Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Openvpn ssl/tls peer to peer with teltonika router

    Scheduled Pinned Locked Moved OpenVPN
    2 Posts 1 Posters 2.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • G
      gullio
      last edited by

      hello,

      i have a strange problem in building a site to site vpn with my teltonika umts router.

      i have configured my server with ssl/tls peer to peer defined al certs and all network and the vpn network as /30

      when i start the vpn client this is the log:

      
      Aug  3 21:45:43 openvpn(client)[3451]: WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
      Aug  3 21:45:43 openvpn(client)[3451]: NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
      Aug  3 21:45:43 openvpn(client)[3451]: Re-using SSL/TLS context
      Aug  3 21:45:43 openvpn(client)[3451]: LZO compression initialized
      Aug  3 21:45:43 openvpn(client)[3451]: Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
      Aug  3 21:45:43 openvpn(client)[3451]: Socket Buffers: R=[163840->131072] S=[163840->131072]
      Aug  3 21:45:43 openvpn(client)[3451]: Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
      Aug  3 21:45:43 openvpn(client)[3451]: UDPv4 link local: [undef]
      Aug  3 21:45:43 openvpn(client)[3451]: UDPv4 link remote: x.x.x.x:1196
      Aug  3 21:45:44 openvpn(client)[3451]: TLS: Initial packet from x.x.x.x:1196, sid=c018e59a 61852cf4
      Aug  3 21:45:50 openvpn(client)[3451]: VERIFY OK: depth=1, /C=IT/ST=xxxx/L=xxxxx/O=xxx/emailAddress=admin@xxxx.it/CN=openvpn-ca-aps-sf
      Aug  3 21:45:50 openvpn(client)[3451]: VERIFY OK: depth=0, /C=IT/ST=xxxxx/L=xxxxx/O=xxxx/emailAddress=admin@xxxx.it/CN=openvpn-aps-sf-server
      Aug  3 21:45:54 openvpn(client)[3451]: Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
      Aug  3 21:45:54 openvpn(client)[3451]: Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
      Aug  3 21:45:54 openvpn(client)[3451]: Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
      Aug  3 21:45:54 openvpn(client)[3451]: Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
      Aug  3 21:45:54 openvpn(client)[3451]: Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
      Aug  3 21:45:54 openvpn(client)[3451]: [openvpn-aps-sf-server] Peer Connection Initiated with x.x.x.x:1196
      Aug  3 21:45:56 openvpn(client)[3451]: SENT CONTROL [openvpn-aps-sf-server]: 'PUSH_REQUEST' (status=1)
      Aug  3 21:45:57 openvpn(client)[3451]: PUSH: Received control message: 'PUSH_REPLY,route 192.168.0.0 255.255.255.0,route 10.10.5.0 255.255.255.0'
      Aug  3 21:45:57 openvpn(client)[3451]: OPTIONS IMPORT: route options modified
      Aug  3 21:45:57 openvpn(client)[3451]: OpenVPN ROUTE: OpenVPN needs a gateway parameter for a --route option and no default was specified by either --route-gateway or --ifconfig options
      Aug  3 21:45:57 openvpn(client)[3451]: OpenVPN ROUTE: failed to parse/resolve route for host/network: 192.168.0.0
      Aug  3 21:45:57 openvpn(client)[3451]: OpenVPN ROUTE: OpenVPN needs a gateway parameter for a --route option and no default was specified by either --route-gateway or --ifconfig options
      Aug  3 21:45:57 openvpn(client)[3451]: OpenVPN ROUTE: failed to parse/resolve route for host/network: 10.10.5.0
      Aug  3 21:45:57 netifd: Interface 'vpn' is now up
      Aug  3 21:45:57 openvpn(client)[3451]: TUN/TAP device tun0 opened
      Aug  3 21:45:57 openvpn(client)[3451]: TUN/TAP TX queue length set to 100
      Aug  3 21:45:57 openvpn(client)[3451]: Initialization Sequence Completed
      Aug  3 21:45:57 firewall: Reloading firewall due to ifup of vpn (tun0)
      
      

      if i change the vpn network tab in server to /24 the client with the same configuration got connected and i can ping it but the other end network got unreacheable due to incorrect automatic routing table( as i can see there is a 10.0.0.2 as gateway from route but the client got 10.0.0.6).

      f i change back the configuration with peer to peer it works correctly as expected but not if router reboots. i have to do the same trick.

      can you explain or suggest me any kind of resolution/workaround?

      thanks a lot

      1 Reply Last reply Reply Quote 0
      • G
        gullio
        last edited by

        i want to add something i forgot:

        on client side when the openvpn process i s finished(as previous code) the tun interface came up without ip address. when i do the trick there is no problem.

        thanks again

        1 Reply Last reply Reply Quote 0
        • First post
          Last post
        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.