Open VPN files generated by 380.65+ no longer work with Tunnelblick

[Michael W]

Dear Merlin,

thank you for your excellent firmware.

Until before version 380.65, Tunnelblick handled .ovpn files generated by your firmware without any problems (it was possible to use various options settings).

Starting with version 380.65, Tunnelblick cannot open connections based on .ovpn files generated by your firmware anymore.

The following error is generated:

"Options error: Unrecognized option or missing parameter(s) in /Library/Application Support/Tunnelblick/Shared/XXXXXX.tblk/Contents/Resources/config.ovpn:6: ncp-ciphers (2.3.14)"

I have verified the issue with another Open VPN client, Viscosity. Viscosity is also unable to open a connection based on .ovpn files generated by AsusWrt 380.65 or later.

Is there a way around this issue apart from changing back to a version prior to 380.65?

Thanks again for your amazing work,
Best regards,

Michael

 

[cybrnook]

What encryption ciphers are you setting, and what do they want? The new firmware has openvpn 2.4.0, so there are some changes that have happened. You may need to do some adjustments by hand (I would have assumed you have already tried that...).

 

[sfx2000]

if i recall correctly - 380.65 introduced OpenVPN 2.4...

Ensure your version of tunnelblick is up to date...

https://tunnelblick.net/cRlsNotes.html

 

[RMerlin]

Disable any setting that reports as requiring OpenVPN 2.4 - it's displayed on the webui, or upgrade your clients to 2.4.1.

 

[Michael W]

Thank you, problem solved

VPN / Open VPN Servers / Advanced Settings / Cipher negotiation disabled does the trick...

I am however using the latest beta version of Tunnelblick, it seems they have not implemented some features yet...

 

[RMerlin]

Thank you, problem solved

VPN / Open VPN Servers / Advanced Settings / Cipher negotiation disabled does the trick...

I am however using the latest beta version of Tunnelblick, it seems they have not implemented some features yet...

According to the log you posted, your Tunnelblick was using OpenVPN 2.3.14.

 

[highwire]

Tunnelblick 3.7.1beta02 gives the user a few options though the default is still OpenVPN 2.3.14 with openSSL 1.0.2k. I configured it with OpenVPN 2.4.1 with LibreSSL 2.5.0 and it works well.

 

[Michael W]

Indeed, the Tunnelblick Release Notes of the latest beta (3.7.1 beta 02 build 4810) state that it "includes OpenVPN 2.4.1 and OpenVPN 2.3.14" but unless one manually changes the settings, it defaults to OpenVPN 2.3.14.

The latest regular Tunnelblick Release (3.7.0 build 4790) does not include OpenVPN 2.4.1 yet.

The latest version of Viscosity (1.6.8) only includes OpenVPN 2.3.14.

I don't know what the situation is for Windows users - but for Mac users it would appear that the current default settings of the OpenVPN server (as introduced with version 380.65) might make it quite hard for non tech-savvy users to use OpenVPN.

Thanks again to everyone here!

 

[bobiii]

Since we're talking about vpn's. Would somebody be kind enough to make recommendations for a openvpn client provider? I need to install on my rt-ac5300 to protect all in the home. Thanks!

 

[Makaveli]

Since we're talking about vpn's. Would somebody be kind enough to make recommendations for a openvpn client provider? I need to install on my rt-ac5300 to protect all in the home. Thanks!

Maybe better to create your own thread for this instead of asking in someones topic which isn't related to VPN recommendations?