Basic knowledge only--VPN config not right

[jcarrra]

I know a little bit about VPN setups...emphasis on the "little" word.

Here is the situation: I had not used my VPN setup for a while (though it worked before), but an email problem caused ISP to change my public WAN IP, so I know I had to edit the configs in clients.

VPN server is the built in one in ASUS-wrt Merlin 378.56_2.( in AC68U).
Clients are a Galaxy S3, and two Samsung Tab 4's.
All have had working configs in the immediate past, though not used recently.

WHAT I DID.
I edited the existing config ovpn's, replacing only the IP with the new one.
I drove to a public hotspot that requires no password.
No connect by any of the clients. Zero incoming bytes; yes outgoing bytes.
Drove home.
In router, I exported a new client ovpn.
Comparing the CA, keys etc. in new vs. old, I see the CA is different. OH!
(Wonders why, but not the point)
So I know I need to use the newly exported ovpn (all of the config 'commands' were the same as the old one). But see that the sections for
<cert> and
<key>
are empty. The tls-auth section was filled in from what I have stored in the server side.)
So I copy the data for these two sections from the old configs (which did work at one time remember) into the new config. I try the connect test ON MY HOME NET which is the same as net the server is on, and again zero bytes. Now I know this home net test will not make a connect that works, but it usually will send bytes in and out from the client.

Obviously, I have done something wrong, but I do not see what. Ideas?

 

[jcarrra]

Client config
-------------
client
dev tun
proto udp
remote <deleted> 1194
float
cipher AES-256-CBC
comp-lzo adaptive
keepalive 15 60
auth-user-pass
ns-cert-type server
<ca>
-----BEGIN CERTIFICATE-----
MIIDND.................................
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
MIIE2zCC..................................
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
MIIEvAIBA.....................................
-----END PRIVATE KEY-----
</key>
<tls-auth>
-----BEGIN OpenVPN Static key V1-----
458457b......................................
-----END OpenVPN Static key V1-----
</tls-auth>
resolv-retry infinite
nobind

 

[jcarrra]

Further info,
I was a bit wrong above. I took a client with the revised ovpn in it out to the public hotspot, and it did flow traffic both in and out, but never completed a successful negotiation and tunnel setup.

 

[jcarrra]

Wait...above I noted that the ca had changed--would that invalidate the cert and key being used? How do I get new cert and key that will match the ca that the onboard OpenVPN server created?

I do remember that months ago, I went through a process to change from 1024 to 4048 "stuff"--probably in easy-rsa? Gosh, I hope I don't have to go through all that again. Not knowing really what I was doing led to MANY trials and errors.

I just need a simple full tunnel VPN to use when at public hotspots. That's all. Just want to use the OpenVPN Connect app and have an encrypted tunnel out of the public place. I think I am just fixing an IP change and suddenly nothing works. Sigh.

 

[jcarrra]

Well, close this.
I solved it by biting the bullet and rebuilding ALL of the ca, certs, and keys, and dh in easy-rsa. What a pain. But it worked.