GL-MT300N-V2 v.3.011 OpenVPN - #3

GL-FUN · 2019-01-19T04:48:31.793Z

Greetings All

I acquired a new OpenVPN provider - Ivacy (lifetime offer ends soon) - and the router throws a WARNING:
daemon.warn openvpn[31059]: WARNING: No server certificate verification method has been enabled.

their OpenVPN config Files look like this (with the referenced certificates provided):
client
dev tun
remote au1-ovpn-udp.ivacy.net 53
proto udp
nobind
persist-key
persist-tun
tls-auth Wdc.key 1
ca ca.crt
cipher AES-256-CBC
comp-lzo
verb 1
mute 20
float
route-method exe
route-delay 2
auth-user-pass
auth-retry interact
explicit-exit-notify 2
ifconfig-nowarn
auth-nocache

I am wondering, if GL-MT300N-V2 v.3.011 actually correctly recognizes these configs or shall the certs need to be imbedded in the file as SaferVPN uses:
client
dev tun
proto udp
cipher AES-256-CBC
remote-cert-tls server
remote au1.safervpn.net 1194 # - Your server IP and OpenVPN Port
resolv-retry infinite
nobind
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
persist-key
persist-tun
auth-user-pass
comp-lzo
verb 3
bracket ca bracket
-----BEGIN CERTIFICATE-----
MIIE1jCCA76gAwIBAgIJAOnRq4FWsZgYMA0GCSqGSIb3DQEBCwUAMIGiMQswCQYD
VQQGEwJVUzELMAkGA1UECBMCQ0ExFTATBgNVBAcTDFNhbkZyYW5jaXNjbzERMA8G
A1UEChMIU2FmZXJWUE4xETAPBgNVBAsTCFNhZmVyVlBOMREwDwYDVQQDEwhTYWZl
clZQTjERMA8GA1UEKRMIU2FmZXJWUE4xIzAhBgkqhkiG9w0BCQEWFHN1cHBvcnRA
c2FmZXJ2cG4uY29tMB4XDTE3MDgzMTA5NDEyM1oXDTI3MDgyOTA5NDEyM1owgaIx
CzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDQTEVMBMGA1UEBxMMU2FuRnJhbmNpc2Nv
MREwDwYDVQQKEwhTYWZlclZQTjERMA8GA1UECxMIU2FmZXJWUE4xETAPBgNVBAMT
CFNhZmVyVlBOMREwDwYDVQQpEwhTYWZlclZQTjEjMCEGCSqGSIb3DQEJARYUc3Vw
cG9ydEBzYWZlcnZwbi5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
AQCqNV7oJZrUqD/mBSWlKi/sGRE2y3Yphs5m/vmmS4GPrc8lyaI1idhv44MGZ0i1
XCkJFZmaVQk7NUz5npz9hcnxN3MiZd/5Kv8Vo4aQkL0xQ7euto71LIgTqbJvTJjW
kowsVVgartGK2ewfCd+KV6k5oBImlDdSnLW1pq82Kg+YcnXxdaFc8RpNWdBbdxBe
tb4k6JcoZHuk9Zq5gi5Nnhtjc6lheCRzTGZ2hslDfJ58yMpR0jTMC3Rd+G+sM0q3
/gEEEW34ckUgCb5j6Kq35LUlnuonnViBnEzFR/MTizMARFj7VYkzOpxSsxJ6Epan
JP8Zgbz81z4A822hosakl7kTAgMBAAGjggELMIIBBzAdBgNVHQ4EFgQUKSnUrJLQ
omrGvdncxKkKT7Rxrj8wgdcGA1UdIwSBzzCBzIAUKSnUrJLQomrGvdncxKkKT7Rx
rj+hgaikgaUwgaIxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDQTEVMBMGA1UEBxMM
U2FuRnJhbmNpc2NvMREwDwYDVQQKEwhTYWZlclZQTjERMA8GA1UECxMIU2FmZXJW
UE4xETAPBgNVBAMTCFNhZmVyVlBOMREwDwYDVQQpEwhTYWZlclZQTjEjMCEGCSqG
SIb3DQEJARYUc3VwcG9ydEBzYWZlcnZwbi5jb22CCQDp0auBVrGYGDAMBgNVHRME
BTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQB704c0nixfDuJ7OiFBUmkhmDUFEIhl
D35wxlthKYRs8tBzetZEipFGdyUOwuWiuwG/BuOwuP7fPS9uP4u4EPKjA5kL/Z/V
E743q50PS4L/kT3ZFyUrcisUKajAr5Gu+o6rzA6F4+QYu26iBbKewNrrb+riF1wR
GKthc6W++Awt+oVyKtVNyS2QokuBFcSu5IiVsfGqJ8TmffvFBqKUUjWopmP+qiYR
8+0qwHing/S/C9S72ZxhM9DF3et1dXFuHf/69YL8/u36tyKMqy/JVhByAlc87cRI
tcRGaviUttBeSw4j1Y6XrycVkhn4LzizWrqrmfCikhx26MrIeWK5JxYL
-----END CERTIFICATE-----
bracket /ca bracket

alzhao · 2019-01-19T06:50:44.018Z

certificate can be embedded or linked. Warning may not matter.

What else is displayed in log?

glitch · 2019-01-19T09:17:34.662Z

Safer then Ivacy? You certainly know how to pick providers!

Anyhow, back to the “problem” - Ivacy works fine with the ovpn files provided. Just ignore the log errors

GL-FUN · 2019-01-19T14:26:15.766Z

@glitch - LoL, my choice is pure consideration of cost/quality (speed, bandwidth, geographical spread, reviews 10 Best VPN Services (2022): Security, Features + Speed and personal tests). crackberry had a lifetime 39$ promotion for ivacy and I trust those folks CrackBerry | The #1 Site for BlackBerry Users (and Abusers!) - the same directly with 20% discount was 48$+60$

@alzhao - this is my connection log
Sat Jan 19 05:11:58 2019 user.info : 1267: gl-vpn-client>> Start, vpnpath=/etc/openvpn/ovpn1, serverfile=United Kingdom-London-UDP.ovpn
Sat Jan 19 05:11:58 2019 user.info : 1341: gl-vpn-client>> glconfig.openvpn.ovpn=/etc/openvpn/ovpn1/United Kingdom-London-UDP.ovpn, glconfig.openvpn.clientid=ovpn1
Sat Jan 19 05:12:00 2019 daemon.info dnsmasq[20986]: exiting on receipt of SIGTERM
Sat Jan 19 05:12:00 2019 user.notice dnsmasq: DNS rebinding protection is active, will discard upstream RFC1918 responses!
Sat Jan 19 05:12:00 2019 user.notice dnsmasq: Allowing 127.0.0.0/8 responses
Sat Jan 19 05:12:01 2019 daemon.info dnsmasq[22513]: started, version 2.80test2 cachesize 150
Sat Jan 19 05:12:01 2019 daemon.info dnsmasq[22513]: DNS service limited to local subnets
Sat Jan 19 05:12:01 2019 daemon.info dnsmasq[22513]: compile time options: IPv6 GNU-getopt no-DBus no-i18n no-IDN DHCP no-DHCPv6 no-Lua TFTP no-conntrack no-ipset no-auth no-DNSSEC no-ID loop-detect inotify dumpfile
Sat Jan 19 05:12:01 2019 daemon.info dnsmasq-dhcp[22513]: DHCP, IP range 192.168.8.100 – 192.168.8.249, lease time 12h
Sat Jan 19 05:12:01 2019 daemon.info dnsmasq[22513]: using local addresses only for domain test
Sat Jan 19 05:12:01 2019 daemon.info dnsmasq[22513]: using local addresses only for domain onion
Sat Jan 19 05:12:01 2019 daemon.info dnsmasq[22513]: using local addresses only for domain localhost
Sat Jan 19 05:12:01 2019 daemon.info dnsmasq[22513]: using local addresses only for domain local
Sat Jan 19 05:12:01 2019 daemon.info dnsmasq[22513]: using local addresses only for domain invalid
Sat Jan 19 05:12:01 2019 daemon.info dnsmasq[22513]: using local addresses only for domain bind
Sat Jan 19 05:12:01 2019 daemon.info dnsmasq[22513]: using nameserver 8.8.8.8#53
Sat Jan 19 05:12:01 2019 daemon.info dnsmasq[22513]: using nameserver 9.9.9.9#53
Sat Jan 19 05:12:01 2019 daemon.info dnsmasq[22513]: using local addresses only for domain lan
Sat Jan 19 05:12:01 2019 daemon.info dnsmasq[22513]: read /etc/hosts - 4 addresses
Sat Jan 19 05:12:01 2019 daemon.info dnsmasq[22513]: read /tmp/hosts/dhcp.cfg01411c - 3 addresses
Sat Jan 19 05:12:01 2019 daemon.info dnsmasq-dhcp[22513]: read /etc/ethers - 0 addresses
Sat Jan 19 05:12:04 2019 daemon.notice openvpn[22651]: OpenVPN 2.4.5 mipsel-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
Sat Jan 19 05:12:04 2019 daemon.notice openvpn[22651]: library versions: OpenSSL 1.0.2o 27 Mar 2018, LZO 2.10
Sat Jan 19 05:12:04 2019 daemon.warn openvpn[22655]: WARNING: No server certificate verification method has been enabled. See How To Guide: Set Up & Configure OpenVPN Client/server VPN | OpenVPN for more info.
Sat Jan 19 05:12:04 2019 daemon.warn openvpn[22655]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Sat Jan 19 05:12:04 2019 daemon.notice openvpn[22655]: TCP/UDP: Preserving recently used remote address: [AF_INET]46.243.235.5:53
Sat Jan 19 05:12:04 2019 daemon.notice openvpn[22655]: UDP link local: (not bound)
Sat Jan 19 05:12:04 2019 daemon.notice openvpn[22655]: UDP link remote: [AF_INET]46.243.235.5:53
Sat Jan 19 05:12:07 2019 daemon.notice netifd: Network device ‘ra0’ link is down
Sat Jan 19 05:12:09 2019 daemon.notice netifd: Network device ‘ra0’ link is up
Sat Jan 19 05:12:09 2019 daemon.notice netifd: wan (20972): udhcpc: received SIGTERM
Sat Jan 19 05:12:09 2019 daemon.notice netifd: Interface ‘wan’ is now down
Sat Jan 19 05:12:09 2019 daemon.notice netifd: Interface ‘wan’ is setting up now
Sat Jan 19 05:12:11 2019 daemon.notice netifd: Network device ‘ra0’ link is down
Sat Jan 19 05:12:11 2019 daemon.notice netifd: wan (22768): udhcpc: started, v1.28.3
Sat Jan 19 05:12:13 2019 daemon.notice netifd: Network device ‘ra0’ link is up
Sat Jan 19 05:12:13 2019 daemon.notice netifd: wan (22768): udhcpc: sending discover
Sat Jan 19 05:12:13 2019 daemon.info dnsmasq-dhcp[22513]: DHCPREQUEST(br-lan) 192.168.8.170 00:0f:00:00:00:00
Sat Jan 19 05:12:13 2019 daemon.info dnsmasq-dhcp[22513]: DHCPACK(br-lan) 192.168.8.170 00:0f:00:00:00:00
Sat Jan 19 05:12:17 2019 daemon.notice netifd: Network device ‘ra0’ link is down
Sat Jan 19 05:12:17 2019 daemon.notice netifd: wan (22768): udhcpc: sending discover
Sat Jan 19 05:12:19 2019 daemon.notice netifd: Network device ‘ra0’ link is up
Sat Jan 19 05:12:20 2019 daemon.notice netifd: wan (22768): udhcpc: sending discover
Sat Jan 19 05:12:21 2019 daemon.err openvpn[22655]: write UDP: Network unreachable (code=128)
Sat Jan 19 05:12:23 2019 daemon.err openvpn[22655]: write UDP: Network unreachable (code=128)
Sat Jan 19 05:12:23 2019 daemon.notice netifd: wan (22768): udhcpc: sending select for 192.168.1.166
Sat Jan 19 05:12:23 2019 daemon.notice netifd: wan (22768): udhcpc: lease of 192.168.1.166 obtained, lease time 864000
Sat Jan 19 05:12:23 2019 daemon.notice netifd: Interface ‘wan’ is now up
Sat Jan 19 05:12:24 2019 daemon.info dnsmasq-dhcp[22513]: DHCPREQUEST(br-lan) 192.168.8.170 00:0f:00:00:00:00
Sat Jan 19 05:12:24 2019 daemon.info dnsmasq-dhcp[22513]: DHCPACK(br-lan) 192.168.8.170 00:0f:00:00:00:00
Sat Jan 19 05:12:27 2019 daemon.notice openvpn[22655]: [Secure-Server] Peer Connection Initiated with [AF_INET]46.243.235.5:53
Sat Jan 19 05:12:29 2019 user.notice firewall: Reloading firewall due to ifup of wan (eth0.2)
Sat Jan 19 05:12:43 2019 daemon.notice netifd: Interface ‘VPN_client’ is enabled
Sat Jan 19 05:12:43 2019 daemon.notice netifd: Interface ‘ovpn’ is enabled
Sat Jan 19 05:12:43 2019 daemon.notice netifd: Network device ‘tun0’ link is up
Sat Jan 19 05:12:43 2019 daemon.notice netifd: Interface ‘VPN_client’ has link connectivity
Sat Jan 19 05:12:43 2019 daemon.notice netifd: Interface ‘VPN_client’ is setting up now
Sat Jan 19 05:12:43 2019 daemon.notice openvpn[22655]: TUN/TAP device tun0 opened
Sat Jan 19 05:12:43 2019 daemon.notice netifd: Interface ‘VPN_client’ is now up
Sat Jan 19 05:12:43 2019 daemon.notice openvpn[22655]: do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Sat Jan 19 05:12:43 2019 daemon.notice openvpn[22655]: /sbin/ifconfig tun0 46.243.235.239 netmask 255.255.255.192 mtu 1500 broadcast 46.243.235.255
Sat Jan 19 05:12:43 2019 daemon.notice netifd: Interface ‘ovpn’ has link connectivity
Sat Jan 19 05:12:43 2019 daemon.notice netifd: Interface ‘ovpn’ is setting up now
Sat Jan 19 05:12:43 2019 daemon.notice netifd: Interface ‘ovpn’ is now up
Sat Jan 19 05:12:43 2019 daemon.notice openvpn[22655]: /etc/openvpn/update-resolv-conf tun0 1500 1558 46.243.235.239 255.255.255.192 init
Sat Jan 19 05:12:43 2019 daemon.info dnsmasq[22513]: exiting on receipt of SIGTERM
Sat Jan 19 05:12:44 2019 daemon.info odhcpd[1462]: Using a RA lifetime of 0 seconds on br-lan
Sat Jan 19 05:12:44 2019 user.notice dnsmasq: DNS rebinding protection is active, will discard upstream RFC1918 responses!
Sat Jan 19 05:12:44 2019 user.notice dnsmasq: Allowing 127.0.0.0/8 responses
Sat Jan 19 05:12:46 2019 daemon.info dnsmasq[23945]: started, version 2.80test2 cachesize 150
Sat Jan 19 05:12:46 2019 daemon.info dnsmasq[23945]: DNS service limited to local subnets
Sat Jan 19 05:12:46 2019 daemon.info dnsmasq[23945]: compile time options: IPv6 GNU-getopt no-DBus no-i18n no-IDN DHCP no-DHCPv6 no-Lua TFTP no-conntrack no-ipset no-auth no-DNSSEC no-ID loop-detect inotify dumpfile
Sat Jan 19 05:12:46 2019 daemon.info dnsmasq-dhcp[23945]: DHCP, IP range 192.168.8.100 – 192.168.8.249, lease time 12h
Sat Jan 19 05:12:46 2019 daemon.info dnsmasq[23945]: using local addresses only for domain test
Sat Jan 19 05:12:46 2019 daemon.info dnsmasq[23945]: using local addresses only for domain onion
Sat Jan 19 05:12:46 2019 daemon.info dnsmasq[23945]: using local addresses only for domain localhost
Sat Jan 19 05:12:46 2019 daemon.info dnsmasq[23945]: using local addresses only for domain local
Sat Jan 19 05:12:46 2019 daemon.info dnsmasq[23945]: using local addresses only for domain invalid
Sat Jan 19 05:12:46 2019 daemon.info dnsmasq[23945]: using local addresses only for domain bind
Sat Jan 19 05:12:46 2019 daemon.info dnsmasq[23945]: using nameserver 8.8.8.8#53
Sat Jan 19 05:12:46 2019 daemon.info dnsmasq[23945]: using nameserver 9.9.9.9#53
Sat Jan 19 05:12:46 2019 daemon.info dnsmasq[23945]: using local addresses only for domain lan
Sat Jan 19 05:12:46 2019 daemon.info dnsmasq[23945]: read /etc/hosts - 4 addresses
Sat Jan 19 05:12:46 2019 daemon.info dnsmasq[23945]: read /tmp/hosts/dhcp.cfg01411c - 3 addresses
Sat Jan 19 05:12:46 2019 daemon.info dnsmasq-dhcp[23945]: read /etc/ethers - 0 addresses
Sat Jan 19 05:12:48 2019 user.notice firewall: Reloading firewall due to ifup of ovpn (tun0)
Sat Jan 19 05:12:49 2019 user.notice firewall: Reloading firewall due to ifup of ovpn (tun0)
Sat Jan 19 05:12:51 2019 user.notice root: check route success
Sat Jan 19 05:12:51 2019 daemon.notice openvpn[22655]: Initialization Sequence Completed

alzhao · 2019-01-19T17:54:27.900Z

From the logs seem it is connected finally, isn’t it?

GL-FUN · 2019-01-19T18:06:54.201Z

@alzhao - yes, indeed. however, the connection to establish takes longer with Ivacy than with Safer…

glitch · 2019-01-19T20:55:38.534Z

That’s just the Ivacy (Pure) servers for you - you’ll have to live with it

GL-FUN · 2019-01-19T21:02:05.836Z

@glitch would you, please, elaborate? did you meant the connection time establishment - yes, I guess nothing I can do. or did you mean anything else?

BTW, I am now trying to get my money back from Safe - apparently they implicitly admitted some issues with their infrastructure

glitch · 2019-01-20T09:28:30.631Z

GL-FUN:

Did you meant the connection time establishment - yes, I guess nothing I can do. or did you mean anything else?

Yes, it takes time to connect to their servers but it works OK (most of the time).

Thanks for reporting back on Safer - I suspected all along that the problem was with them.

GL-FUN · 2019-01-20T13:28:16.730Z

@glitch what do you think is the reason for long time initiation? their config file specifies UDP:53 - that shall be opened and be fast as it is DNS port & UDP. any thoughts?

BTW - i now have done more tests with their clients: my broadband and 4G providers are definitely filter VPN traffic and affect how either of the Safer (apart of their own difficulties) and Ivacy work.