Solved OpenVPN server issue

[grifo]

Yeah it's a stable and well maintained app, possibly too well sometimes I think these changes are related to the latest OpenVPN version 2.5.4 released on October 5th, the dev has updated his app straight away and enforced some new security requirements while providing fallback options.

To be fair yesterday's issue (app v. 0.7.25) wasn't due to his app but to the regression that RMerlin mentioned. Today's (v. 0.7.26) it seems that the app won't start the VPN as it rejects the now deprecated BF-CBC cipher but, as written on the notes at the OpenVPN download page, the connection between OpenVPN v2.5 clients and servers (Asuswrt-Merlin is running 2.5.3) should negotiate successfully one of the better ciphers configured regardless of the fallback cipher.

Edit: actually, the problem we saw with v. 0.7.26 is a consequence of the app migration to OpenSSL 3.0 that treats BF-CBC as legacy so it isn't an app issue either. Link: https://www.openssl.org/docs/man3.0/man7/migration_guide.html

 

[elorimer]

I think the BF-CBC might have been fixed in 0.7.27 now.

Through the multiple iteration of allowing OpenVPN to run without
BF-CBC we accidentially made a regression and still required BF-CBC.

This patch fixes the code path and restores its intended function.

 

[grifo]

Yep, just downloaded 0.7.27 and it also works with the Load OpenSSL legacy provider option turned off, so it was an app issue.