User Manual

• First, let's look at the simplest configuration using a shared secret key.

  1. The minimum configuration of the OpenVPN server for Keenetic#1:

     dev tun
     ifconfig 10.1.0.1 10.1.0.2
     cipher AES-128-CBC
     <secret>
       <--insert the secret key here
     </secret>
     verb 3
     route 192.168.2.0 255.255.255.0

  2. The minimum configuration of the OpenVPN client for Keenetic#2:

     dev tun
     remote KEENETIC-1.mykeenetic.net <-- server's domain name or IP address
     ifconfig 10.1.0.2 10.1.0.1
     cipher AES-128-CBC
     <secret>
       <--insert the secret key here
     </secret>
     verb 3
     route 192.168.1.0 255.255.255.0
     or
     redirect-gateway def1
     or
     route 0.0.0.0 0.0.0.0 <-- if it's neccessary to route all the traffic in the tunnel

  3. Generate a shared secret key. To do this, download and install OpenVPN from here: openvpn.net/downloads.html

     In this example, we will be using version 2.4.6-I602 for Windows.

     After installing the software, restart the computer.

     By default, the program will be installed in the C:\Program folder.

     Run the Windows command line as an administrator. Go to C:\Program Files\OpenVPN\bin and run the command:

     openvpn.exe --genkey --secret static.key

     

  4. Open the generated static.key file with the shared secret key in any text editor (e.g. Notepad), copy its contents to the clipboard (Ctrl-A, Ctrl-C) and paste (Ctrl-V) into the appropriate locations of the client and server configuration files.

     Examples of static-server.ovpn configuration files for Keenetic#1 and static-client.ovpn configuration files for Keenetic#2 with shared secret key are attached at the end of this article. There are other commented out (starting with ';') OpenVPN settings in these files which may be used later if necessary. You can use these configuration files for verification by replacing the domain name KEENETIC-1.mykeenetic.ru in static-client.ovpn with the domain name of your Keenetic#1 or its public IP address and a shared secret key to the one you generated in both files.

  5. Go to the 'Other connections' page in the web interface of the 1st Keenetic and click 'Create connection' in the 'VPN connections' section. In the 'VPN connection settings' window, select 'OpenVPN' in the 'Type (protocol)' field.

     Then enter the name of the connection in the 'Connection name' field and insert the contents of the static-server.ovpn configuration file in the 'OpenVPN configuration' field. Save the settings.

     

     Important

     From KeeneticOS 3.4.1 the server only works when 'Connect via' — 'Any Internet connection' is specified.

  6. In the same way, add an OpenVPN connection to the web interface of the second Keenetic, but with a static-client.ovpn configuration:

     

  7. Additionally, on the Keenetic#1 (server) side, the following commands will need to be executed via the command-line interface (CLI) of the router:

     interface OpenVPN0 no ip global
     interface OpenVPN0 security-level private

     To allow traffic between the Home and OpenVPN0 interfaces, which have a private security level, run the command:

     no isolate-private

     If you plan to use this server to connect the client to the Internet as well, run the command:

     ip nat 10.1.0.2 255.255.255.255

     and save the settings with the command:

     system configuration save

     

  8. Finally, it is necessary to open a port for OpenVPN connection. The default port is UDP/1194. To do this, create a rule for the 'Provider' interface or for the interface used to access the Internet on the 'Firewall' page (in addition to the 'Provider', it can be PPPoE, L2TP or PPTP interfaces).

     

     On the 'Firewall rule' window, select 'Allow' in the 'Action' field, 'UDP' in the 'Protocol' field, and 'Equals 1194' in the 'Destination port number' field.

     

     This completes the configuration of the OpenVPN tunnel. Successful installation of the tunnel can be proved by the messages in the System log (on the 'Diagnostics' page):

     

     Try pinging both ends of the tunnel to check:

     ping 10.1.0.1
     ping 10.1.0.2

     and then remote subnets:

     ping 192.168.1.1
     ping 192.168.2.1

Typical errors and solutions:

1. auth-user-pass without inline credentials data is not supported

   The configuration file contains a line for online login/password entry, which Keenetic does not support. Error in the Keenetic log file:

   OpenVPN0 auth-user-pass without inline credentials data is not supported
   OpenVPN0 Exiting due to fatal error

   Delete or comment out all lines of this kind:

   auth-user-pass

2. Block-outside-dns option error

   The block-outside-dns option is configured on the OpenVPN server, which is correctly handled only in Windows. Error in the Keenetic log file:

   OpenVPN0 Unrecognized option or missing or extra parameter(s) in configuration: (line X): block-outside-dns (2.4.4)
   OpenVPN0 Exiting due to fatal error

   Add a line to the OpenVPN client configuration file:

   pull-filter ignore "block-outside-dns"

3. Error when connecting to PrivateTunnel servers

   An error is displayed when trying to connect:

   OpenVPN0 Unrecognized option or missing or extra parameter(s) in configuration: (line 3): client-ip (2.4.4)

   Add a line to the OpenVPN client configuration file:

   ignore-unknown-option client-ip block-ipv6

4. An error occurs when using the askpass /storage/key.txt option:

   Error: private key password verification failed

   This is a limitation of the current OpenVPN implementation in Keenetic. You can only use a key without a password or with a fixed password: 'password'.

5. After updating the router to KeeneticOS 3.9.1, the VPN tunnel to the OpenVPN servers for certain VPN suppliers may no longer be established. You can see the following messages in the system log:

   W [Dec 15 16:52:58] OpenVPN6: DEPRECATED OPTION: --cipher set to 'AES-128-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305). 
   OpenVPN ignores --cipher for cipher negotiations.
   Error: private key password verification failed

   The problem is the outdated encryption format BF-CBC, which is not supported starting from the OpenVPN 2.5.0 client version ( KeeneticOS 3.9 uses the OpenVPN 2.6.0 client version).

   Note

   The BF-CBC chipher is no longer supported in the default configuration. The OpenVPN 2.5.0 version supports AES-256-GCM and AES-128-GCM ciphers by default. You can change this behaviour using the data-ciphers option, for example, by specifying in the settings data-ciphers AES-256-GCM:AES-128-GCM:BF-CBC. To support very old OpenVPN nodes that do not support cipher negotiation (mode "--cipher"), you can specify data-ciphers-fallback BF-CBC.

   When upgrading to a new version of OpenVPN, the setting "cipher BF-CBC" in older configuration files will be converted with appending BF-CBC to the data-ciphers set. In addition, the data-ciphers-fallback mode is turned on.

   To successfully install the tunnel, you will need to change the directive:

   cipher AES-128-CBC to data-ciphers AES-128-CBC or data-ciphers AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305

   If it doesn't work, then change the directive:

   cipher AES-128-CBC to data-ciphers-fallback AES-128-CBC

   For maximum cipher negotiation compatibility with the remote server, specify the following directives:

   data-ciphers AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305

   data-ciphers-fallback AES-128-CBC

   or

   data-ciphers AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305

   data-ciphers-fallback AES-256-CBC

   Important

   Encryption depends on the remote OpenVPN server. Before changing the directive cipher, please look at the system log.

6. If the following key size error is recorded in the log:

   [E] Dec 16 19:01:38 OpenVPN0: Unrecognized option or missing or extra parameter(s) in configuration: (line 22): keysize (2.6_git)
   [E] Dec 16 19:01:38 OpenVPN0: Exiting due to fatal error
   [E] Dec 16 19:01:38 ndm: Service: "OpenVPN0": unexpectedly stopped.Error: private key password verification failed

   Then in the tunnel configuration, you need to remove the keysize 256 option directive, which is outdated for the updated client OpenVPN 2.6.0, and check the tunnel connection again.

   You can find detailed information for the "keysize" option by this link.