- Status Nouveau
- Percent Complete
- Task Type Évolution
- Category Services locaux → Client VPN
- Assigned To No-one
- Operating System Freebox Server V6 (Révolution)
- Severity Medium
- Priority Very Low
- Reported Version 4.0.2
- Due in Version Undecided
-
Due Date
Undecided
-
Votes
1
- SvenThor76 (02/01/2019)
- Private
Opened by gouge_re - 01/01/2019
Last edited by mbizon - 02/01/2019
FS#23827 - OpenVPN : version dépassée
Bonsoir,
Je souhaite utiliser ma Freebox en tant que client OpenVPN (pour l’application Téléchargements, entre autres).
Mon serveur OpenVPN étant installé et fonctionnel sur mon ordinateur et ma tablette (j’utilise un fichier .ovpn).
Voici mon ovpn (j’ai remplacé les balises tls-crypt par tls-auth pour que mon fichier soit accepté par Freebox OS)
client
proto udp
remote {redacted} 1194
dev tun
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
verify-x509-name server_rKPVIfiQfZNFnVaE name
auth SHA256
auth-nocache
cipher AES-128-GCM
tls-client
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
verb 3
<ca>
-----BEGIN CERTIFICATE-----
{redacted}
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
{redacted}
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
{redacted}
-----END PRIVATE KEY-----
</key>
<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
{redacted}
-----END OpenVPN Static key V1-----
</tls-auth>
Ma Freebox ne se connecte pas à mon VPN, pour cause: Le cipher AES-128-GCM n’est pas surtout par OpenVPN... 2.3!
Certes la version d’OpenVPN peut être considérée comme stable, mais étant donné que Freebox OS 4.0 est sorti récemment et que cela concerne peut-être également la FBX Delta, cela ne vaudrait-il pas le coup de mettre la version d’OpenVPN à jour vers la branche 2.4?
Merci,
Cordialement.
Loading...
Available keyboard shortcuts
- Alt + ⇧ Shift + l Login Dialog / Logout
- Alt + ⇧ Shift + a Add new task
- Alt + ⇧ Shift + m My searches
- Alt + ⇧ Shift + t focus taskid search
Tasklist
- o open selected task
- j move cursor down
- k move cursor up
Task Details
- n Next task
- p Previous task
- Alt + ⇧ Shift + e ↵ Enter Edit this task
- Alt + ⇧ Shift + w watch task
- Alt + ⇧ Shift + y Close Task
Task Editing
- Alt + ⇧ Shift + s save task
+1 pour la demande !
Lié à https://dev.freebox.fr/bugs/task/22144 + https://dev.freebox.fr/bugs/task/21826 + https://dev.freebox.fr/bugs/task/22563 + https://dev.freebox.fr/bugs/task/22745 + https://dev.freebox.fr/bugs/task/22839 + https://dev.freebox.fr/bugs/task/23610
Lié également à :
- https://dev.freebox.fr/bugs/task/22996
Je me suis trompé dans le dernier lien, il s'agit de celui-ci : https://dev.freebox.fr/bugs/task/22518.
Actuellement en 4.2.3 :
- OpenVPN : 2.4.7
- OpenSSL : 1.1.1d
Version stable :
- OpenVPN : 2.4.9
- OpenSSL : 1.1.1f
OpenVPN 2.5.0 Beta 1 (2020-08-14)
- http://openvpn.net/
Bonjour Neustradamus,
Etes-vous certain que la version Open VPN 2.4.7 soit bien chargée ?
En effet, dans les logs de connections, cette information est bien présente :
.
Cependant, impossible dans mon fichier .ovpn de faire reconnaitre la balise
ou encore la commande
!
J'obtiens dans l'interface de la Freebox : "Erreur lors de la mise à jour de la configuration VPN : Configuration OpenVPN non supporté"
Je fais tous ces tests car impossible de faire fonctionner mon client VPN sur la Freebox en raison d'une erreur obscure d'IPV6 non supportée (alors que mon client VPN fonctionne très bien et que la box semble fonctionner correctement) :
Merci de votre retour rapide.
@mbizon : Qu'en pensez-vous ?
Rappel, il y a OpenVPN 2.4.9 depuis le 16 avril 2020, la 2.4.7 date du 18 février 2019 et la 2.5.0 arrive très bientôt.
tls-crypt existe depuis OpenVPN 2.4.x en 2016...
Ce n'est donc pas logique que ça ne fonctionne pas correctement de nos jours.
@kaisernet : Il faut suivre et voter :
- https://dev.freebox.fr/bugs/task/22839
- https://dev.freebox.fr/bugs/task/30669
Malgré le passage ce midi à la 4.2.5, je n'arrive toujours pas à me connecter à mon VPN.
Les logs sont identiques. Ils ne reconnaîtraient les options :
ce qui créé un problème avec les VPN en ipV6. Quand j'essaye de rajouter les lignes suivantes pour contourner ce problème, les lignes ne sont pas reconnues :
Pourtant il s'agit bien de commande openVPN 2.4.
Actuellement dans Freebox OS 4.2.5 :
- OpenVPN : 2.4.7
- OpenSSL : 1.1.1d
Versions stables :
- OpenVPN : 2.4.9
- OpenSSL : 1.1.1f
OpenVPN 2.5.0 Beta 3 (2020-08-31)
- http://openvpn.net/
Lié à :
- https://dev.freebox.fr/bugs/task/25817
OpenVPN 2.5.0 RC1 (2020-09-21) :
- http://openvpn.net/
- https://github.com/OpenVPN/openvpn/releases
OpenVPN 2.5.0 RC2 (2020-09-30) :
- https://openvpn.net/ - https://github.com/OpenVPN/openvpn/releases
OpenVPN 2.5.0 RC3 (2020-10-15) :
- https://openvpn.net/
- https://github.com/OpenVPN/openvpn/releases
Voir toutes les améliorations de la 2.5.0 presque finale "RC3" dans l'email d'annonce :
- https://sourceforge.net/p/openvpn/mailman/message/37132033/
Overview of changes in OpenVPN v2.5:
- https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn25
Rappel pour la 2.4.x (il manque toujours des options) :
Overview of changes in OpenVPN v2.4:
- https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn24
@mbizon, ça devrait évoluer avec ça non ?
OpenVPN 2.5.0 (2020-10-27) :
- https://openvpn.net/
- https://github.com/OpenVPN/openvpn/releases
Email d'annonce de la sortie d'OpenVPN 2.5.0 :
- https://sourceforge.net/p/openvpn/mailman/message/37138737/
OpenVPN 2.5 is a new major release with many new features:
- Client-specific tls-crypt keys (–tls-crypt-v2)
- Added support for using the ChaCha20-Poly1305 cipher in the OpenVPN data channel
- Improved Data channel cipher negotiation
- Removal of BF-CBC support in default configuration
- Asynchronous (deferred) authentication support for auth-pam plugin
- Deferred client-connect
- Faster connection setup
- Netlink support
- Wintun support
- IPv6-only operation
- Improved Windows 10 detection
- Linux VRF support
- TLS 1.3 support
- Support setting DHCP search domain
- Handle setting of tun/tap interface MTU on Windows
- HMAC based auth-token support
- VLAN support
- Support building of .msi installers for Windows
- Allow unicode search string in –cryptoapicert option (Windows)
- Support IPv4 configs with /31 netmasks now
- New option –block-ipv6 to reject all IPv6 packets (ICMPv6)
- MSI installer (Windows)
- The MSI installer now bundles EasyRSA 3, a modern take on OpenVPN CA management
Overview of changes in OpenVPN v2.5:
- https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn25
Rappel pour la 2.4.x (il manque toujours des options dans Freebox OS) :
Overview of changes in OpenVPN v2.4:
- https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn24
OpenVPN 2.5.1 (2021-02-24) :
- https://openvpn.net/
- https://github.com/OpenVPN/openvpn/releases
- https://sourceforge.net/p/openvpn/mailman/message/37226597/
[Openvpn-announce] OpenVPN 2.5.1 released From: Samuli Seppänen <samuli@op...> - 2021-02-24 13:50:33 The OpenVPN community project team is proud to release OpenVPN 2.5.1. It includes several bug fixes and improvements as well as updated OpenSSL and OpenVPN GUI for Windows. Source code and Windows installers can be downloaded from our download page: <https://openvpn.net/community-downloads/>; Debian and Ubuntu packages are available in the official apt repositories: <https://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos>; On Red Hat derivatives we recommend using the Fedora Copr repository. <https://copr.fedorainfracloud.org/coprs/dsommers/openvpn-release/>; --- Overview of changes since OpenVPN 2.4 Faster connections Connections setup is now much faster Crypto specific changes ChaCha20-Poly1305 cipher in the OpenVPN data channel Requires OpenSSL 1.1.0 or newer) Improved TLS 1.3 support when using OpenSSL 1.1.1 or newer Client-specific tls-crypt keys (--tls-crypt-v2) Improved Data channel cipher negotiation Removal of BF-CBC support in default configuration (see below for possible incompatibilities) Server-side improvements HMAC based auth-token support for seamless reconnects to standalone servers or a group of servers. Asynchronous (deferred) authentication support for auth-pam plugin Asynchronous (deferred) support for client-connect scripts and plugins Network-related changes Support IPv4 configs with /31 netmasks now 802.1q VLAN support on TAP servers IPv6-only tunnels New option --block-ipv6 to reject all IPv6 packets (ICMPv6) Linux-specific features VRF support Netlink integration (OpenVPN no longer needs to execute ifconfig/route or ip commands) Windows-specific features Wintun driver support, a faster alternative to tap-windows6 Setting tun/tap interface MTU Setting DHCP search domain Allow unicode search string in --cryptoapicert option EasyRSA3, a modern take on OpenVPN CA management MSI installer --- Important notices BF-CBC cipher is no longer the default Cipher handling for the data channel cipher has been significantly changed between OpenVPN 2.3/2.4 and v2.5, most notably there are no "default cipher BF-CBC" anymore because it is no longer considered a reasonable default. BF-CBC is still available, but it needs to be explicitly configured now. For connections between OpenVPN 2.4 and v2.5 clients and servers, both ends will be able to negotiate a better cipher than BF-CBC. By default they will select one of the AES-GCM ciphers, but this can be influenced using the --data-ciphers setting. Connections between OpenVPN 2.3 and v2.5 that have no --cipher setting in the config (= defaulting to BF-CBC and not being negotiation-capable) must be updated. Unless BF-CBC is included in --data-ciphers or there is a "--cipher BF-CBC" in the OpenVPN 2.5 config, a v2.5 client or server will refuse to talk to a v2.3 server or client, because it has no common data channel cipher and negotiating a cipher is not possible. Generally, we recommend upgrading such setups to OpenVPN 2.4 or v2.5. If upgrading is not possible we recommend adding data-ciphers AES-256-GCM:AES-128-GCM:AES-128-CBC (for v2.5+) or cipher AES-128-CBC (v2.4.x and older) to the configuration of all clients and servers. If you really need to use an unsupported OpenVPN 2.3 (or even older) release and need to stay on BF-CBC (not recommended), the OpenVPN 2.5 based client will need a config file change to re-enable BF-CBC. But be warned that BF-CBC and other related weak ciphers will be removed in coming OpenVPN major releases. For full details see the Data channel cipher negotiation section on the man page. Connectivity to some VPN service provider may break Connecting with an OpenVPN 2.5 client to at least one commercial VPN service that implemented their own cipher negotiation method that always reports back that it is using BF-CBC to the client is broken in v2.5. This has always caused warning about mismatch ciphers. We have been in contact with some service providers and they are looking into it. This is not something the OpenVPN community can fix. If your commercial VPN does not work with a v2.5 client, complain to the VPN service provider. More details on these new features as well as a list of deprecated features and user-visible changes are available in Changes.rst: <https://github.com/OpenVPN/openvpn/blob/release/2.5/Changes.rst>; ---Freebox OS 4.3.1 a OpenVPN 2.5.0, est-ce qu'il y a une amélioration ?