Android + OpenVPN 3.4.0 + SSL VPN = No Traffic

Question

Hello, 
 Began experiencing an issue with our SSL VPN connections when some Android tablets updated OpenVPN Connect app from 3.3.4 to 3.4.0. 
 Symptom: SSL VPN connections are made successfully in 3.4.0 but no traffic flows. OpenVPN 3.4.0 is configured to use the 'Legacy' setting. I tried the others to no avail. OpenVPN log will show this error repeating every minute or so: 
 "TUN write exception: write_some: Invalid argument" 
 Workaround: After removing various deprecated options (according to OpenVPN log) and lots of trial and error with no success I eventually stumbled on a workaround. Despite "Compress SSL VPN traffic" being disabled in SSL VPN global settings the Sophos Firewall still seems to be doing something regarding compression. Only when I manually change the 'comp-lzo' parameter to 'yes' in the ovpn file does the connection start passing traffic again. This message is then displayed in the OpenVPN log: 
 "EVENT: COMPRESSION_ENABLED info='Asymmetric compression enabled. Server may send compressed data. This may be a potential security issue.' trans=TO_DISCONNECTED 
 Clearly this is not a good workaround with lots of devices/users. Is Sophos aware of this issue and will it be fixed? 
 Working OpenVPN 3.4.0 Config: client
dev tun
proto udp
nobind
(keys removed)
auth-user-pass
cipher AES-128-CBC
auth SHA256
comp-lzo yes
verb 3
reneg-sec 86400
remote x.x.x.x 8443 udp

Sreenivasulu Naidu · Accepted Answer

Hi The G-Man , We tested this internally, for now with v19.5.MR4, compression should be turned ON and keep the 'Legacy' mode on OpenVPN Connect to enable data plane. As Ant&oacute;nio Carvalho pointed out, Openvpn should fix this issue in their later versions. 
 We will also discuss internally to come out with a solution so that legacy and latest OpenVPN clients work with SFOS seamlessly. 
 For now, the workaround you mentioned is the way forward.

The G-Man · Answer

Hi Emmanuel, 
 I just want to point out to others that may be reading that it worked for you because you downloaded your profile when Compress SSL VPN Traffic was enabled. This function sets comp-lzo to yes in the profiles. If it is disabled comp-lzo is set to no in the profiles, which I imagine will be the case for a lot of users that had already downloaded profiles months/years previously and had no issue until this point. For those users - they will have to re-download the profiles (or manually edit existing ones) for this workaround to function. 
 Further information on OpenVPN and deprecated compression here: https://community.openvpn.net/openvpn/wiki/Compression 
 Sreenivasulu Naidu's post below advises a future solution will be looked at which will hopefully take this into account.

Android + OpenVPN 3.4.0 + SSL VPN = No Traffic

Top Replies