Chromebook Notes.
Chromebooks are a little more complicated to set up as clients. If you just import the certificates, then you can use the native OpenVPN client to make a connection, but you are stuck with the defaults: I'm not sure what you end up with port, redirection, protocol, cipher, compression, etc. If you want to control this, you need to do something more complicated. If the Chromebook supports Android apps, then you can use the unofficial client in the Play store (blinkt.de) and import the four clients directly. The official openvpn client doesn't work well, in my experience. Note the unofficial client has extensive logging but you can filter it to show different levels, so it is very good for debugging. EDIT: as of October 2021, the unofficial client will throw a fatal error with certificates encoded with SHA1. You need to add
tls-cipher DEFAULT:@SECLEVEL=0 to the configuration to make it work. Here SHA1 isn't a problem. Note that the Merlin firmware on the 386 branch before 386.4 currently generates new certs with SHA1. Older and newer firmware uses SHA256. This is an error in Asus's code.
If the Chromebook doesn't support Android apps, or you want to set up a native VPN connection, then you need to create .onc files for the four configurations. Follow this post for instructions:
Success: Chromebook VPN Client with Merlin. Note that as of 2022 these have changed slightly; the .onc block is imported in a different place (the old place points you to the correct place), and now when you import the block you see a message of how many configs were imported (yay! before it was a silent fail).
Eight things to note:
1. It doesn't appear that a Chromebook can import two .p12 files for the same router. So, when you are setting up the second server, edit the keys by copying each block from the first server to the second server, so they are the same. Check when you export the file for the second server, as it may not include all of the keys in the .ovpn file. In this case you will need to copy the missing keys from the first server's .ovpn file. Or, if the first .ovpn file is working, you can just edit it to correct the port/protocol settings and save it for the second server. Also, I have had it happen that the keys that are exported are not those listed in the GUI, and if you edit the .ovpn file to include the keys listed in the GUI, there is still an authentication hang. If you are having authentication issues, set the servers back to default and start over.
2. Each .onc file has two main sections. The first identifies the keys by a GUID number. This will be the same in all four .onc files. The second section identifies the unique configuration. This has its own GUID number and appears once; in this section the GUID number in the first section appears again twice. You cannot import a configuration unless the second GUID number and the name of the configuration are unique, and an import will fail silently! There isn't magic in this GUID number, though, so for the first configuration file you set up, change the last digit to "1" and give it the name of the equivalent .ovpn file. In the second, change the last digit of the GUID number to "2" and give it the name of the equivalent .ovpn file, and so on for all 4 files. With each .onc file, edit the configuration to change the port and protocol to match the equivalent .ovpn file. For the two configurations that will ignore the server's default gateway, include a line in the second block:
Code:
"IgnoreDefaultRoute": true,
Include the quotes, and note the line ends with a comma. Then import the four files. The only way to see an import is successful (other than digging into the Chromebook logs), is that the configs will appear in the VPN settings section or the system tray.
3. The unofficial Android app can save user name and password combinations, so if you do that, make sure you give the Chromebook a secure password, otherwise anyone with possession of the Chromebook will be able to log into your server and access your LAN. The native OpenVPN setup won't use a password even if it is in the .onc file until after you make a connection. That is, if you include them, the connection will fail the first time, and you will have to enter the password. Afterwards it will connect automatically, although my experience varies.
4. If you powerwash the Chromebook (or it resets itself), the VPN configurations are deleted. So you may want to save the configurations on Google Drive or on a thumb drive to reimport them.
5. You can combine the four .onc files into one, if you are careful, and this can be convenient. The second section starts with this line:
Code:
"NetworkConfigurations": [ {
, and the whole thing ends with a }]. Each section enclosed in curly brackets is a separate network configuration, with all the network configurations enclosed in the square brackets. So when you have the first configuration done, copy and paste it three times below (with the curly brackets). Because we are declaring a JSON array here, add a comma between the close curly bracket of the first configuration and the open curly bracket of the second configuration, and so on between the second and third, and the third and the fourth. Then edit the other three configurations to specify a different GUID number (1, 2, 3 and 4) and then edit the port/protocol combinations and the friendly names. Then you can import just the one .onc file. You end up with something like this:
Code:
{
"Type": "UnencryptedConfiguration",
"Certificates": [{
"GUID": "{FIRSTGUID#}",
"Type": "Authority",
"X509": "ONELINECERTIFICATE"
}
],
"NetworkConfigurations": [
{
"GUID": "{SECONDGUID#1}",
"Name": "Home 443 redir",
"Type": "VPN",
"VPN": {
"Type": "OpenVPN",
"Host": "YOURSERVERDDNSADDRESS",
"OpenVPN": {
"Port": 443,
"UserAuthenticationType": "Password",
"Proto": "tcp",
"RemoteCertTLS": "server",
"Cipher": "AES-256-GCM",
"Username": "YOURNAME",
"Password": "YOURPASSWORD",
"ServerCARefs": [
"{FIRSTGUID#}"
],
"ClientCertType": "Pattern",
"ClientCertPattern": {
"IssuerCARef": [ "{FIRSTGUID#}" ]
},
}
}
},
{
"GUID": "{SECONDGUID#2}",
"Name": "Home 443 no redir",
"Type": "VPN",
"VPN": {
"Type": "OpenVPN",
"Host": "YOURSERVERDDNSADDRESS",
"OpenVPN": {
"Port": 443,
"UserAuthenticationType": "Password",
"Proto": "tcp",
"IgnoreDefaultRoute": true,
"RemoteCertTLS": "server",
"Cipher": "AES-256-GCM",
"Username": "YOURNAME",
"Password": "YOURPASSWORD",
"ServerCARefs": [
"{FIRSTGUID#}"
],
"ClientCertType": "Pattern",
"ClientCertPattern": {
"IssuerCARef": [ "{FIRSTGUID#}" ]
},
}
}
},
{
"GUID": "{SECONDGUID#3}",
"Name": "Home 1194 redir",
"Type": "VPN",
"VPN": {
"Type": "OpenVPN",
"Host": "YOURSERVERDDNSADDRESS",
"OpenVPN": {
"Port": 1194,
"UserAuthenticationType": "Password",
"Proto": "udp",
"RemoteCertTLS": "server",
"Cipher": "AES-256-GCM",
"Username": "YOURNAME",
"Password": "YOURPASSWORD",
"ServerCARefs": [
"{FIRSTGUID#}"
],
"ClientCertType": "Pattern",
"ClientCertPattern": {
"IssuerCARef": [ "{FIRSTGUID#}" ]
},
}
}
},
{
"GUID": "{SECONDGUID#4}",
"Name": "Home 1194 no redir",
"Type": "VPN",
"VPN": {
"Type": "OpenVPN",
"Host": "YOURSERVERDDNSADDRESS",
"OpenVPN": {
"Port": 1194,
"UserAuthenticationType": "Password",
"Proto": "udp",
"IgnoreDefaultRoute": true,
"RemoteCertTLS": "server",
"Cipher": "AES-256-GCM",
"Username": "YOURNAME",
"Password": "YOURPASSWORD",
"ServerCARefs": [
"{FIRSTGUID#}"
],
"ClientCertType": "Pattern",
"ClientCertPattern": {
"IssuerCARef": [ "{FIRSTGUID#}" ]
},
}
}
}
]
}
6. If you have configurations for two servers, Chrome may pick up the wrong server ca. When you first open the VPN configuration to start, you may have to correct the server ca in two places to identify the correct server. Generally, these are the model numbers of the Asus routers.
7. If you add TLS-auth to the server config, add a line in each individual connection to read:
Code:
"TLSAuthContents": "ONELINECERTWITHthe Begin and End Lines",
Note that ONC doesn't understand tls-crypt. This may be a different reason to differentiate the two servers, so that one is tls-auth, and the other the more secure tls-crypt.
8. If you want compression, note that the .onc block descriptions afoot are incorrect in some respects.
https://bugs.chromium.org/p/chromium/issues/detail?id=1212518&q=onc&can=2
Edited 12/28/19 to add notes 5 and 6.
Edited 12/7/20 to add note 7.
Edited 6/10/21 to add note 8.
Edited 10/9/21 to reference SHA1 certs in first paragraph.
