Compression "comp-lzo no" in openVPN client file not supported

Question

Hi there. 
 Using XG Home with latest SFOS 19.5.3 MR-3-Build652 exporting the openVPN SSL file and using it on iOS 17.0.3 openVPN App V. 3.4.0. In advanced settings of the openvpn is an option of recommended secuity level. If I choose it, I get an error message: server pushed compression settings that are not allowed and will result in a non-working connection 
 and the connection fails. I had try to delete this line (comp-lzo no) in the openvpn-file and achieve to connect without an error but there is no connection. I've also tried to put a semicolon before this line in client-config-template.ovpn over ssh. Again no chance to connect properly. 
 Any point to the solution would be fine. 
 Thanks 
 btw: Some more info regarding the comp-lzo option.

Alok · Accepted Answer

We are looking into this actively, currently &ldquo;comp-lzo&rdquo; is the attribute causing some issues in making it work with the &ldquo;preferred&rdquo; security level. 
 With the latest release of Android (3.4.0), there seems some issue with &ldquo;comp-lzo no&rdquo; and legacy mode too, which is highlighted in the OpenVPN community at https://forums.openvpn.net/viewtopic.php?t=43571 . 
 The current workaround to make Android-based OpenVPN connect clients to work is by enabling &ldquo;compression&rdquo; on SFOS global settings and reimport of configuration.

Openvpn Connect version

Security Level

Compression on SFOS

Tunnel status

Data plane

Android Phone Openvpn Connect 3.4.0

Legacy

ON

Up

OFF

Up

Down 
 Error: 2024-01-30 10:18:08Z [7565] user1/xx: 
 35854 Bad compression stub decompression 
 header byte:251

iOS Phone Openvpn Connect 3.4.1

Legacy

ON/OFF

Up

MacOS Openvpn Connect 3.4.8

Legacy

ON/OFF

Up

Windows Openvpn Connect 3.4.3

Legacy

ON/OFF

Up

Windows Sophos Connect Client

-

ON/OFF

Up

Vivek Jagad · Answer

Hey fink , Thank you for reaching out to the community, following are parameters options you can opt for: client dev tun proto [] verify-x509-name "[]" ;route remote_host 255.255.255.255 net_gateway resolv-retry infinite nobind persist-key persist-tun ca [] cert [] key [] auth-user-pass cipher [] auth [] comp-lzo [] ;can_save [] ;otp [] ;run_logon_script [] ;auto_connect [] ;route-delay 4 verb 3 reneg-sec 0 XG - RR Temporary Fix OpenVPN (3.4.0)

UThomas · Answer

Hello, I got rid of this message after changing the security level in the openvpn app (3.4.1) to "Legacy". 
 It's under settings -> advanced settings -> security level 
 Sophos should remove deprecated seetings or implament Wireguard :-) 
 SFOS v20

Compression "comp-lzo no" in openVPN client file not supported

Top Replies