1

Temat: problem z openvpn na openwrt 19.07

Cześć, po update firmware'u mam problem z połączeniem się z vpn. Nie może załadować certyfikatów. Na poprzedniej wersji 18.06 wszystko działało bez problemów, a teraz już nie, może będziecie mi w stanie pomóc, wklejam logi.

Sun Sep  1 14:46:19 2019 daemon.err openvpn(custom_config)[2929]: OpenSSL: error:140AB18E:SSL routines:SSL_CTX_use_certificate:ca md too weak
Sun Sep  1 14:46:19 2019 daemon.err openvpn(custom_config)[2929]: Cannot load certificate file /etc/openvpn/certl.crt
Sun Sep  1 14:46:19 2019 daemon.notice openvpn(custom_config)[2929]: Exiting due to fatal error
Sun Sep  1 14:46:24 2019 daemon.notice openvpn(custom_config)[2962]: OpenVPN 2.4.7 mips-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
Sun Sep  1 14:46:24 2019 daemon.notice openvpn(custom_config)[2962]: library versions: OpenSSL 1.1.1c  28 May 2019, LZO 2.10
Sun Sep  1 14:46:24 2019 daemon.warn openvpn(custom_config)[2962]: WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Dzięki za pomoc!

2

Odp: problem z openvpn na openwrt 19.07

Wynik

ls -al /etc/openvpn/certl.crt

Pokaż.

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

3

Odp: problem z openvpn na openwrt 19.07

-rwxr-xr-x    1 root     root          3542 Aug 23  2017 /etc/openvpn/certl.crt

4

Odp: problem z openvpn na openwrt 19.07

uci show openvpn

i pełny log z próby uruchomienia.

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

5

Odp: problem z openvpn na openwrt 19.07

openvpn.custom_config=openvpn
openvpn.custom_config.enabled='1'
openvpn.custom_config.config='/etc/openvpn/my-vpn.conf'

6

Odp: problem z openvpn na openwrt 19.07

cat /etc/openvpn/my-vpn.conf

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

7

Odp: problem z openvpn na openwrt 19.07

Sun Sep  1 15:07:17 2019 daemon.err openvpn(custom_config)[6771]: OpenSSL: error:140AB18E:SSL routines:SSL_CTX_use_certificate:ca md too weak
Sun Sep  1 15:07:17 2019 daemon.err openvpn(custom_config)[6771]: Cannot load certificate file /etc/openvpn/certl.crt
Sun Sep  1 15:07:17 2019 daemon.notice openvpn(custom_config)[6771]: Exiting due to fatal error
Sun Sep  1 15:07:37 2019 daemon.notice openvpn(custom_config)[6826]: OpenVPN 2.4.7 mips-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
Sun Sep  1 15:07:37 2019 daemon.notice openvpn(custom_config)[6826]: library versions: OpenSSL 1.1.1c  28 May 2019, LZO 2.10
Sun Sep  1 15:07:37 2019 daemon.warn openvpn(custom_config)[6826]: WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Sun Sep  1 15:07:37 2019 daemon.err openvpn(custom_config)[6826]: OpenSSL: error:140AB18E:SSL routines:SSL_CTX_use_certificate:ca md too weak
Sun Sep  1 15:07:37 2019 daemon.err openvpn(custom_config)[6826]: Cannot load certificate file /etc/openvpn/certl.crt
Sun Sep  1 15:07:37 2019 daemon.notice openvpn(custom_config)[6826]: Exiting due to fatal error

8

Odp: problem z openvpn na openwrt 19.07

# Automatically generated configuration
client
dev tun11
proto tcp
remote xx.xx.xx.xxx xxxx
resolv-retry infinite
nobind
persist-key
persist-tun
comp-lzo adaptive
verb 3
ca /etc/openvpn/ca.crt
cert /etc/openvpn/certl.crt
key /etc/openvpn/certl.key
auth-user-pass /etc/openvpn/password.txt
status-version 2
status status
# Custom Configuration
route 192.168.1.0 255.255.255.0

9

Odp: problem z openvpn na openwrt 19.07

ls -al /etc/openvpn
opkg list-installed | grep openvpn

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

10

Odp: problem z openvpn na openwrt 19.07

Znajomy się odezwie i przetestuje te ustawienia na tym samym routerze i tej nowej wersji, ja z braku czasu wróciłem tymczasowo do starej wersji i nie mogę teraz tej operacji przeprowadzić jeszcze raz. Wszystko tam jest ok. Dzięki.

11

Odp: problem z openvpn na openwrt 19.07

potwierdzam u mnie tez openvpn nie dziala na najnowszym 19.07 ale tez przestalo mi dzilac przekierowanie portu na zewnatrz wiec moze to cos z firewalem

12

Odp: problem z openvpn na openwrt 19.07

Nie potwierdzam tego. Openvpn nadal działa na 19.07.

root@OpenWrt:/etc/openvpn# ping onet.pl
PING onet.pl (213.180.141.140): 56 data bytes
64 bytes from 213.180.141.140: seq=1 ttl=51 time=58.864 ms
64 bytes from 213.180.141.140: seq=2 ttl=51 time=57.804 ms
^C
--- onet.pl ping statistics ---
3 packets transmitted, 2 packets received, 33% packet loss
round-trip min/avg/max = 57.804/58.334/58.864 ms
root@OpenWrt:/etc/openvpn# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.12.6.137     128.0.0.0       UG    0      0        0 tun0
0.0.0.0         10.1.1.1        0.0.0.0         UG    0      0        0 wlan0
10.1.1.0        0.0.0.0         255.255.255.0   U     0      0        0 wlan0
10.12.0.1       10.12.6.137     255.255.255.255 UGH   0      0        0 tun0
10.12.6.137     0.0.0.0         255.255.255.255 UH    0      0        0 tun0
51.68.180.4     10.1.1.1        255.255.255.255 UGH   0      0        0 wlan0
128.0.0.0       10.12.6.137     128.0.0.0       UG    0      0        0 tun0
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 br-lan
root@OpenWrt:/etc/openvpn# ifconfig tun0
tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.12.6.138  P-t-P:10.12.6.137  Mask:255.255.255.255
          inet6 addr: fe80::fb9e:c087:4f94:17f1/64 Scope:Link
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:7 errors:0 dropped:0 overruns:0 frame:0
          TX packets:12 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:570 (570.0 B)  TX bytes:900 (900.0 B)

root@OpenWrt:/etc/openvpn# wget -O - http://ip-api.com/csv
Downloading 'http://ip-api.com/csv'
Connecting to 185.194.141.58:80
Writing to stdout
success,Germany,DE,HE,Hesse,Limburg an der Lahn,65550,50.3986,8.07958,Europe/Berlin,OVH SAS,OVH GmbH,AS16276 OVH SAS,51.68.180.4
-                    100% |*******************************|   129   0:00:00 ETA
Download completed (129 bytes)


root@OpenWrt:/etc/openvpn# cat /etc/config/openvpn

config openvpn 'custom_config'
    option enabled '1'
    option config '/etc/openvpn/vpnbook-de4-tcp80.ovpn'

config openvpn 'sample_server'
    option enabled '0'
    option port '1194'
    option proto 'udp'
    option dev 'tun'
    option ca '/etc/openvpn/ca.crt'
    option cert '/etc/openvpn/server.crt'
    option key '/etc/openvpn/server.key'
    option dh '/etc/openvpn/dh1024.pem'
    option server '10.8.0.0 255.255.255.0'
    option ifconfig_pool_persist '/tmp/ipp.txt'
    option keepalive '10 120'
    option compress 'lzo'
    option persist_key '1'
    option persist_tun '1'
    option user 'nobody'
    option status '/tmp/openvpn-status.log'
    option verb '3'

config openvpn 'sample_client'
    option enabled '0'
    option client '1'
    option dev 'tun'
    option proto 'udp'
    list remote 'my_server_1 1194'
    option resolv_retry 'infinite'
    option nobind '1'
    option persist_key '1'
    option persist_tun '1'
    option user 'nobody'
    option ca '/etc/openvpn/ca.crt'
    option cert '/etc/openvpn/client.crt'
    option key '/etc/openvpn/client.key'
    option compress 'lzo'
    option verb '3'
root@OpenWrt:/etc/openvpn# cat /etc/openvpn/vpnbook-de4-tcp80.ovpn 
client
dev tun0
proto tcp
remote 51.68.180.4 80
remote de4.vpnbook.com 80
resolv-retry infinite
nobind
persist-key
persist-tun
comp-lzo
verb 3
cipher AES-128-CBC
fast-io
pull
route-delay 2
redirect-gateway
<ca>
-----BEGIN CERTIFICATE-----
MIIDyzCCAzSgAwIBAgIJAKRtpjsIvek1MA0GCSqGSIb3DQEBBQUAMIGgMQswCQYD
VQQGEwJDSDEPMA0GA1UECBMGWnVyaWNoMQ8wDQYDVQQHEwZadXJpY2gxFDASBgNV
BAoTC3ZwbmJvb2suY29tMQswCQYDVQQLEwJJVDEUMBIGA1UEAxMLdnBuYm9vay5j
b20xFDASBgNVBCkTC3ZwbmJvb2suY29tMSAwHgYJKoZIhvcNAQkBFhFhZG1pbkB2
cG5ib29rLmNvbTAeFw0xMzA0MjQwNDA3NDhaFw0yMzA0MjIwNDA3NDhaMIGgMQsw
CQYDVQQGEwJDSDEPMA0GA1UECBMGWnVyaWNoMQ8wDQYDVQQHEwZadXJpY2gxFDAS
BgNVBAoTC3ZwbmJvb2suY29tMQswCQYDVQQLEwJJVDEUMBIGA1UEAxMLdnBuYm9v
ay5jb20xFDASBgNVBCkTC3ZwbmJvb2suY29tMSAwHgYJKoZIhvcNAQkBFhFhZG1p
bkB2cG5ib29rLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAyNwZEYs6
WN+j1zXYLEwiQMShc1mHmY9f9cx18hF/rENG+TBgaS5RVx9zU+7a9X1P3r2OyLXi
WzqvEMmZIEhij8MtCxbZGEEUHktkbZqLAryIo8ubUigqke25+QyVLDIBuqIXjpw3
hJQMXIgMic1u7TGsvgEUahU/5qbLIGPNDlUCAwEAAaOCAQkwggEFMB0GA1UdDgQW
BBRZ4KGhnll1W+K/KJVFl/C2+KM+JjCB1QYDVR0jBIHNMIHKgBRZ4KGhnll1W+K/
KJVFl/C2+KM+JqGBpqSBozCBoDELMAkGA1UEBhMCQ0gxDzANBgNVBAgTBlp1cmlj
aDEPMA0GA1UEBxMGWnVyaWNoMRQwEgYDVQQKEwt2cG5ib29rLmNvbTELMAkGA1UE
CxMCSVQxFDASBgNVBAMTC3ZwbmJvb2suY29tMRQwEgYDVQQpEwt2cG5ib29rLmNv
bTEgMB4GCSqGSIb3DQEJARYRYWRtaW5AdnBuYm9vay5jb22CCQCkbaY7CL3pNTAM
BgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBAKaoCEWk2pitKjbhChjl1rLj
6FwAZ74bcX/YwXM4X4st6k2+Fgve3xzwUWTXinBIyz/WDapQmX8DHk1N3Y5FuRkv
wOgathAN44PrxLAI8kkxkngxby1xrG7LtMmpATxY7fYLOQ9yHge7RRZKDieJcX3j
+ogTneOl2w6P0xP6lyI6
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
MIID6DCCA1GgAwIBAgIBATANBgkqhkiG9w0BAQUFADCBoDELMAkGA1UEBhMCQ0gx
DzANBgNVBAgTBlp1cmljaDEPMA0GA1UEBxMGWnVyaWNoMRQwEgYDVQQKEwt2cG5i
b29rLmNvbTELMAkGA1UECxMCSVQxFDASBgNVBAMTC3ZwbmJvb2suY29tMRQwEgYD
VQQpEwt2cG5ib29rLmNvbTEgMB4GCSqGSIb3DQEJARYRYWRtaW5AdnBuYm9vay5j
b20wHhcNMTMwNTA2MDMyMTIxWhcNMjMwNTA0MDMyMTIxWjB4MQswCQYDVQQGEwJD
SDEPMA0GA1UECBMGWnVyaWNoMQ8wDQYDVQQHEwZadXJpY2gxFDASBgNVBAoTC3Zw
bmJvb2suY29tMQ8wDQYDVQQDEwZjbGllbnQxIDAeBgkqhkiG9w0BCQEWEWFkbWlu
QHZwbmJvb2suY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCkTM/8E+JH
CjskqMIwgYDrNCBTWZLa+qKkJjZ/rliJomTfVYwKwv1AHYYU6RHpCxS1qFp3BEKL
vQlASuzycSv1FGnNiLmg94fqzzWdmjs1XWosnLqbOwxx2Ye/1WoakSHia0pItoZk
xK7/fllm42+Qujri/ERGga5Cb/TfiP6pUQIDAQABo4IBVzCCAVMwCQYDVR0TBAIw
ADAtBglghkgBhvhCAQ0EIBYeRWFzeS1SU0EgR2VuZXJhdGVkIENlcnRpZmljYXRl
MB0GA1UdDgQWBBTDr4BCNSdOEh+Lx6+4RRK11x8XcDCB1QYDVR0jBIHNMIHKgBRZ
4KGhnll1W+K/KJVFl/C2+KM+JqGBpqSBozCBoDELMAkGA1UEBhMCQ0gxDzANBgNV
BAgTBlp1cmljaDEPMA0GA1UEBxMGWnVyaWNoMRQwEgYDVQQKEwt2cG5ib29rLmNv
bTELMAkGA1UECxMCSVQxFDASBgNVBAMTC3ZwbmJvb2suY29tMRQwEgYDVQQpEwt2
cG5ib29rLmNvbTEgMB4GCSqGSIb3DQEJARYRYWRtaW5AdnBuYm9vay5jb22CCQCk
baY7CL3pNTATBgNVHSUEDDAKBggrBgEFBQcDAjALBgNVHQ8EBAMCB4AwDQYJKoZI
hvcNAQEFBQADgYEAoDgD8mpVPnHUh7RhQziwhp8APC8K3jToZ0Dv4MYXQnzyXziH
QbewJZABCcOKYS0VRB/6zYX/9dIBogA/ieLgLrXESIeOp1SfP3xt+gGXSiJaohyA
/NLsTi/Am8OP211IFLyDLvPqZuqlh/+/GOLcMCeCrMj4RYxWstNxtguGQFc=
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN RSA PRIVATE KEY-----
MIICXAIBAAKBgQCkTM/8E+JHCjskqMIwgYDrNCBTWZLa+qKkJjZ/rliJomTfVYwK
wv1AHYYU6RHpCxS1qFp3BEKLvQlASuzycSv1FGnNiLmg94fqzzWdmjs1XWosnLqb
Owxx2Ye/1WoakSHia0pItoZkxK7/fllm42+Qujri/ERGga5Cb/TfiP6pUQIDAQAB
AoGANX508WQf9nVUUFlJ8LUZnnr4U2sEr5uPPNbcQ7ImTZm8MiMOV6qo/ikesMw5
8qCS+5p26e1PJWRFENPUVhOW9c07z+nRMyHBQzFnNAFD7TiayjNk1gz1oIXarceR
edNGFDdWCwXh+nJJ6whbQn9ioyTg9aqScrcATmHQxTit0GECQQDR5FmwC7g0eGwZ
VHgSc/bZzo0q3VjNGakrA2zSXWUWrE0ybBm2wJNBYKAeskzWxoc6/gJa8mKEU+Vv
ugGb+J/tAkEAyGSEmWROUf4WX5DLl6nkjShdyv4LAQpByhiwLjmiZL7F4/irY4fo
ct2Ii5uMzwERRvHjJ7yzJJic8gkEca2adQJABxjZj4JV8DBCN3kLtlQFfMfnLhPd
9NFxTusGuvY9fM7GrXXKSMuqLwO9ZkxRHNIJsIz2N20Kt76+e1CmzUdS4QJAVvbQ
WKUgHBMRcI2s3PecuOmQspxG+D+UR3kpVBYs9F2aEZIEBuCfLuIW9Mcfd2I2NjyY
4NDSSYp1adAh/pdhVQJBANDrlnodYDu6A+a4YO9otjd+296/T8JpePI/KNxk7N0A
gm7SAhk379I6hr5NXdBbvTedlb1ULrhWV8lpwZ9HW2k=
-----END RSA PRIVATE KEY-----
</key>
auth-user-pass /etc/openvpn/pass.txt
root@OpenWrt:/etc/openvpn# cat /etc/openvpn/pass.txt 
vpnbook
vBeD3Fz
root@OpenWrt:/etc/openvpn# cat /etc/openwrt_release 
DISTRIB_ID='OpenWrt'
DISTRIB_RELEASE='19.07-SNAPSHOT'
DISTRIB_REVISION='r10324-8bf8de95a2'
DISTRIB_TARGET='ar71xx/generic'
DISTRIB_ARCH='mips_24kc'
DISTRIB_DESCRIPTION='OpenWrt 19.07-SNAPSHOT r10324-8bf8de95a2'
DISTRIB_TAINTS=''
Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

13

Odp: problem z openvpn na openwrt 19.07

problemem byl modem z kablowki po restarcie modemu wszystko dziala