Softethervpn: Mikrotik OpenVPN as a client of SoftEther

Created on 14 Jun 2017 · 26Comments · Source: SoftEtherVPN/SoftEtherVPN

Outgoing connection from Mikrotik OpenVPN (client) to SoftEther OpenVPN (server) causing exceptions on Mikrotik side:

jun/14/2017 12:24:09 ovpn,debug,error,,,,,,,,,bgp,info,,l2tp,,,critical,,,,,,,,,critical,,,,critical duplicate packet, dropping
jun/14/2017 12:24:09 ovpn,debug,error,,,,,,,,,bgp,info,,l2tp,,,critical,,,,,,,,,critical,,,,critical duplicate packet, dropping
jun/14/2017 12:24:10 ovpn,debug,error,,,,,,,,,bgp,info,,l2tp,,,critical,,,,,,,,,critical,,,,critical duplicate packet, dropping
jun/14/2017 12:24:10 ovpn,debug,error,,,,,,,,,bgp,info,,l2tp,,,critical,,,,,,,,,critical,,,,critical duplicate packet, dropping
jun/14/2017 12:24:11 ovpn,debug,error,,,,,,,,,bgp,info,,l2tp,,,critical,,,,,,,,,critical,,,,critical duplicate packet, dropping
jun/14/2017 12:24:11 ovpn,debug,error,,,,,,,,,bgp,info,,l2tp,,,critical,,,,,,,,,critical,,,,critical duplicate packet, dropping
jun/14/2017 12:24:12 ovpn,debug,error,,,,,,,,,bgp,info,,l2tp,,,critical,,,,,,,,,critical,,,,critical duplicate packet, dropping
jun/14/2017 12:24:12 ovpn,debug,error,,,,,,,,,bgp,info,,l2tp,,,critical,,,,,,,,,critical,,,,critical duplicate packet, dropping

There is no problems on using Mikrotik with official OpenVPN software.

bug protocoOpenVPN

Source

andr-04

👍1

All 26 comments

try https://wiki.mikrotik.com/wiki/Manual:Interface/SSTP#SSTP_Client

maurerr on 5 Jul 2017

👍1

Thank you for suggestion, but it is not a solution of OpenVPN. It's required to use L2 connection due to _Mikrotik OVPN client_ provides DHCP to other SoftEther VPN clients.

andr-04 on 9 Jul 2017

I'm facing the same problem.
@andr-04: Did you found a workaround or a solution for this?

steirico on 16 Sep 2017

I discovered in the SoftEtherVPN logs that apparently 2 channels are opened for the very same OpenVPN connection from the MikroTik router. This might explain why packets are send twice:

Entering OpenVPN TCP Server Main Loop.
OpenVPN New Session: 192.168.88.232:1194 -> 192.168.88.1:48752 Proto=1
LOG: OpenVPN Session 1 (192.168.88.1:48752 -> 192.168.88.232:1194): A new session is created. Protocol: TCP
RECV PACKET: 0 16064239884603291736
   PKT 7 0
OpenVPN New Channel :0
LOG: OpenVPN Session 1 (192.168.88.1:48752 -> 192.168.88.232:1194) Channel 0: A new channel is created.
Recv Packet ID (c=0): 0
SIZE: recv_fifo = 0, send_fifo = 0
Sending Opcode=8  Sending ACK Packet IDs (c=0): 0 
RECV PACKET: 0 16064239884603291736
   PKT 7 0
OpenVPN New Channel :0
LOG: OpenVPN Session 1 (192.168.88.1:48752 -> 192.168.88.232:1194) Channel 0: A new channel is created.
Recv Packet ID (c=0): 1
SIZE: recv_fifo = 0, send_fifo = 0
Sending Opcode=8  Sending ACK Packet IDs (c=0): 1 
RECV PACKET: 0 16064239884603291736
   PKT 4 0
Recv Packet ID (c=0): 2
SSL (c=0): 283
SSL Pipe Created (c=0).
SSL_Write: 283
SIZE: recv_fifo = 0, send_fifo = 0
RawOut Fifo Size (c=0): 1559
Sending Opcode=4  Sending ACK Packet IDs (c=0): 2 
Sending Opcode=4  
RECV PACKET: 0 16064239884603291736
   PKT 5 0
RECV PACKET: 0 16064239884603291736
   PKT 5 0
RECV PACKET: 0 16064239884603291736
   PKT 4 0
Recv Packet ID (c=0): 3
SSL (c=0): 895
SSL_Write: 895
SslCertVerifyCallback preverify error: 'self signed certificate'
SIZE: recv_fifo = 0, send_fifo = 0
RawOut Fifo Size (c=0): 59
Sending Opcode=4  Sending ACK Packet IDs (c=0): 3 
RECV PACKET: 0 16064239884603291736
   PKT 5 0
RECV PACKET: 0 16064239884603291736
   PKT 4 0
Recv Packet ID (c=0): 4
SSL (c=0): 330
SSL_Write: 330
SIZE: recv_fifo = 256, send_fifo = 0
Sending Opcode=5  Sending ACK Packet IDs (c=0): 4 
Sending Opcode=8  
Sending Opcode=8  
Sending Opcode=8  
Sending Opcode=8  
Sending Opcode=8  
Breaking OpenVPN TCP Server Main Loop.

cm0x4D on 22 Sep 2017

isn't this according to spec? Control Channel + Data channel
https://build.openvpn.net/doxygen/html/network_protocol.html

maurerr on 22 Sep 2017

Those channels are rather conceptual. When I use the openvpn client on my Mac over TCP to connect to SoftEtherVPN, only one single channel will be created and it works without problems.

cm0x4D on 23 Sep 2017

Another Mikrotik user enters!

Was just about to set this up, luckily I took a read in here...

Considering that Softether hasn't been updated for a year, it might be better to just use OpenVPN instead?

tmikaeld on 24 Sep 2017

I found already one problem: MikroTik routers do not send the peer info as part of the key exchange and SoftEtherVPN's OpenVPN compatibility layer failed if this string was missing in the key exchange.

Here the PR with the fix: #355

cm0x4D on 28 Sep 2017

👍1

The good news is that using this patch I was able to connect from a MikroTik router to SoftEtherVPN in ip mode (Layer 3 or tun) mode, but a connection using ether mode (Layer 2) still fails. The reason for this is that even when using layer 2 (so no IP), the MikroTik router expects IP parameters in the PUSH_REPLY.

Sending fake IP settings even when a layer 2 connection from a MikroTik router is incomming actually works, but I have to figure out how to detect connections from those routers as sending IP parameters to all clients would be really a bad idea.

cm0x4D on 28 Sep 2017

@cm0x4D facing the same issue using IP mode.

moham96 on 22 Jul 2018

@moham96 Did you apply the patch?

cm0x4D on 23 Jul 2018

@cm0x4D no, I just connected to one of the servers from vpngate.net looking at the PR you sent I can see it was merged so I assumed these servers are already patched.
I will try to build from the master branch and see.
thanks

moham96 on 23 Jul 2018

@cm0x4D I just built softether server from the master branch and tried to connect from mikrotik and the same problem persists.
deepinscreenshot_20180725201453

moham96 on 25 Jul 2018

I'm experiencing the same issue. I cannot connect to my VPN server - I'm getting 'duplicate packet, dropping'. L2TP connection works fine, but as it is now considered as vulnerable - I'm seeking for a safer way to communicate through my internal network...

panwolfram on 21 Oct 2018

I prepared a virtual machine with the latest stable version of RouterOS (6.43.4) and I can reproduce the issue.

~~However, the cause of the connection failure is this:~~
~~ovpn-out1: terminating... - TLS failed~~

~~Which also happens with an OpenVPN 2.4.0 server.~~

I realized that the Certificate field is meant to be the client certificate, not the server one.
The graphical interface is not clear on that.

davidebeatrici on 21 Oct 2018

Fixed in #812.

davidebeatrici on 20 Nov 2018

https://github.com/SoftEtherVPN/SoftEtherVPN/issues/333#issuecomment-332789392:

The good news is that using this patch I was able to connect from a MikroTik router to SoftEtherVPN in ip mode (Layer 3 or tun) mode, but a connection using ether mode (Layer 2) still fails. The reason for this is that even when using layer 2 (so no IP), the MikroTik router expects IP parameters in the PUSH_REPLY.

Sending fake IP settings even when a layer 2 connection from a MikroTik router is incomming actually works, but I have to figure out how to detect connections from those routers as sending IP parameters to all clients would be really a bad idea.

Workaround implemented in #828.

davidebeatrici on 3 Dec 2018

@davidebeatrici I can confirm that the master branch now is working fine with mikrotik router.
I'm curious if this fix was pushed to the stable repo? I see they have some differences in structure so I can't be sure if it landed or not? I also see that the developer repo releases versions is 5.x while the stable releases versions are 4.x so are the stable version really that much behind the developer one ?
It would be nice if we had a version column in https://www.vpngate.net so we know what version each server is running.

moham96 on 1 May 2019

Stable Edition is maintained by me. I will consider to integrate this patch to the Stable Edition after my verification will complete. I don't assure the exact date to the integration. Before that, everybody can use Developer Edition.

dnobori on 2 May 2019

Hi,
I'm facing this error again (sort of):
I've setup softether vpnserver on an Amazon Aws instance (running ubuntu 18.04.2) and when i try to connect from my local router to that server i get the duplicate packet error
2019-06-10-162111_1366x768_scrot
Note that the connection is established and the vpn is working fine but i thought I report it anyway in case it has some long term effect.
to replicate the problem locally I made a virtual machine with the same system (ubuntu 18.04.2) and connected to it from the mikrotik router and couldn't reproduce the problem.
The strange thing is that the problem only occur when connecting to my AWS instance and not when connecting to a local server, so maybe this has something to do with connecting through public ip vs through internal network private ip ?

moham96 on 10 Jun 2019

Can confirm this problem.
Server - SoftEther 64-bit on Debian 9 Ver 4.30 Build 9696
Client - Mikrotik RB2011 with ROS 6.45.1
L2TP connection - work
SSTP connection - work
OpenVPN connection - not work, in mikrotik log many entries with "duplicate packet, dropping"