Keine Verbindung mehr über pfSense mit eurem HowTo

[Schallwerker]

Moin auch,

Mit eurem HowTo bekommt man in den aktuellen pfSense Versionen keine Verbindung mehr hin:

May 15 13:33:08 openvpn 39871 VERIFY ERROR: depth=0, error=CA signature digest algorithm too weak: C=DE, ST=SAXONIA, L=Frohburg, O=COSIMO Vertriebs- und Beratungs GmbH, OU=Webservices, CN=vpn2.connect2any.net, name=VPN2, emailAddress=isp@cosimo.de, serial=3
May 15 13:33:08 openvpn 39871 OpenSSL: error:0A000086:SSL routines::certificate verify failed:
May 15 13:33:08 openvpn 39871 TLS_ERROR: BIO read tls_read_plaintext error
May 15 13:33:08 openvpn 39871 TLS Error: TLS object -> incoming plaintext read error
May 15 13:33:08 openvpn 39871 TLS Error: TLS handshake failed
May 15 13:33:08 openvpn 39871 SIGUSR1[soft,tls-error] received, process restarting
May 15 13:33:18 openvpn 39871 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
May 15 13:33:18 openvpn 39871 WARNING: if you use --mssfix and --fragment, you should use the "mtu" flag for both or none of of them.
May 15 13:33:18 openvpn 39871 TCP/UDP: Preserving recently used remote address: [AF_INET]185.62.150.18:1194
May 15 13:33:18 openvpn 39871 UDPv4 link local (bound): [AF_INET]192.168.178.64:1194
May 15 13:33:18 openvpn 39871 UDPv4 link remote: [AF_INET]185.62.150.18:1194
May 15 13:33:18 openvpn 39871 TLS Error: Unroutable control packet received from [AF_INET]185.62.150.18:1194 (si=3 op=P_ACK_V1)
May 15 13:33:20 openvpn 39871 TLS Error: Unroutable control packet received from [AF_INET]185.62.150.18:1194 (si=3 op=P_ACK_V1)
May 15 13:33:22 openvpn 39871 TLS Error: Unroutable control packet received from [AF_INET]185.62.150.18:1194 (si=3 op=P_CONTROL_V1)
May 15 13:33:23 openvpn 39871 TLS Error: Unroutable control packet received from [AF_INET]185.62.150.18:1194 (si=3 op=P_CONTROL_V1)

[Schallwerker]

okay, habe es zum laufen bekommen.

Wer noch Probleme hat, das muss unbedingt ins Custom Options Feld:

tun-mtu 1440;
fragment 1400;
comp-lzo;
cipher BF-CBC;
providers legacy default;
tls-version-min 1.0;
tls-cipher "DEFAULT:@SECLEVEL=0";
ncp-ciphers AES-256-GCM:AES-256-CBC:AES-128-GCM:AES-128-CBC:BF-CBC;