Openvpn & Airvpn

[dfox]

Raised a support ticket with my VPN provider due to issues with getting this running, most of the issues are now sorted apart from the below, the vpn provider has said they don't know what is wrong now but have pointed out the below when I run the telnet command they provided.

Wondering if anyone on here can shed some light as to what this issue is.

Mon Jul 6 20:33:09 2015 OpenVPN 2.3.4 mipsel-oe-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on May 8 2015
Mon Jul 6 20:33:09 2015 library versions: OpenSSL 1.0.2a 19 Mar 2015, LZO 2.09
Mon Jul 6 20:33:09 2015 WARNING: file '/etc/openvpn/user.key' is group or others accessible
Mon Jul 6 20:33:09 2015 WARNING: file '/etc/openvpn/ta.key' is group or others accessible
Mon Jul 6 20:33:09 2015 Control Channel Authentication: using '/etc/openvpn/ta.key' as a OpenVPN static key file
Mon Jul 6 20:33:09 2015 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Jul 6 20:33:09 2015 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Jul 6 20:33:09 2015 Socket Buffers: R=[87380->131072] S=[16384->131072]
Mon Jul 6 20:33:09 2015 Attempting to establish TCP connection with [AF_INET]199.241.146.178:443 [nonblock]

Mon Jul 6 20:33:10 2015 TCP connection established with [AF_INET]199.241.146.178:443

Mon Jul 6 20:33:10 2015 TCPv4_CLIENT link local:
Mon Jul 6 20:33:10 2015 TCPv4_CLIENT link remote: [AF_INET]199.241.146.178:443
Mon Jul 6 20:33:10 2015 TLS: Initial packet from [AF_INET]199.241.146.178:443, sid=4c27a6e6 9a343736

Mon Jul 6 20:33:12 2015 VERIFY OK: depth=1, C=IT, ST=IT, L=Perugia, O=airvpn.org, CN=airvpn.org CA, emailAddress=info@airvpn.org

Mon Jul 6 20:33:12 2015 Validating certificate key usage
Mon Jul 6 20:33:12 2015 ++ Certificate has key usage 00a0, expects 00a0
Mon Jul 6 20:33:12 2015 VERIFY KU OK
Mon Jul 6 20:33:12 2015 Validating certificate extended key usage
Mon Jul 6 20:33:12 2015 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Mon Jul 6 20:33:12 2015 VERIFY EKU OK
Mon Jul 6 20:33:12 2015 VERIFY OK: depth=0, C=IT, ST=IT, L=Perugia, O=airvpn.org, CN=server, emailAddress=info@airvpn.org

Mon Jul 6 20:33:24 2015 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Mon Jul 6 20:33:24 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Jul 6 20:33:24 2015 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Mon Jul 6 20:33:24 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Jul 6 20:33:24 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 4096 bit RSA
Mon Jul 6 20:33:24 2015 [server] Peer Connection Initiated with [AF_INET]199.241.146.178:443

Mon Jul 6 20:33:26 2015 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)

Mon Jul 6 20:33:27 2015 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 10.5.0.1,comp-lzo no,route-gateway 10.5.0.1,topology subnet,ping 10,ping-restart 60,ifconfig 10.5.0.251 255.255.0.0'
Mon Jul 6 20:33:27 2015 OPTIONS IMPORT: timers and/or timeouts modified
Mon Jul 6 20:33:27 2015 OPTIONS IMPORT: LZO parms modified
Mon Jul 6 20:33:27 2015 OPTIONS IMPORT: --ifconfig/up options modified
Mon Jul 6 20:33:27 2015 OPTIONS IMPORT: route options modified
Mon Jul 6 20:33:27 2015 OPTIONS IMPORT: route-related options modified
Mon Jul 6 20:33:27 2015 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Mon Jul 6 20:33:27 2015 ROUTE_GATEWAY 192.168.0.1/255.255.255.0 IFACE=eth0 HWADDR=00:1e:a0:00:66:a2

Mon Jul 6 20:33:27 2015 TUN/TAP device tun1 opened
Mon Jul 6 20:33:27 2015 TUN/TAP TX queue length set to 100
Mon Jul 6 20:33:27 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Jul 6 20:33:27 2015 /sbin/ifconfig tun1 10.5.0.251 netmask 255.255.0.0 mtu 1500 broadcast 10.5.255.255

Mon Jul 6 20:33:32 2015 /sbin/route add -net 199.241.146.178 netmask 255.255.255.255 gw 192.168.0.1

[U] route: SIOCADDRT: File exists
Mon Jul 6 20:33:32 2015 ERROR: Linux route add command failed: external program exited with error status: 1
Mon Jul 6 20:33:32 2015 /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw 10.5.0.1
route: SIOCADDRT: File exists
Mon Jul 6 20:33:32 2015 ERROR: Linux route add command failed: external program exited with error status: 1
Mon Jul 6 20:33:32 2015 /sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw 10.5.0.1
route: SIOCADDRT: File exists
Mon Jul 6 20:33:32 2015 ERROR: Linux route add command failed: external program exited with error status: 1
Mon Jul 6 20:33:32 2015 Initialization Sequence Completed

Mon Jul 6 20:33:47 2015 Connection reset, restarting [0]
Mon Jul 6 20:33:47 2015 SIGUSR1[soft,connection-reset] received, process restarting
Mon Jul 6 20:33:47 2015 Restart pause, 5 second(s)

Mon Jul 6 20:33:52 2015 Socket Buffers: R=[87380->131072] S=[16384->131072]
Mon Jul 6 20:33:52 2015 Attempting to establish TCP connection with [AF_INET]199.241.146.178:443 [nonblock]

Mon Jul 6 20:33:53 2015 TCP connection established with [AF_INET]199.241.146.178:443
Mon Jul 6 20:33:53 2015 TCPv4_CLIENT link local: [undef]
Mon Jul 6 20:33:53 2015 TCPv4_CLIENT link remote: [AF_INET]199.241.146.178:443

Mon Jul 6 20:33:53 2015 TLS: Initial packet from [AF_INET]199.241.146.178:443, sid=51fc7777 0f20fe94

Mon Jul 6 20:33:56 2015 VERIFY OK: depth=1, C=IT, ST=IT, L=Perugia, O=airvpn.org, CN=airvpn.org CA, emailAddress=info@airvpn.org

Mon Jul 6 20:33:56 2015 Validating certificate key usage
Mon Jul 6 20:33:56 2015 ++ Certificate has key usage 00a0, expects 00a0
Mon Jul 6 20:33:56 2015 VERIFY KU OK
Mon Jul 6 20:33:56 2015 Validating certificate extended key usage
Mon Jul 6 20:33:56 2015 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Mon Jul 6 20:33:56 2015 VERIFY EKU OK
Mon Jul 6 20:33:56 2015 VERIFY OK: depth=0, C=IT, ST=IT, L=Perugia, O=airvpn.org, CN=server, emailAddress=info@airvpn.org

Mon Jul 6 20:34:08 2015 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Mon Jul 6 20:34:08 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Jul 6 20:34:08 2015 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Mon Jul 6 20:34:08 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Jul 6 20:34:08 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 4096 bit RSA
Mon Jul 6 20:34:08 2015 [server] Peer Connection Initiated with [AF_INET]199.241.146.178:443

Mon Jul 6 20:34:10 2015 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)

Mon Jul 6 20:34:10 2015 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 10.5.0.1,comp-lzo no,route-gateway 10.5.0.1,topology subnet,ping 10,ping-restart 60,ifconfig 10.5.0.251 255.255.0.0'
Mon Jul 6 20:34:10 2015 OPTIONS IMPORT: timers and/or timeouts modified
Mon Jul 6 20:34:10 2015 OPTIONS IMPORT: LZO parms modified
Mon Jul 6 20:34:10 2015 OPTIONS IMPORT: --ifconfig/up options modified
Mon Jul 6 20:34:10 2015 OPTIONS IMPORT: route options modified
Mon Jul 6 20:34:10 2015 OPTIONS IMPORT: route-related options modified
Mon Jul 6 20:34:10 2015 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Mon Jul 6 20:34:10 2015 Preserving previous TUN/TAP instance: tun1
Mon Jul 6 20:34:10 2015 Initialization Sequence Completed

[ArowonA]

This would normally suggest openvpn is already running. Could you try running
/etc/init.d/openvpn stop
killall openvpn and then retry the telnet command they gave you

[dfox]

This would normally suggest openvpn is already running. Could you try running
/etc/init.d/openvpn stop
killall openvpn and then retry the telnet command they gave you

Thanks for the reply. That is what the VPN provider said to me that it seems openvpn is already running so I disabled autostart and rebooted. With openvpn not running they asked me to run ps aux ¦ grep vpn, which gave this output.

I will try your telnet command above later. They have said they don't know what is wrong. A bug in Enigma 2?

43666

[ArowonA]

You've already checked OpenVPN isn't running, so my commands won't help. It's weird that them routes are still there though and OpenVPN is trying to connect using tun1 instead of tun0.
What steps have you gone through to set it up? also what files do you have in the /etc/openvpn folder and can you tell me what output you get from running these two commands
route
ifconfig
I use AirVPN, just on my PC though, but I've copied the config files across to my box and it connected fine.

[dfox]

I have used the config generator on Airvpn, downloaded them to my desktop.

Edited the ovpn file and changed values ca.crt, cert.crt, user.key and ta.key to /etc/openvpn/ca.crt and so on. Then renamed the ovpn file client.conf and transferred client.conf, ca.crt, cert.crt, user.key and ta.key to etc/openvpn on the box.

I have set it up on my laptop as a test and it also connects fine. Did you rename the ovpn file before you transferred it to the box?

[ArowonA]

When I used their config generator it only created one file (ovpn) which contained all the certificates and keys, but I don't think that matters as your box is connecting, but it looks like it thinks it's already connected. On the log you included it finishes with "Initialization Sequence Completed", does it try and reconnect again a few seconds later or did it stay on "Initialization Sequence Completed"?

I did rename the file to client.conf which then allowed me to start it from the TV through the settings/network/OpenVPN.

I would still check the contents of the /etc/openvpn folder as when you start OpenVPN on the box it will read and try to connect to any file that ends with a .conf in that folder, so maybe you have two?

[dfox]

When I used their config generator it only created one file (ovpn) which contained all the certificates and keys, but I don't think that matters as your box is connecting, but it looks like it thinks it's already connected. On the log you included it finishes with "Initialization Sequence Completed", does it try and reconnect again a few seconds later or did it stay on "Initialization Sequence Completed"?

I did rename the file to client.conf which then allowed me to start it from the TV through the settings/network/OpenVPN.

I would still check the contents of the /etc/openvpn folder as when you start OpenVPN on the box it will read and try to connect to any file that ends with a .conf in that folder, so maybe you have two?

Ah right, I thought you needed to generate the files individually. When I go onto the client area of airvpn when I have openvpn running it states I am connected to a server and when I check the ip addres with a telnet command it has changed.

It was the support team at airvpn that said I still had an issue, on the bottom of the web page on airvpn it has a box that says connected and not connected, if I was connected properyl that would change to green? it never does, that's what they have said.

I double checked yesterday and there was only one client.conf file in there. I will start over and see what happens.

4367043669

[ArowonA]

The way you have it set up is the box is the only thing using the VPN connection, so if you got to their webpage on your PC it will say you aren't connected (because you aren't the box is). Once you are connected to the VPN if you run the following on the box
curl -s icanhazip.com and then go to
http://icanhazip.com on your computer, if you get different addresses it means you are connected OK.
If you wanted all devices on your network to use the VPN connection that would be more complicated to set up and I'm not sure how well it would work.

[dfox]

The way you have it set up is the box is the only thing using the VPN connection, so if you got to their webpage on your PC it will say you aren't connected (because you aren't the box is). Once you are connected to the VPN if you run the following on the box
curl -s icanhazip.com and then go to
http://icanhazip.com on your computer, if you get different addresses it means you are connected OK.
If you wanted all devices on your network to use the VPN connection that would be more complicated to set up and I'm not sure how well it would work.

To cut a long story short, yes I get different IP addresses.

And in the telnet command the IP showing matches up with Airvpn.

Assume that means it is working. I also thought this would fix the error addon in TS Media but still get that on genesis.

Thanks for your help

[dfox]

I use AirVPN, just on my PC though, but I've copied the config files across to my box and it connected fine.[/QUOTE]

ArowonA, When you transfer to the config file over to etc/openvpn, can you log onto airvpn and sign in and see if the box at the bottom of the page has turned from red to green and says connected as in the attached photo? They are still adamant it is not connected properly if this has not changed?

[ArowonA]

can you log onto airvpn and sign in and see if the box at the bottom of the page has turned from red to green and says connected as in the attached photo?No if I connect to their website from my computer it says 'Not connected' , as the picture you posted (I would expect this as I'm not using the STB as my default gateway). If I go to the client area I can see the following 43674 and if I run the curl command I posted earlier it shows the same IP address 46.182.etc

[dfox]

No if I connect to their website from my computer it says 'Not connected' , as the picture you posted (I would expect this as I'm not using the STB as my default gateway). If I go to the client area I can see the following 43674 and if I run the curl command I posted earlier it shows the same IP address 46.182.etc

Ok thanks I see, so when you connect via your computer it will turn green as that is the your default gateway? Same as when I connected with my computer. it turned green.

But box will stay red.