Disclaimer: This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.
Special thanks to: Giridhar Katti Sreenivasulu Naidu Alok
Table of Contents
Overview
This recommended read describes the workaround regarding OpenVPN 3.4.x not connecting or traffic not flowing due to OpenVPN not providing any compression option in Preferred Mode.
Background
A new version 3.4.x of the OpenVPN Connect client was released recently. This version has two modes (can be selected in Advanced Settings) – Legacy and Preferred. After the upgrade, some users reported being unable to establish an SSL VPN tunnel with the Sophos Firewall, and some reported that the tunnel was established. Still, there’s no traffic going on the tunnel.
On further investigation, it was found that the new OpenVPN Connect version does not support any compression options in the configuration in the Preferred mode. This is also highlighted in the OpenVPN forum.
Temporary Fix/Work Around
For v19.5 and v20, the workaround is to use only the legacy mode of the OpenVPN Connect Client.
In OpenVPN Connect, go to Settings > Advanced Settings > Legacy.
Note: If "Preferred" mode is selected, the tunnel won’t come up
Note: If "Legacy" mode is selected, the problem is only seen when compression on the Sophos Firewall is set to OFF.
To confirm if the Sophos Firewall is using compression, go to Configure > Remote access VPN > SSL VPN > SSL VPN Global Settings > Advanced settings > Compress SSL VPN traffic.
If compression is OFF, please enable it by checking the check-box and the Users or Administrators will need to either:
- Re-import/Download the OVPN file
- Manually edit the OVPN file and set "comp-lzo yes" which would not require the re-download/import of the OVPN file.
This only affects Android users.
|
Openvpn Connect version |
Security Level |
Compression on SFOS |
Tunnel status |
Data plane |
|
Android Phone |
Legacy |
ON |
Up |
Up |
|
OFF |
Up |
Down Error: 2024-01-30 10:18:08Z [7565] user1/xx: 35854 Bad compression stub decompression header byte:251 |
||
|
iOS Phone |
Legacy |
ON/OFF |
Up |
Up |
|
MacOS |
Legacy |
ON/OFF |
Up |
Up |
|
Windows |
Legacy |
ON/OFF |
Up |
Up |
|
Windows |
- |
ON/OFF |
Up |
Up |
Additional Alternative
Additional alternatives shared by community members
- Downgrade/Reinstall OpenVPN 3.3.4
- OpenVPN for Android by Arne Schwabe (use at your own risk, but should be a safe App)
.
[edited by: emmosophos at 10:41 PM (GMT -8) on 1 Feb 2024]
