Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    [SOLVED] Always so difficult… Trying to get Android smartphone to work

    Scheduled Pinned Locked Moved OpenVPN
    19 Posts 4 Posters 4.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      Mr. Jingles
      last edited by

      @NOYB:

      Fix those options errors.
      Be sure you're exporting the correct config.

      Google doesn't give any clue as to that error message.

      I did nothing special. I simply exported it. Both 'Android' and 'OpenVPN connect' export give the same problems. In both Android OpenVPN clients.

      6 and a half billion people know that they are stupid, agressive, lower life forms.

      1 Reply Last reply Reply Quote 0
      • M
        Mr. Jingles
        last edited by

        There is something wrong with that export utility.

        If I disable 'verify server CN' to get rid of the one of the errors in the previous screenshots, we get the next error. Now UDP protocol is not allowed…

        Pic attached.

        Screenshot_20170522-194924.png
        Screenshot_20170522-194924.png_thumb

        6 and a half billion people know that they are stupid, agressive, lower life forms.

        1 Reply Last reply Reply Quote 0
        • M
          Mr. Jingles
          last edited by

          Ok, when I install the OpenVPN client on Windows, I get a new/other/strange error:

          Options error: You must define TUN/TAP device (–dev)

          However, the server is setup as tun and the config file contains tun too (screenshot).

          ovpn40.png
          ovpn40.png_thumb

          6 and a half billion people know that they are stupid, agressive, lower life forms.

          1 Reply Last reply Reply Quote 0
          • N
            NOYB
            last edited by

            Here are my Windows and Android OpenVPN profiles.  There are only two lines different between them.

            dev tun
            resolv-retry infinite

            Windows OpenVPN Profile (certs snipped out)

            
dev tun
persist-tun
persist-key
cipher AES-256-CBC
auth SHA512
tls-client
client
resolv-retry infinite
remote my.domain.com 1194 udp
lport 0
verify-x509-name "OpenVPN Server Certificate" name
auth-user-pass
ns-cert-type server
comp-lzo adaptive

 <ca>-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----</ca> 
 <cert>-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----</cert> 
 <key>-----BEGIN PRIVATE KEY-----
-----END PRIVATE KEY-----</key> 
 <tls-auth>#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
-----END OpenVPN Static key V1-----</tls-auth> 
 key-direction 1

            Android OpenVPN Profile (certs snipped out)

            
persist-tun
persist-key
cipher AES-256-CBC
auth SHA512
tls-client
client
remote my.domain.com 1194 udp
lport 0
verify-x509-name "OpenVPN Server Certificate" name
auth-user-pass
ns-cert-type server
comp-lzo adaptive

 <ca>-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----</ca> 
 <cert>-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----</cert> 
 <key>-----BEGIN PRIVATE KEY-----
-----END PRIVATE KEY-----</key> 
 <tls-auth>#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
-----END OpenVPN Static key V1-----</tls-auth> 
 key-direction 1
            1 Reply Last reply Reply Quote 0
            • N
              NOYB
              last edited by

              Be sure the profile being used on the Android has LF line termination only.  Not CRLF.

              1 Reply Last reply Reply Quote 0
              • M
                Mr. Jingles
                last edited by

                @NOYB:

                Be sure the profile being used on the Android has LF line termination only.  Not CRLF.

                Thank you for both replies, NOYB ;D

                I'll compare your configs with mine.

                What do you mean with the above quoted? I only export the *.ovpn in pfSense export utility, and then try to import it in Android. Do I need to change something somewhere?

                6 and a half billion people know that they are stupid, agressive, lower life forms.

                1 Reply Last reply Reply Quote 0
                • N
                  NOYB
                  last edited by

                  If you export and use directly that should be fine.  It should have only the LF line endings.  If you edit it, especially in Windows, it could be saved with CRLF line endings.

                  1 Reply Last reply Reply Quote 0
                  • M
                    Mr. Jingles
                    last edited by

                    @Mr.:

                    Nobody can help me?

                    This is my opvn profile. different compared to NOYB are (although I don't know why?):

                    auth SHA1
                    auth-user-pass
                    ns-cert-type server

                    
persist-tun
persist-key
cipher AES-256-CBC
auth SHA1
tls-client
client
remote domain.dynu.net 44000 udp
lport 0
verify-x509-name "smartphone-server" name
remote-cert-tls server
comp-lzo adaptive

 <ca>-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----</ca> 
 <cert>-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----</cert> 
 <key>-----BEGIN PRIVATE KEY-----
-----END PRIVATE KEY-----</key> 
 <tls-auth>#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
-----END OpenVPN Static key V1-----</tls-auth> 
key-direction 1

                    But when I adapt NOYB's differential settings the problem remains the same.

                    6 and a half billion people know that they are stupid, agressive, lower life forms.

                    1 Reply Last reply Reply Quote 0
                    • M
                      Mr. Jingles
                      last edited by

                      Solved.

                      Don't email the *.opvn profile to your Android device, neither from Windows nor Debian: the Android email client corrupts the *.ovpn…

                      6 and a half billion people know that they are stupid, agressive, lower life forms.

                      1 Reply Last reply Reply Quote 0
                      • N
                        NOYB
                        last edited by

                        Here.  Let me fix that for you.

                        @Mr.:

                        Don't email the *.opvn profile to your Android device, neither from Windows nor Debian: the Android email client corrupts the *.ovpn…

                        Don't email security certificates.  Especially private keys.  Period!!!

                        1 Reply Last reply Reply Quote 0
                        • M
                          Mr. Jingles
                          last edited by

                          @NOYB:

                          Here.  Let me fix that for you.

                          @Mr.:

                          Don't email the *.opvn profile to your Android device, neither from Windows nor Debian: the Android email client corrupts the *.ovpn…

                          Period!!!

                          Here, let me fix that for you: Period

                          Comma.

                          UNLESS it is on your own LAN and you are both the only sender and receiver.

                          6 and a half billion people know that they are stupid, agressive, lower life forms.

                          1 Reply Last reply Reply Quote 0
                          • N
                            NOYB
                            last edited by

                            @Mr.:

                            @NOYB:

                            Here.  Let me fix that for you.

                            @Mr.:

                            Don't email the *.opvn profile to your Android device, neither from Windows nor Debian: the Android email client corrupts the *.ovpn…

                            Period!!!

                            Here, let me fix that for you: Period

                            Comma.

                            UNLESS it is on your own LAN and you are both the only sender and receiver.

                            Nope.  Not even then.

                            1 Reply Last reply Reply Quote 0
                            • GertjanG
                              Gertjan
                              last edited by

                              @Mr.:

                              …..
                              UNLESS it is on your own LAN and you are both the only sender and receiver.

                              With or without the mail server on the other side of the planet ?  ;)

                              No "help me" PM's please. Use the forum, the community will thank you.
                              Edit : and where are the logs ??

                              1 Reply Last reply Reply Quote 0
                              • M
                                Mr. Jingles
                                last edited by

                                @Gertjan:

                                @Mr.:

                                …..
                                UNLESS it is on your own LAN and you are both the only sender and receiver.

                                With or without the mail server on the other side of the planet ?  ;)

                                6 and a half billion people know that they are stupid, agressive, lower life forms.

                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.