Tutorial How to Setup a VPN client including Policy Rules for PIA and other VPN providers 384.5 07.10.18

[Dref]

I have two Pure who I won't recommend and Nord who I have had very few problems with

 

[Patje]

I'm having connection issues using 380.66.6 - Authentication failed.

Jul 3 18:07:43 openvpn[28264]: AUTH: Received control message: AUTH_FAILED
Jul 3 18:07:43 openvpn[28264]: vpnrouting.sh tun13 1500 1622 10.19.10.6 10.19.10.5 init
Jul 3 18:07:43 openvpn-routing: Configuring policy rules for client 3
Jul 3 18:07:43 openvpn-routing: Removing rule 10501 from routing policy
Jul 3 18:07:43 openvpn-routing: Tunnel down - VPN client access blocked
Jul 3 18:07:43 openvpn-routing: Adding route for 192.168.1.8 to 0.0.0.0 through VPN client 3
Jul 3 18:07:43 openvpn-routing: Completed routing policy configuration for client 3
Jul 3 18:07:43 openvpn[28264]: /usr/sbin/ip route del 10.19.10.1/32
Jul 3 18:07:43 openvpn[28264]: ERROR: Linux route delete command failed: external program exited with error status: 2
Jul 3 18:07:43 openvpn[28264]: /usr/sbin/ip route del 37.221.166.146/32
Jul 3 18:07:43 openvpn[28264]: /usr/sbin/ip route del 0.0.0.0/1
Jul 3 18:07:43 openvpn[28264]: ERROR: Linux route delete command failed: external program exited with error status: 2
Jul 3 18:07:43 openvpn[28264]: /usr/sbin/ip route del 128.0.0.0/1
Jul 3 18:07:43 openvpn[28264]: ERROR: Linux route delete command failed: external program exited with error status: 2
Jul 3 18:07:43 openvpn[28264]: Closing TUN/TAP interface

Nothing changed since upgrading, so I'm going back to 380.66.4

I've the excact same problem, but only on client-1.
I'm using 2 clients with the excact same setup except the Server Address.
Client-2 is running with no problem day after day, client-1 is closing the tunnel almost every day

 

[yorgi]

I've the excact same problem, but only on client-1.
I'm using 2 clients with the excact same setup except the Server Address.
Client-2 is running with no problem day after day, client-1 is closing the tunnel almost every day

Hi, you cannot run 2 simultaneous clients from the same company at the same time. This can give you router conflict and you can leak DNS. Enable each client as you need it. or get another service provider for the other client.

 

[Patje]

Hi, you cannot run 2 simultaneous clients from the same company at the same time. This can give you router conflict and you can leak DNS. Enable each client as you need it. or get another service provider for the other client.

Oops,

I did this all the time

 

[yorgi]

Oops,

I did this all the time

If that is the case then default the VPN client that you are having problems with and enter the values again and see what happens. PIA servers are not all alike. some drop and have connection problems when re establishing a connection. Example the montreal server is rock solid and the toronto server is flaky sometimes.
Just to be sure when you default your client 1 put the info of the client 2 instead and put the client 1 on client 2 so you can eliminate the dropping of server being the router or just the server end.

 

[Patje]

If that is the case then default the VPN client that you are having problems with and enter the values again and see what happens. PIA servers are not all alike. some drop and have connection problems when re establishing a connection. Example the montreal server is rock solid and the toronto server is flaky sometimes.
Just to be sure when you default your client 1 put the info of the client 2 instead and put the client 1 on client 2 so you can eliminate the dropping of server being the router or just the server end.

Okay, I'll try some different situations and server addresses.

Thanks,
Patrick


Verzonden vanaf mijn iPhone met Tapatalk

 

[xtropodx]

Ok so haven't been able to get VPN to work, stock firmware & now even Merlin.

ASUS RT-AC3200.
Merlin FW: 380.67.
Went through all settings & made sure they were where I wanted them. Nothing fancy. So...

VPN->OpenVPN Client Settings:
Clicked "Default".
Change all "Basic settings" & apply.
Then;
Import .ovpn file;
-select file.
-upload.
-Popup: "Warning (17) while importing file -
you will need to manually provide the CA, CRL content, on the keys/certificates page."
-2 seconds later page reloads/refreshes & as such;
-settings change, including Username/Password Authentication, they change to router login details.
- .ovpn file is no longer listed on page.


So no matter what I do, every time I upload .ovpn file the page reloads itself. I didn't have this problem on stock firmware. And system logs have nothing that I can see help. So if I can't get this to work, I'll have to roll back to stock firmware as this is only reason I've tried Merlin :/.

EDIT: have tried using FF browser & now IE. Same problem with both.

 

[RMerlin]

-Popup: "Warning (17) while importing file -
you will need to manually provide the CA, CRL content, on the keys/certificates page."

Did you do what it said in that popup?

- .ovpn file is no longer listed on page.

That's normal. The file is only used to import settings, afterward it's discarded.

 

[xtropodx]

Did you do what it said in that popup?

Yeah, however still wouldn't work. So uploaded .ovpn file first & then all other settings, which isn't really explicitly clear in any instructions I've read (to be fair, it is a little confusing, as you need to upload ovpn first, then go through basic settings, THEN change service state. Not intuitive for first time users). SHA256/AES-256-CBC fails to authenticate so still trying to troubleshoot this, but least have SHA1/AES-128-CBC working for now.

That's normal. The file is only used to import settings, afterward it's discarded.

Should be changed so as to show user it's got settings loaded etc. I'm sure stock FW still lists/updates details. Would reduce user headache.

Thanks

 

[Xentrk]

Yeah, however still wouldn't work. So uploaded .ovpn file first & then all other settings, which isn't really explicitly clear in any instructions I've read (to be fair, it is a little confusing, as you need to upload ovpn first, then go through basic settings, THEN change service state. Not intuitive for first time users). SHA256/AES-256-CBC fails to authenticate so still trying to troubleshoot this, but least have SHA1/AES-128-CBC working for now.


Should be changed so as to show user it's got settings loaded etc. I'm sure stock FW still lists/updates details. Would reduce user headache.

Thanks

Can you post a screen shot of your OpenVPN Client page? I'll look it over to see if I can spot the issue. Who is your provider?

Look at this guide to see if it is of any help.
https://www.snbforums.com/threads/torguard-openvpn-2-4-client-setup-for-asus-merlin-380-65-380-65_2-part-i.38281/

https://www.snbforums.com/threads/torguard-openvpn-2-4-client-setup-for-asus-merlin-380-65-380-65_2-part-ii.38282/

https://www.snbforums.com/threads/torguard-openvpn-2-4-client-setup-for-asus-merlin-380-65-380-65_2-part-iii.38283/

 

[RMerlin]

Should be changed so as to show user it's got settings loaded etc.

The fact that all the settings get changed beneath should be a visual cue as to this having happened.

I'm sure stock FW still lists/updates details.

It doesn't. And in fact my firmware does provide more feedback, as stock firmware won't let you know that you have to manually enter the CA/CRL (and my firmware will even tell you which of these need to be manually entered - with the stock firmware you will have to guess).

 

[xtropodx]

Thanks for the help .

SHA256/AES-256-CBC fails to authenticate so still trying to troubleshoot this.

Oddly enough, this is now working despite no changes by me . EDIT: nope, spoke to soon. Now neither work.

On side note: Service State refuses to stay off if router gets rebooted.
And every 2nd time item gets changed, it's doing "Please wait,193% Applying Settings" ie 200% lol

 

[yorgi]

Thanks for the help .



Oddly enough, this is now working despite no changes by me . EDIT: nope, spoke to soon. Now neither work.

On side note: Service State refuses to stay off if router gets rebooted.
And every 2nd time item gets changed, it's doing "Please wait,193% Applying Settings" ie 200% lol

If you don't want the service to start when you reboot the router take out the option start at WAN.
maybe you downloaded the wrong certificates for 256, default the VPN client and start it again.
There is no way that PIA won't work on Merlin. At one point I noticed PIA was making some changes to their servers and connections would time out or error on connection. Its now stable and I don't see that problem anymore.
Double check your options and I would suggest default the VPN then reboot the router and put the info in there again and see what happens. IF you are still getting these problems then you should consider factory reset the router.

 

[yorgi]

Ok so haven't been able to get VPN to work, stock firmware & now even Merlin.

ASUS RT-AC3200.
Merlin FW: 380.67.
Went through all settings & made sure they were where I wanted them. Nothing fancy. So...

VPN->OpenVPN Client Settings:
Clicked "Default".
Change all "Basic settings" & apply.
Then;
Import .ovpn file;
-select file.
-upload.
-Popup: "Warning (17) while importing file -
you will need to manually provide the CA, CRL content, on the keys/certificates page."
-2 seconds later page reloads/refreshes & as such;
-settings change, including Username/Password Authentication, they change to router login details.
- .ovpn file is no longer listed on page.


So no matter what I do, every time I upload .ovpn file the page reloads itself. I didn't have this problem on stock firmware. And system logs have nothing that I can see help. So if I can't get this to work, I'll have to roll back to stock firmware as this is only reason I've tried Merlin :/.

EDIT: have tried using FF browser & now IE. Same problem with both.

can you upload your .ovpn file here so I can see it. I can tell you how to manually configure the router if I see the file.

 

[xtropodx]

If you don't want the service to start when you reboot the router take out the option start at WAN.
maybe you downloaded the wrong certificates for 256, default the VPN client and start it again.
There is no way that PIA won't work on Merlin. At one point I noticed PIA was making some changes to their servers and connections would time out or error on connection. Its now stable and I don't see that problem anymore.
Double check your options and I would suggest default the VPN then reboot the router and put the info in there again and see what happens. IF you are still getting these problems then you should consider factory reset the router.

Decided to start from scratch again incase I missed something as things were getting weird . Seems to be all working now, will upload stuff if have problem again. Thanks .

 

[Cat47]

can you upload your .ovpn file here so I can see it. I can tell you how to manually configure the router if I see the file.

Hi

I have just joined the forum, I got an Asus DSL 68U router/modem yesterday, I want to set up a VPN client and I am with PIA for VPN.

I have read up on getting the Merlin firmware into the router but I am having problems, it's telling me that the firmware is invalid, I tried rebooting, I tried using the original Asus firmware and the latest Asus firmware, I just cannot get the firmware accepted by the router.

I must be doing something wrong, I am going to read this forum and see if this thread or another has the information, sorry to post first but there are a lot of posts and if you or someone else has the info I need it will help me faster if I get a response.

All I want to do is setup the router so everything except the X Box One S goes through a VPN, I hope that is possible but first I need to be able to get the Merlin firmware installed.

I also do not know what PIA certificate and CA to install, I wonder if someone has links, I want to use Open VPN.

Thanks in advance.

 

[pusb87]

Hi

I have just joined the forum, I got an Asus DSL 68U yesterday, I want to set up a VPN client and I am with PIA for VPN.

I have read up on getting the Merlin firmware into the router but I am having problems, it's telling me that the firmware is invalid, I tried rebooting, I tried using the original Asus firmware and the latest Asus firmware, I just cannot get the firmware accepted by the router.

I must be doing something wrong, I am going to read this forum and see if this thread or another has the information, sorry to post first but there are a lot of posts and if you or someone else has the info I need it will help me faster if I get a response.

All I want to do is setup the router so everything except the X Box One S goes through a VPN, I hope that is possible but first I need to be able to get the Merlin firmware installed.

I also do not know what PIA certificate and CA to install, I wonder if someone has links, I want to use Open VPN.

Thanks in advance.

i don't think the Asus DSL 68U modem/router is supported by Merlin
see here >> https://www.snbforums.com/threads/asus-dsl-ac68u-merlin-firmware.18261/

 

[Cat47]

i don't think the Asus DSL 68U modem/router is supported by Merlin
see here >> https://www.snbforums.com/threads/asus-dsl-ac68u-merlin-firmware.18261/

Oh pity, yeah just read that link.

Can I get a VPN client to work without the Merlin software, I mean Asus put the software in there, so wouldn't it be possible to get it working with just the stock firmware, probably the wrong thread for that question so I will search the forum and ask in another thread.

It all works now, I have a VPN via my router, I usually get 30Mbps to 35Mbps depending on time of the day, I am getting 20Mbps via the VPN, all good for me, very happy now.

This is the advice I followed, changing DNS was the issue for me and why it didn't work yesterday.

https://www.privateinternetaccess.c...-to-openvpn-client-with-asus-asuswrt-firmware

For anyone else with a DSL version of the Asus router, try the advice above.

 

[yorgi]

I am not sure if this is happening to others but every 24 hours or so I get a authentication error can't establish connection with OpenVPN client.
I never had this issue in the past, its only with recent updated firmware .67

I read this on github
https://github.com/RMerl/asuswrt-merlin/issues/1214

If we use this script https://github.com/RMerl/asuswrt-merlin/commit/6dcc3cfd20bd47f6613b4ab25c115fbcaa6d7d3f where do we load it in Jffs scripts?

Thanks

 

[yorgi]

My buddy is running 87U like me but he had enough of this issue and went back a few firmware releases and has no problem anymore.
I told him not to do this as there where security issues fixed with the updates so if there is a way to fix this annoying bug would be great