Menu
What's new
By:
Filters Better Search

Asus RT-87U (Merlin) OpenVPN Server fails - Diffie Helmann (DH) Key too small

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

D

Dalle

Occasional Visitor
Hey fellas. I really could use an advice from the more experienced network sharks around here. I have been struggling for days to set up an OpenVPN server on my Asus RT-87U with a fresh AsusWRT (Merlin Firmware version 378.54_2 + following hardware reset.

I also initially donated 10 USD for this fantastic Router software from Merlin...

So all should be good about the router the setup and I pretty much used the standard config for the VPN Server.

It seems like my DH Key is too small. The server initializes with length 512 and I have read 2048 is default.

The Question is just if that is really the root cause, and how can I change it ?

When I am trying to connect to the OpenVPN server, I see following error in the TunnelBlick (VPN client for mac) log:

---------- VPN CLIENT LOG ------
2015-06-17 00:42:12 *Tunnelblick: Established communication with OpenVPN

2015-06-17 00:42:12 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts

2015-06-17 00:42:12 UDPv4 link local: [undef]

2015-06-17 00:42:12 UDPv4 link remote: [AF_INET]78.68.180.155:1194

2015-06-17 00:42:15 TLS_ERROR: BIO read tls_read_plaintext error: error:14082174:SSL routines:SSL3_CHECK_CERT_AND_ALGORITHM:dh key too small

2015-06-17 00:42:15 TLS Error: TLS object -> incoming plaintext read error

2015-06-17 00:42:15 TLS Error: TLS handshake failed

2015-06-17 00:42:15 SIGUSR1[soft,tls-error] received, process restarting

2015-06-17 00:42:15 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts

---------------------

The OpenVPN server log (AsusWRT) says:
------------

un 17 00:40:49 rc_service: httpd 1195:notify_rc restart_chpass;restart_vpnserver1
Jun 17 00:40:50 openvpn[1518]: event_wait : Interrupted system call (code=4)
Jun 17 00:40:50 openvpn[1518]: Closing TUN/TAP interface
Jun 17 00:40:50 openvpn[1518]: /usr/sbin/ip addr del dev tun21 10.8.0.1/24
Jun 17 00:40:50 openvpn[1518]: SIGTERM[hard,] received, process exiting
Jun 17 00:40:50 kernel: tun: Universal TUN/TAP device driver, 1.6
Jun 17 00:40:50 kernel: tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
Jun 17 00:40:51 kernel: ADDRCONF(NETDEV_UP): tun21: link is not ready
Jun 17 00:40:51 kernel: device tun21 entered promiscuous mode
Jun 17 00:40:51 openvpn[1593]: OpenVPN 2.3.6 arm-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Jun 10 2015
Jun 17 00:40:51 openvpn[1593]: library versions: OpenSSL 1.0.2a 19 Mar 2015, LZO 2.08
Jun 17 00:40:51 openvpn[1593]: Diffie-Hellman initialized with 512 bit key
Jun 17 00:40:51 openvpn[1593]: Socket Buffers: R=[122880->122880] S=[122880->122880]
Jun 17 00:40:51 openvpn[1593]: TUN/TAP device tun21 opened
Jun 17 00:40:51 openvpn[1593]: TUN/TAP TX queue length set to 100
Jun 17 00:40:51 openvpn[1593]: do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Jun 17 00:40:51 openvpn[1593]: /usr/sbin/ip link set dev tun21 up mtu 1500
Jun 17 00:40:51 kernel: ADDRCONF(NETDEV_CHANGE): tun21: link becomes ready
Jun 17 00:40:51 openvpn[1593]: /usr/sbin/ip addr add dev tun21 10.8.0.1/24 broadcast 10.8.0.255
Jun 17 00:40:51 openvpn[1596]: UDPv4 link local (bound): [undef]
Jun 17 00:40:51 openvpn[1596]: UDPv4 link remote: [undef]
Jun 17 00:40:51 openvpn[1596]: MULTI: multi_init called, r=256 v=256
Jun 17 00:40:51 openvpn[1596]: IFCONFIG POOL: base=10.8.0.2 size=252, ipv6=0
Jun 17 00:40:51 openvpn[1596]: Initialization Sequence Completed
Jun 17 00:42:12 openvpn[1596]: 94.191.186.197:50165 TLS: Initial packet from [AF_INET]94.191.186.197:50165, sid=39227b1b 506c3dfe
Jun 17 00:42:14 openvpn[1596]: 94.191.186.197:25933 TLS: Initial packet from [AF_INET]94.191.186.197:25933, sid=ac4ba775 50f59721
Jun 17 00:42:17 openvpn[1596]: 94.191.186.197:50188 TLS: Initial packet from [AF_INET]94.191.186.197:50188, sid=346ac944 f97c0bb5
Jun 17 00:42:19 openvpn[1596]: 94.191.186.197:25956 TLS: Initial packet from [AF_INET]94.191.186.197:25956, sid=04628d8c 2abe8ca5
Jun 17 00:43:12 openvpn[1596]: 94.191.186.197:50165 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Jun 17 00:43:12 openvpn[1596]: 94.191.186.197:50165 TLS Error: TLS handshake failed
Jun 17 00:43:12 openvpn[1596]: 94.191.186.197:50165 SIGUSR1[soft,tls-error] received, client-instance restarting
Jun 17 00:43:14 openvpn[1596]: 94.191.186.197:25933 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Jun 17 00:43:14 openvpn[1596]: 94.191.186.197:25933 TLS Error: TLS handshake failed
Jun 17 00:43:14 openvpn[1596]: 94.191.186.197:25933 SIGUSR1[soft,tls-error] received, client-instance restarting
Jun 17 00:43:17 openvpn[1596]: 94.191.186.197:50188 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Jun 17 00:43:17 openvpn[1596]: 94.191.186.197:50188 TLS Error: TLS handshake failed
Jun 17 00:43:17 openvpn[1596]: 94.191.186.197:50188 SIGUSR1[soft,tls-error] received, client-instance restarting
Jun 17 00:43:19 openvpn[1596]: 94.191.186.197:25956 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Jun 17 00:43:19 openvpn[1596]: 94.191.186.197:25956 TLS Error: TLS handshake failed
Jun 17 00:43:19 openvpn[1596]: 94.191.186.197:25956 SIGUSR1[soft,tls-error] received, client-instance restarting
Jun 17 00:43:32 dnsmasq-dhcp[1177]: DHCPREQUEST(br0) 192.168.1.15 04:0c:ce:e1:32:e4
-------------

Just hoping any angel comes by and help, as I feel pretty stuck from here :(

Best regards, Daniel from Denmark
 
That page is terribly long to read. Its an easy fix.

#0 Make sure your router has the correct TIME.
#1 in linux run: openssl dhparam -out dhparams.pem 2048
#2 in the ASUS RT-* go to /Advanced_VPN_OpenVPN.asp and change it to "advanced" on the dropdown
#3 click Content modification of Keys & Certification. Copy Paste your dhparams.pem content into "Diffie Hellman parameters"
#4 Hit Apply. Your clients should reconnect

If you dont have linux i'm sorry i dont know how to do this elsewhere.
 
Having the same issue on a AC66U but the work around (openssl dhparam -out dhparams.pem 2048) crashes the router.
- The OpenVPN will not start OR
- The Router will not start

I know there is a beta version available (378.55 Beta 1 (3-July-2015)) with a DH of 2048 provided, but I am a little scared of upgrading the router again. The last time I spent hours recovering from scratch...

Anyone had the same issue? or tried the beta release ?
 
slabastrou said:
Perfect. It works.... But... Isn't sharing the same DH key a security issue?
Click to expand...

No. In fact, that DH came from an RFC, and is used by various applications following that RFC. You just need to ensure that the DH is based on a prime number that can't be trivially cracked back - that's why I went with 2048-bit, and also for one from an RFC rather than one randomly generated.
 
How do I update the key in the browser? Every time I do so, I get a "Diffle Hellman parameters field error!" From what i've found its due to the browser adding in html codes to the key.
 
It seems to be a bug in the Asus firmware. I'm on stock (Firmware Version:3.0.0.4.376_3861) and it is impossible to change the certificates or keys because the key is edited incorrectly before it is applied.

My Certificate Authority shows this (note the multiple &#10; which shouldn't be there):
Code: 
-----BEGIN CERTIFICATE-----&#10;MIIDNDCCAp2gAwIBAgIJAOesWHeZ7IzRMA0GCSqGSIb3DQEBBQUAMHAxCzAJBgNV&#10;BAYTAlRXMQswCQYDVQQIEwJUVzEPMA0GA1UEBxMGVGFpcGVpMQ0wCwYDVQQKEwRB&#10;U1VTMREwDwYDVQQDEwhSVC1BQzY2VTEhMB8GCSqGSIb3DQEJARYSbWVAbXlob3N0&#10;Lm15ZG9tYWluMB4XDTE1MDkwODEyMDEzMloXDTI1MDkwNTEyMDEzMlowcDELMAkG&#10;A1UEBhMCVFcxCzAJBgNVBAgTAlRXMQ8wDQYDVQQHEwZUYWlwZWkxDTALBgNVBAoT&#10;BEFTVVMxETAPBgNVBAMTCFJULUFDNjZVMSEwHwYJKoZIhvcNAQkBFhJtZUBteWhv&#10;c3QubXlkb21haW4wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOgNBDn+iIqD&#10;gJuvUFapWmENo4Wg1bkaTN4YkCpw5ZqFCVUrWGIUrvRYizAhw13FNUR5eB5J1bX8&#10;pnRyDCdcC6U6mKyc8j8Ug2o++uLaIwIsvl5YVHo+wOlb9bz3cJuhs/1pWtUJlEm4&#10;fOzI5jf08h8a/g76OJj/Yx96DHcbyccPAgMBAAGjgdUwgdIwHQYDVR0OBBYEFNY7&#10;SguheW/hnaDxDoy0CkZ95UTzMIGiBgNVHSMEgZowgZeAFNY7SguheW/hnaDxDoy0&#10;CkZ95UTzoXSkcjBwMQswCQYDVQQGEwJUVzELMAkGA1UECBMCVFcxDzANBgNVBAcT&#10;BlRhaXBlaTENMAsGA1UEChMEQVNVUzERMA8GA1UEAxMIUlQtQUM2NlUxITAfBgkq&#10;hkiG9w0BCQEWEm1lQG15aG9zdC5teWRvbWFpboIJAOesWHeZ7IzRMAwGA1UdEwQF&#10;MAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAtAxqfzMVSa2XKAm6hWHXxDEtw12JjnEL&#10;CnXBCU9eCx26rAIBCMoKlo5JfCjtYk0Kly1Vo48SMpV1QMSeMHhk/ouY+vpmfRNE&#10;pEECxcr/bXb1DwJ3BIUdT+J5MCHB0mlPafqjw+olaO98wb33VumzAMOJuNsySPxd&#10;Fe3nrayb7N8=&#10;-----END CERTIFICATE-----&#10;

But when I click save (without changing anything) the key has become (note the multiple &#38;#10; which shouldn't be there):
Code: 
-----BEGIN CERTIFICATE-----&#38;#10;MIIDNDCCAp2gAwIBAgIJAOesWHeZ7IzRMA0GCSqGSIb3DQEBBQUAMHAxCzAJBgNV&#38;#10;BAYTAlRXMQswCQYDVQQIEwJUVzEPMA0GA1UEBxMGVGFpcGVpMQ0wCwYDVQQKEwRB&#38;#10;U1VTMREwDwYDVQQDEwhSVC1BQzY2VTEhMB8GCSqGSIb3DQEJARYSbWVAbXlob3N0&#38;#10;Lm15ZG9tYWluMB4XDTE1MDkwODEyMDEzMloXDTI1MDkwNTEyMDEzMlowcDELMAkG&#38;#10;A1UEBhMCVFcxCzAJBgNVBAgTAlRXMQ8wDQYDVQQHEwZUYWlwZWkxDTALBgNVBAoT&#38;#10;BEFTVVMxETAPBgNVBAMTCFJULUFDNjZVMSEwHwYJKoZIhvcNAQkBFhJtZUBteWhv&#38;#10;c3QubXlkb21haW4wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOgNBDn+iIqD&#38;#10;gJuvUFapWmENo4Wg1bkaTN4YkCpw5ZqFCVUrWGIUrvRYizAhw13FNUR5eB5J1bX8&#38;#10;pnRyDCdcC6U6mKyc8j8Ug2o++uLaIwIsvl5YVHo+wOlb9bz3cJuhs/1pWtUJlEm4&#38;#10;fOzI5jf08h8a/g76OJj/Yx96DHcbyccPAgMBAAGjgdUwgdIwHQYDVR0OBBYEFNY7&#38;#10;SguheW/hnaDxDoy0CkZ95UTzMIGiBgNVHSMEgZowgZeAFNY7SguheW/hnaDxDoy0&#38;#10;CkZ95UTzoXSkcjBwMQswCQYDVQQGEwJUVzELMAkGA1UECBMCVFcxDzANBgNVBAcT&#38;#10;BlRhaXBlaTENMAsGA1UEChMEQVNVUzERMA8GA1UEAxMIUlQtQUM2NlUxITAfBgkq&#38;#10;hkiG9w0BCQEWEm1lQG15aG9zdC5teWRvbWFpboIJAOesWHeZ7IzRMAwGA1UdEwQF&#38;#10;MAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAtAxqfzMVSa2XKAm6hWHXxDEtw12JjnEL&#38;#10;CnXBCU9eCx26rAIBCMoKlo5JfCjtYk0Kly1Vo48SMpV1QMSeMHhk/ouY+vpmfRNE&#38;#10;pEECxcr/bXb1DwJ3BIUdT+J5MCHB0mlPafqjw+olaO98wb33VumzAMOJuNsySPxd&#38;#10;Fe3nrayb7N8=&#38;#10;-----END CERTIFICATE-----&#38;#10;

Repeating the save (note the multiple &#38;#38;#10; which shouldn't be there):
Code: 
-----BEGIN CERTIFICATE-----&#38;#38;#10;MIIDNDCCAp2gAwIBAgIJAOesWHeZ7IzRMA0GCSqGSIb3DQEBBQUAMHAxCzAJBgNV&#38;#38;#10;BAYTAlRXMQswCQYDVQQIEwJUVzEPMA0GA1UEBxMGVGFpcGVpMQ0wCwYDVQQKEwRB&#38;#38;#10;U1VTMREwDwYDVQQDEwhSVC1BQzY2VTEhMB8GCSqGSIb3DQEJARYSbWVAbXlob3N0&#38;#38;#10;Lm15ZG9tYWluMB4XDTE1MDkwODEyMDEzMloXDTI1MDkwNTEyMDEzMlowcDELMAkG&#38;#38;#10;A1UEBhMCVFcxCzAJBgNVBAgTAlRXMQ8wDQYDVQQHEwZUYWlwZWkxDTALBgNVBAoT&#38;#38;#10;BEFTVVMxETAPBgNVBAMTCFJULUFDNjZVMSEwHwYJKoZIhvcNAQkBFhJtZUBteWhv&#38;#38;#10;c3QubXlkb21haW4wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOgNBDn+iIqD&#38;#38;#10;gJuvUFapWmENo4Wg1bkaTN4YkCpw5ZqFCVUrWGIUrvRYizAhw13FNUR5eB5J1bX8&#38;#38;#10;pnRyDCdcC6U6mKyc8j8Ug2o++uLaIwIsvl5YVHo+wOlb9bz3cJuhs/1pWtUJlEm4&#38;#38;#10;fOzI5jf08h8a/g76OJj/Yx96DHcbyccPAgMBAAGjgdUwgdIwHQYDVR0OBBYEFNY7&#38;#38;#10;SguheW/hnaDxDoy0CkZ95UTzMIGiBgNVHSMEgZowgZeAFNY7SguheW/hnaDxDoy0&#38;#38;#10;CkZ95UTzoXSkcjBwMQswCQYDVQQGEwJUVzELMAkGA1UECBMCVFcxDzANBgNVBAcT&#38;#38;#10;BlRhaXBlaTENMAsGA1UEChMEQVNVUzERMA8GA1UEAxMIUlQtQUM2NlUxITAfBgkq&#38;#38;#10;hkiG9w0BCQEWEm1lQG15aG9zdC5teWRvbWFpboIJAOesWHeZ7IzRMAwGA1UdEwQF&#38;#38;#10;MAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAtAxqfzMVSa2XKAm6hWHXxDEtw12JjnEL&#38;#38;#10;CnXBCU9eCx26rAIBCMoKlo5JfCjtYk0Kly1Vo48SMpV1QMSeMHhk/ouY+vpmfRNE&#38;#38;#10;pEECxcr/bXb1DwJ3BIUdT+J5MCHB0mlPafqjw+olaO98wb33VumzAMOJuNsySPxd&#38;#38;#10;Fe3nrayb7N8=&#38;#38;#10;-----END CERTIFICATE-----&#38;#38;#10;

So when I change something, before even clicking the Apply button it has been modified and became invalid. Making it impossible to change my keys/certificates.

Clearing all fields and saving will get the router to generate new keys and certificates, but they always show up with the &#10; in the web interface.

Edit:
Is there somewhere I can post this bug report?

Clearing a field and hitting the return key a couple times results in this after saving:
Code: 
&#13;&#10;&#13;&#10;&#13;&#10;
 
Last edited:
j0bb13 said:
It seems to be a bug in the Asus firmware. I'm on stock (Firmware Version:3.0.0.4.376_3861)
Edit:
Is there somewhere I can post this bug report?
Click to expand...

That firmware is really old, you should upgrade first. That section of the firmware has changed a lot over the past year.
 
RMerlin said:
That firmware is really old, you should upgrade first. That section of the firmware has changed a lot over the past year.
Click to expand...
It's the latest stable from Asus (2015.03.03), the only newer firmware is a beta from 2015.04.07 (3.0.0.4.378.4850) right?
The release note only said "Add DDNS support method and tutorials on web interface when DDNS is not able to use in some areas.", so I didn't think the beta would be any better.
 
j0bb13 said:
It's the latest stable from Asus (2015.03.03), the only newer firmware is a beta from 2015.04.07 (3.0.0.4.378.4850) right?
The release note only said "Add DDNS support method and tutorials on web interface when DDNS is not able to use in some areas.", so I didn't think the beta would be any better.
Click to expand...

You didn't specify which router model you have so I can't check, but the 376_xxxx codebase is quite old by now.

If there's no non-beta 378_xxxx build yet, 378_4850 is generally a good release from what I remember.

A LOT was changed between 376_xxxx and 378_xxxx, not just what's in the 4850 changelog.
 
RMerlin said:
You didn't specify which router model you have so I can't check, but the 376_xxxx codebase is quite old by now.

If there's no non-beta 378_xxxx build yet, 378_4850 is generally a good release from what I remember.

A LOT was changed between 376_xxxx and 378_xxxx, not just what's in the 4850 changelog.
Click to expand...
You were right, the beta firmware fixed it :)
I assume khaoohs has the same issue. If so, he now knows how to fix it.
 
The following threads together all the relevant items discussed above (in case I need to find consolidated how-to instructions [again]). Credits to previous posters.

I have an ASUS RT-AC3200 (E9200) that I've had similar issues with after upgrading both the ASUS factory firmware to 3.0.0.4.378_7838; and Tunnelblick to 3.5.4 (build 4270.4395).

I ran into similar issues using the default key generated by the interface. I performed OpenSSL dhparam generation from a terminal setting the bit length to 512, 768, and 1024 without success. When I generated a 2048 bit file I was able to establish a tunnel. I haven't tested anything larger as of this writing. (I assume efficiency diminishes as the bit length increases. I also aged 5 years waiting for OpenSSL to generate a 4096 bit test file.)

The steps I followed to get the tunnel to connect properly were as follows:

(1) Per Merlin's instructions:

Open a Unix/BSD/OSX command line terminal and type:

openssl dhparam -out dhparams.pem 2048​

(2) Wait for terminal to complete generating the Diffie Hellman parameters (i.e. get some coffee).

(3) Upon completion, either cat dhparams.pem or open dhparams.pem from an editor and copy the contents (into the clipboard).

(4) Open and login to the ASUS web interface.

(5) Navigate to VPN - OpenVPN and change the OpenVPN Details selection from General to Advance Settings.

(6) Scroll down to where it says "Authorization Mode" (mine is set to TLS) and click on the corresponding yellow link that reads: "Content modification of Keys & Certification."

(7) The link will open a "Keys and Certifications" window with five large input fields. The fourth input field reads: "Diffie Hellman parameters". Paste your Diffie Hellman parameters that you copied from dhparams.pem to that field.

[Note: each field purportedly has a 2,999 character limitation. A 2048 Diffie Hellman parameter file contains a total of 423 characters <including "-----BEGIN DH PARAMETERS-----" and "-----END DH PARAMETERS-----". So there is plenty of room for larger parameter file contents.]

(8) Click the "Save" button at the bottom of that window to close and return to the previous (OpenVPN) window.

(9) Scroll to the bottom of the OpenVPN window and click on the "Accept" button. This should close the Open VPN Advanced Settings window and return you to the OpenVPN General window.

(10) From the General page locate the line that says: "Export OpenVPN configuration file" and click on the "Export" button. A "client.ovpn" should download to your computer.

(11) Navigate (if needed) back to the Home Screen for the Router web interface and click the "Reboot" button at the top of the page.

(12) While the router is rebooting, find the "client.ovpn" file, click (or double click) to open which should should populate the Tunnelblick application Configurations page with client.ovpn.

(13) Rename the "client" configuration appearance and adjust any other relevant settings in Tunnelblick.

(14) Once the router has rebooted, fire up a connection using the new configuration.

(15) Success!

I believe the reboot is required so the OpenVPN daemon running on the router can reload the new Diffie Hellman parameters. (Unless you plan to SSH into the router to cycle the daemon, reboot appears to be your only option.)

As and when there is a stable version of Merlin by Merlin supporting the AC-RT3200/E9200 I'll port it to the router.
 
Last edited:
You must log in or register to reply here.

Similar threads

D
ASUS RT-AX86U OpenVPN Server Error - Key Too Small
Replies
5
Views
1K
David2001
D
V
Unable to get NordVPN to work with Asus RT-AX82U
Replies
1
Views
1K
Befuddled
B
J
ovpn-server log errors meaning?
Replies
11
Views
2K
RMerlin
RMerlin
P
openvpn connection problems
Replies
1
Views
1K
ColinTaylor
C
B
OpenVPN TLS Error: tls-crypt unwrapping failed
Replies
1
Views
3K
brzvlg
B
Similar threads
Thread starter Title Forum Replies Date
G Pi-Hole + Asus WRT Wireguard VPN 1
L Client to client disabled when using static IP on OpenVPN ASUS RT-AC3200 VPN 31
M Asus OpenVpn Server behind behind another router (Google Mesh). VPN 1
F Site To Site VPN between Debian VM and AsusWRT-Merlin router, no routes exists VPN 2

Similar threads

Latest threads

Support SNBForums w/ Amazon

If you'd like to support SNBForums, just use this link and buy anything on Amazon. Thanks!

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!

Members online

Total: 564 (members: 20, guests: 544)
Top