OpenVPN: compression error & fix (Android client)

[sos_opnsense]

Using the 23.1.6 OPNsense web GUI, I downloaded the openVPN config ("file only") for my Android client (OpenVPN Connect 3.3.2).

Connected ok, but wouldn't route traffic. Log showed a compression error.

It turns out the problem is that the GUI-generated config has the line "compress lzo", but the current Android app requires "comp-lzo" to work.

I ran into a similar error with cypher fallback option not working due to OPNsense vs OpenVPN client version changes & differences and resulting incompatibilities.

Moral of the story: carefully read the changelogs, log files, and know how to troubleshoot!

Edit: I see that compression is a deprecated option according OpenVPN: https://community.openvpn.net/openvpn/wiki/DeprecatedOptions#Option:--comp-lzoStatus:Pendingremoval

[benyamin]

It turns out the problem is that the GUI-generated config has the line "compress lzo", but the current Android app requires "comp-lzo" to work.

I'm presuming your server's Tunnel Settings configuration for Compression was set to "Enabled - LZO algorithm (--compress lzo)" and then you changed it to one of the Legacy LZO options in that drop-down list. Importing the new client configuration file should then resolve the problem.

I would suggest using "No Preference" instead to mitigate VORACLE attacks. This *should* disable compression entirely. The default compression configuration item is now --allow-compression no, which causes the server to refuse any clients attempting to use non-stub compression. So if client still tries to use compression, a stub type will be negotiated.

I ran into a similar error with cypher fallback option not working due to OPNsense vs OpenVPN client version changes & differences and resulting incompatibilities.

This is because the OpenVPN Connect for Android (presently v3.3.4 (9290)) is based on openvpn3 which tracks the OpenVPN 2.x stream but presently lags behind somewhat. I do believe a workaround was provided in Github issue #6420.

That being said, you could try --cypher none which is equivalent to setting Encryption algorithm (deprecated) in your server's Cryptographic Settings to "None". I would also set TLS Authentication to "Enabled - Authentication only".

Again, importing the new client configuration file should then resolve the problem.


I use a different OpenVPN server vendor for my Android clients and it doesn't implement the --cipher none option so I am unable to properly test the client in this case. However, I can confirm that the Android client will use stub compression options for the tunnel if available.