Hi, how to generate good certificates for openvpn on MT 3.0? I created certificates for OpenVPN on Linux box and they worked fine (based on openvpn howto page). In MT when I tried to enable openvpn client interface with selected cert I have error: couldn't add new interface - no ceritificate found (6). Is there any special method to generate certs for MT's ovpn?
Post subject: Re: ovpn can't support lzo compress?
Posted: Fri May 02, 2008 1:27 pm
Member
Joined: Sat Aug 04, 2007 4:40 pm Posts: 304
Karma: 0
Location: Port-Elizabeth
wsgtrsys : How do you get openvpn to use usernames & passwords? Currently i also have a working setup on FreeBSD for existing clients, however MT forces you to enter a username and i don't use usernames/passwords on my Openvpn server , only certificates.
Anybody have an idea if Mikrotik is working on adding support for lzo-comp and using udp protocol. If so when will it be available?
We have a client that needs to connect to a linux server with lzo-comp. We can establish a connection, but if you try and communicate to the server it just replies with no route. Seems the communication level is broken.
RouterOS OpenVPN does not support LZO and UDP and most likely support for them will not be added in near future.
I really think MT should address the problem. We were under the impression ROS can support ovpn. As far as I am concerned, the lzo-comp is a standard used often on linux machines. So the need to incorporate it into ROS do exist.
Post subject: Re: ovpn can't support lzo compress?
Posted: Wed Oct 22, 2008 5:38 am
newbie
Joined: Wed Oct 22, 2008 5:24 am Posts: 30
Karma: 0
Unfortunately we have to read the fine print, and the manual. Mikrotiks position on this is They added OpenVPN TCP support because it could get through proxies and firewalls easily, and if we want UDP, use L2TP because their version doesn't utilize the IP-SEC Auth portion, and is UDP only. They are focusing on other features and openvpn udp support is not a priority, and won't be in ROS 4 most likely.
I didn't even think to ask about Lzo compression, now that i know it's not in thats makes it even more crippled.
The only recourse I got from them to remedy this is to vote the feature in via the Wiki, so if you want it please go to the wiki and vote it in. Otherwise you can build OpenVPN box from *BSD/Linu* or you can use PFSense like i do for OpenVPN.
Post subject: Re: ovpn can't support lzo compress?
Posted: Wed Jul 15, 2009 4:29 pm
just joined
Joined: Sun Mar 13, 2005 12:49 am Posts: 14
Karma: 0
Hi MRZ,
So when you say "not yet," do you mean Not Yet we're putting into one of the next revisions? Or do you mean Not Yet, we don't really have this on the table and probably wont?
Just curious.
Our problem is that we have about 60 locations already deployed with OpenVPN using DD-WRT. But those boxes, not the OS just the hardware, are kind of buggy. I've used Mikrotik quite a bit and have convinced my bosses to try it out. So we'd like to start replacing those 60 sites with Mikrotik boxes, but we can't change the whole infrastructure of the VPN right now. Plus there are some locations that tunnel through other company's internet, ie. it's not our internet, so UDP allows us to do so without having to ask them to open ports, etc.
Right now the only thing holding us up is the implementation of OpenVPN with LZO and UDP.
I know 60 itself isn't that huge of a number, but we have that many, there must be others with quite a few sites that are just waiting for this one hurdle to get jumped.
added my vote for complete openvpn server support on the wiki. I wouldn't have thought it would be all that difficult seeing how it is all open source but as I can see from the request list there is a lot of work for mikrotik programmers to do.
When people say UDP isn't supported, do they mean openVPN connections on mikrotik can't carry UDP packets, or openVPN connections can't use UDP as the transport layer?
does this mean UDP can't be tunneled over openVPN or that openVPN tunnels can carry both TCP and UDP traffic but that openVPN can only use TCP as the transport and not UDP?
Post subject: Re: ovpn can't support lzo compress?
Posted: Wed Jul 22, 2009 5:26 pm
Member
Joined: Sat Aug 04, 2007 4:40 pm Posts: 304
Karma: 0
Location: Port-Elizabeth
Quote:
You definitely will not see UDP and LZO support in v3.x If UDP tunnels are needed then L2TP can be used instead.
Why not? What would be the reason too this? UDP and LZO is the default option for openVPN on Linux, therefore that is the way we have it set up. Now we cannot join any customers choosing to use Mikrotik to our existing infrastructure.
We can't add these features right now. If you really need OVPN with UDP and LZO support on mikrotik router, then one option is to add virtual router running other os that supports these ovpn features, for example http://wiki.mikrotik.com/wiki/Metaroute ... al_machine
Post subject: Random Number Generator problems under MetaRouter !
Posted: Mon Aug 03, 2009 3:33 am
just joined
Joined: Sun Aug 02, 2009 10:55 pm Posts: 2
Karma: 0
I agree - OpenVPN over TCP is rather pointless, moreover without LZO, hemm... Better remove OpenVPN from the list of features.. Anyways - running OpenWRT inside MetaRouter seems like a good direction...
However - using the pre-made by Mikrotik, OpenWRT image and the pre-compiled packages with it... I get this error when running OpenVPN under Metarouter: "ERROR: Random number generator cannot obtain entropy for PRNG."
This is RouterOS v3.27 on RB493
I suspect some Xen configuration errors in the RouterOS... FWIW - /dev/random does not produce anything... (/dev/urandom does seem ok).
Ideas ?
Thanks,
Yahel.
Code:
root@OpenWrt:~# uname -a Linux OpenWrt 2.6.27.21 #1 Thu Jun 11 17:02:37 EEST 2009 mips unknown root@OpenWrt:~# cat /proc/cpuinfo system type : Mikrotik MetaROUTER processor : 0 cpu model : MIPS 4Kc V0.10 BogoMIPS : 198.65 wait instruction : yes microsecond timers : yes tlb_entries : 16 extra interrupt vector : yes hardware watchpoint : yes ASEs implemented : mips16 shadow register sets : 1 core : 0 VCED exceptions : not available VCEI exceptions : not available
root@OpenWrt:~# openvpn --config /etc/openvpn/airjaldi-1.conf Mon Aug 3 00:31:56 2009 us=66611 OpenVPN 2.1_rc18 mips-openwrt-linux [SSL] [LZO2] built on Jul 17 2009 Mon Aug 3 00:31:56 2009 us=75097 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA. OpenVPN 2.0-beta16 and earlier used 5000 as the default port. Mon Aug 3 00:31:56 2009 us=77613 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables Mon Aug 3 00:31:56 2009 us=185913 ERROR: Random number generator cannot obtain entropy for PRNG Mon Aug 3 00:31:56 2009 us=189398 Exiting root@OpenWrt:~#
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot post attachments in this forum
Login |
View unanswered posts | View active topics
