH key: openssl dhparam -out dh2048.pem 2048
  • Change the settings in your router to use that.

The longer version is dealing with the somewhat sad firmware of the Asus. Just create the key, then open the settings:

VPN -> openVPN -> advanced -> Content Modification (the sentence next to 'TLS')

Now you see all sorts of keys that have HTML encoding. If you press save now (without changing anything) you will have broken your set-up. Hurray. (see below).

You need to:

  • copy the encoded keys
  • decode them (with an online HTML decoder for instance. I used this one
  • Paste them back (you now have literally no changes if you save)
  • Paste your new key (the one you created wit openssl) in the DH box
  • save
  • apply

Now, if you did save the encoded keys, or you have been mucking about, you can delete all the keys (just empty the boxes) and save/apply. It will trigger a regeneration of the keys.

Improve this answer
1
  • You may find this some help Commented Oct 18, 2015 at 15:57

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.