JW0914 wrote:gaga wrote:In my Android openvpn.ovpn file I had to remove
<tls-auth> -----BEGIN OpenVPN Static key V1----- -----END OpenVPN Static key V1----- </tls-auth>and replace it with
tls-auth ta.key 1When you pasted your ta.key in the xml layout, was there a blank line between the key and the lines BEGIN or END? It would have either been that or you maybe missed a character when you copied it over. (I hope that doesn't come across as arrogant, as it's not my intent).
The reason why it would have had to be either/or is OpenVPN for Android applies the ovpn config in xml format, not in the format it's written as in the config file. You can view the ovpn config in the way it's actually applied by selecting the edit [pencil] icon, and scrolling all the way to right, until you reach the last tab. It applies the ca.crt, client.key, client.crt, and ta.key in xml format.
Because of this, the only reason the xml code within the ovpn config couldn't work would have to be user error.
In reference to the key direction (i.e. the 1 after ta.key), when configuring with the ta.key in xml format, the value key-direction 1 is what specifies the 1. If that isn't included when you configure an ovpn with the ta.key in xml format, it'll fail. (The server and client configs are literally the exact same ones I use, and the only differences between the ones in the wiki and the ones I use are the subnets, port numbers, and certificate names.)
Uhm, ok, I did this probably ten times or more so far. I didn't pay too much attention to the copying process. After reading your post, I did. Now, it works, of course.
What happened? Well, there is a blank after each line including the last line. I never copied the last blank from the last line...
Feeling stupid right now.
lol glad you figured out where the issue was =]
Also, when it comes to firewalls, especially and even more so on routers, an SPI firewall with a default drop policy is the way to go. It's a bit more hands on for the end user, as that means manually configuring things like Plug N Play, as port 1900 will be auto blocked, but a default deny policy is the #1 guarantee you have against intrusion.
It's extremely important a default deny approach is taken with routers because they're literally the front door to your home, and once access is gained, physical access to your devices is granted. To provide a real world example, while not typical it does demonstrate why it's necessary.... A friend of mine owns an auto customization shop and utilizes ~5 devices connected to a router running DD-WRT, and is serviced via Charter Spectrum Business. About 2 months ago, I was creating a vlan for a guest network for his customers when I saw firewall logging wasn't enabled (it's disabled by default on DD-WRT for some reason). So I enabled it and checked it about an hour later and there were hundreds of inbound connection attempts that were coming from China and Hong Kong. DD-WRT doesn't include the greatest of firewall implementations so I pulled the iptables rules OpenWRT utilizes via fw3 and deployed them on the R6300. The next day I checked the logs and there were over 1000 blocked inbound connections originating in China.
Keep in mind this was a small business in a mid size town experiencing intrusion attempts at a rate one would expect to be seen against a financial institution or corporate network... it wasn't normal, with Charter stating they've never seen that kind of intrusion traffic against a small business in the region they serviced. Granted, this isn't by any means a typical experience, but does show it's vitally important to ensure you do everything to prevent, or at the very least make it extremely difficult, for someone to gain access to your router and the devices behind it.
