OpenVPN for iOS - Finally Available!

asterix

With the new client package, import is sucessful on Android. But now I get a new error when trying to connect.

OpenVPN core error: option_error: tls-remote not supported

jimp

With the new client package, import is sucessful on Android. But now I get a new error when trying to connect.

OpenVPN core error: option_error: tls-remote not supported

Is that error from Android or iOS? The Android client supports tls-remote, but the iOS client does not.

Note that in the latest client export package there are separate links for the Android and iOS configs - they don't all go to the same file.

asterix

This error is coming from my Android device. I updated with Android config.. also tried "All Other Platforms" .. same error.

This wasn't an issue earlier when I used the basic inline config.

asterix

Just tested the iOS config on an iPhone and that worked. Though I still saw the below error.

Jan 23 11:07:17 openvpn[19318]: xxx.xxx.xxx.xxx:62546 TLS Error: incoming packet authentication failed from [AF_INET]xxx.xxx.xxx.xxx:62546
Jan 23 11:07:17 openvpn[19318]: xxx.xxx.xxx.xxx:62546 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1358957236) Wed Jan 23 11:07:16 2013 ] – see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings

asterix

Funny.. I used the iOS config on my Android and it worked. Something definitely is messing up the Android config generation.

jimp

Which Android client are you using?

If it's the "OpenVPN Connect" client it may suffer the same limits as the iOS app.

I use this app on Android:
https://play.google.com/store/apps/details?id=de.blinkt.openvpn

asterix

I am using OpenVPN Connect

jimp

then that explains it :-)

I'll have to find a way to reword the choices to make that clearer… but the client we link to on the doc wiki for Android is the one I linked above. I haven't tried OpenVPN connect on Android but it appears to function the same as the iOS app so the same config should work for both.

The client I linked for Android, IMO, is better. You can adjust many of the config options directly in the GUI rather than re-importing to make any changes.

jimp

Updated the export package again, reworded the links a little. Also added a list of links to recommended and other clients at the bottom of the page.

asterix

meh ::)

LOL !.. well at least that clarifies some confusion. The iOS/Android config download link still has iOS mentioned.. might get a bit confusing for first timers.

jimp

No there are two options for android, "Android" (for OpenVPN for Android) and "OpenVPN Connect (Android/iOS)" (for OpenVPN connect on both platforms).

The "iOS" config was not specific to iOS, it's only specific to the OpenVPN connect app.

At least their quirks are cross-platform. :-)

asterix

Ya well I don't see "OpenVPN for Android" written next to them..

This is what I see

Inline Configurations:
Android OpenVPN Connect (iOS/Android) Others

jimp

Yeah there's not a ton of room there to write it all out. I had to make room to put in what is there. I'm hoping someone is smart enough that if they installed OpenVPN Connect they'll at least consider the option of clicking the name of the client they did install.

Or they'll be smarter and not install OpenVPN Connect on Android :p

asterix

Well I tried OpenVPN for Android.. as you recommended.. now I get this error while importing the android config

Error reading config file
Option tls-remote has 2 parameters, expected between 1 and 1

Moving back to my iOS config on the Android. That works on this new client as well.

jimp

check the box to quote the server cn before exporting.

And in the future, don't put spaces in your certificate common names. :-)

asterix

Finally.. that worked. Thanks!

Why is the iOS config not affected by the space?

jimp

It doesn't support tls-remote so that line is left out entirely for the OpenVPN Connect config.

The OpenVPN connect config will also work in the OpenVPN for Android client but it is missing a few lines that can be beneficial for security reasons (like tls-remote)

JoeGTN1

My fix to continual:

Jan 21 13:38:51 openvpn[26787]: xyz123/xxx.xxx.xxx.xxx:xxxxx TLS Error: incoming packet authentication failed from [AF_INET]xxx.xxx.xxx.xxx:xxxxx
Jan 21 13:38:51 openvpn[26787]: xyz123/xxx.xxx.xxx.xxx:xxxxx Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #120 / time = (1358793515) Mon Jan 21 13:38:35 2013 ] – see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings

Was to not use: reneg-sec 0 in the client config. Most clients think this means to use what the server uses. Apparently iOS and Android think this means just keep renegotiating forever. reneg-sec 21600 works fine. It would be nice if renegotiation didn't require re-entry of a (new) OTP…

x2desmit

I can't believe how easy this was. Worked the first time, except for a restrictive firewall rule. This is great work! 8)

trans_lux

Wow works great!
Am I missing something or can you only have one profile in the phone/app at a time?
Every time I import another cofig for a different router it blows out the one that's installed.