HOWTO: cryptostorm on Android non-root | cryptostorm.org/android

Post by **parityboy** » Fri Apr 07, 2017 7:01 pm

@user name

Does the config file have multiple <remote></remote> tags? If so, could you try removing the tags?

For example:

Code: Select all

# this is the cryptostorm.is client settings file, versioning...
# cstorm_linux-rome_1-4.conf
# last update date: 12 January 2014

# it is intended to provide connection solely to our London-based exitnode cluster... yay bad food! ;-)
# DNS resolver redundancy provided by TLD-striped, randomised lookup queries
# Chelsea Manning is indeed a badassed chick: #FreeChelsea!
# also... FuckTheNSA - for reals. W00d!


client
dev tun
resolv-retry 16
nobind
persist-tun
persist-key
float


remote-random
# randomizes selection of connection profile from list below, for redundancy against...
# DNS blacklisting-based session blocking attacks


# Exit node mappings for Rome
remote linux-rome.cryptostorm.net 443 udp
remote linux-rome.cryptostorm.org 443 udp
remote linux-rome.cryptostorm.nu 443 udp
remote linux-rome.cstorm.pw 443 udp



comp-lzo no
# specifies refusal of link-layer compression defaults
# we prefer compression be handled elsewhere in the OSI layers
# see forum for ongoing discussion - https://cryptostorm.org/viewtopic.php?f=38&t=5981

down-pre
# runs client-side "down" script prior to shutdown, to help minimise risk...
# of session termination packet leakage

allow-pull-fqdn
# allows client to pull DNS names from server
# we don't use but may in future leakblock integration

explicit-exit-notify 3
# attempts to notify exit node when client session is terminated
# strengthens MiTM protections for orphan sessions

hand-window 37
# specified duration (in seconds) to wait for the session handshake to complete
# a renegotiation taking longer than this has a problem, & should be aborted

mssfix 1400
# congruent with server-side --fragment directive

auth-user-pass
# passes up, via bootstrapped TLS, SHA512 hashed token value to authenticate to darknet

# auth-retry interact
# 'interact' is an experimental parameter not yet in our production build.

ca ca2.crt
# specification & location of server-verification PKI materials
# for details, see http://pki.cryptostorm.org

<ca>
-----BEGIN CERTIFICATE-----
MIIFHjCCBAagAwIBAgIJAKekpGXxXvhbMA0GCSqGSIb3DQEBCwUAMIG6MQswCQYD
VQQGEwJDQTELMAkGA1UECBMCUUMxETAPBgNVBAcTCE1vbnRyZWFsMTYwNAYDVQQK
FC1LYXRhbmEgSG9sZGluZ3MgTGltaXRlIC8gIGNyeXB0b3N0b3JtX2RhcmtuZXQx
ETAPBgNVBAsTCFRlY2ggT3BzMRcwFQYDVQQDFA5jcnlwdG9zdG9ybV9pczEnMCUG
CSqGSIb3DQEJARYYY2VydGFkbWluQGNyeXB0b3N0b3JtLmlzMB4XDTE0MDQyNTE3
MTAxNVoXDTE3MTIyMjE3MTAxNVowgboxCzAJBgNVBAYTAkNBMQswCQYDVQQIEwJR
QzERMA8GA1UEBxMITW9udHJlYWwxNjA0BgNVBAoULUthdGFuYSBIb2xkaW5ncyBM
aW1pdGUgLyAgY3J5cHRvc3Rvcm1fZGFya25ldDERMA8GA1UECxMIVGVjaCBPcHMx
FzAVBgNVBAMUDmNyeXB0b3N0b3JtX2lzMScwJQYJKoZIhvcNAQkBFhhjZXJ0YWRt
aW5AY3J5cHRvc3Rvcm0uaXMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
AQDJaOSYIX/sm+4/OkCgyAPYB/VPjDo9YBc+zznKGxd1F8fAkeqcuPpGNCxMBLOu
mLsBdxLdR2sppK8cu9kYx6g+fBUQtShoOj84Q6+n6F4DqbjsHlLwUy0ulkeQWk1v
vKKkpBViGVFsZ5ODdZ6caJ2UY2C41OACTQdblCqaebsLQvp/VGKTWdh9UsGQ3LaS
Tcxt0PskqpGiWEUeOGG3mKE0KWyvxt6Ox9is9QbDXJOYdklQaPX9yUuII03Gj3xm
+vi6q2vzD5VymOeTMyky7Geatbd2U459Lwzu/g+8V6EQl8qvWrXESX/ZXZvNG8QA
cOXU4ktNBOoZtws6TzknpQF3AgMBAAGjggEjMIIBHzAdBgNVHQ4EFgQUOFjh918z
L4vR8x1q3vkp6npwUSUwge8GA1UdIwSB5zCB5IAUOFjh918zL4vR8x1q3vkp6npw
USWhgcCkgb0wgboxCzAJBgNVBAYTAkNBMQswCQYDVQQIEwJRQzERMA8GA1UEBxMI
TW9udHJlYWwxNjA0BgNVBAoULUthdGFuYSBIb2xkaW5ncyBMaW1pdGUgLyAgY3J5
cHRvc3Rvcm1fZGFya25ldDERMA8GA1UECxMIVGVjaCBPcHMxFzAVBgNVBAMUDmNy
eXB0b3N0b3JtX2lzMScwJQYJKoZIhvcNAQkBFhhjZXJ0YWRtaW5AY3J5cHRvc3Rv
cm0uaXOCCQCnpKRl8V74WzAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IB
AQAK6B7AOEqbaYjXoyhXeWK1NjpcCLCuRcwhMSvf+gVfrcMsJ5ySTHg5iR1/LFay
IEGFsOFEpoNkY4H5UqLnBByzFp55nYwqJUmLqa/nfIc0vfiXL5rFZLao0npLrTr/
inF/hecIghLGVDeVcC24uIdgfMr3Z/EXSpUxvFLGE7ELlsnmpYBxm0rf7s9S9wtH
o6PjBpb9iurF7KxDjoXsIgHmYAEnI4+rrArQqn7ny4vgvXE1xfAkFPWR8Ty1ZlxZ
gEyypTkIWhphdHLSdifoOqo83snmCObHgyHG2zo4njXGExQhxS1ywPvZJRt7fhjn
X03mQP3ssBs2YRNR5hR5cMdC
-----END CERTIFICATE-----
</ca>

ns-cert-type server
# requires TLS-level confirmation of categorical state of server-side certificate for MiTM hardening.

auth SHA512
# data channel HMAC generation
# heavy processor load from this parameter, but the benefit is big gains in packet-level...
# integrity checks, & protection against packet injections / MiTM attack vectors

cipher AES-256-CBC
# data channel stream cipher methodology
# we are actively testing CBC alternatives & will deploy once well-tested...
# cipher libraries support our choice - AES-GCM is looking good currently

replay-window 128 30
# settings which determine when to throw out UDP datagrams that are out of order...
# either temporally or via sequence number

tls-cipher TLS-DHE-RSA-WITH-AES-256-CBC-SHA
# implements 'perfect forward secrecy' via TLS 1.x & its ephemeral Diffie-Hellman...
# see our forum for extensive discussion of ECDHE v. DHE & tradeoffs wrt ECC curve choice
# http://ecc.cryptostorm.org

tls-client
key-method 2
# specification of entropy source to be used in initial generation of TLS keys as part of session bootstrap

log devnull.txt
verb 0
mute 1
# sets logging verbosity client-side, by default, to zero
# no logs kept locally of connections - this can be changed...
# if you'd like to see more details of connection initiation & negotiation

Post by **user name** » Fri Apr 07, 2017 3:53 am

It is very disappoining to see such slow support response here. Days between me sending a post and it appearing, forget about getting an answer. My 1 week test token is about to expire, still no working android config.

Post by **user name** » Wed Apr 05, 2017 7:51 pm

parityboy wrote:Have you tried these very same config files on a previous version of Android? Did they work? Did you have to edit them in any way?

I don't have access to older Android versions. But I do have other VPN servers set up and running on my current 7.1.1 phone.

Post by **parityboy** » Wed Apr 05, 2017 4:40 am

user name wrote:Android 7.1.1 on Pixel
OpenVPN for Android 0.6.65, have working vpn configs

Tried linux and android ovpn files (raw) from github and android tutorials, which are linked in the token email.

Issue: nothing is being imported fromt the ovpn file. No server list, no certs, nothing. Import log says: your config had a few options that are not mapped to UI configurations.

How do I get it going on android?

Have you tried these very same config files on a previous version of Android? Did they work? Did you have to edit them in any way?

Post by **user name** » Tue Apr 04, 2017 2:38 am

Android 7.1.1 on Pixel
OpenVPN for Android 0.6.65, have working vpn configs

Tried linux and android ovpn files (raw) from github and android tutorials, which are linked in the token email.

Issue: nothing is being imported fromt the ovpn file. No server list, no certs, nothing. Import log says: your config had a few options that are not mapped to UI configurations.

How do I get it going on android?

Post by **parityboy** » Mon Jan 16, 2017 3:32 pm

kakoulo wrote:Hi, For me it does not work anymore, I change smartphone

I installed open vpn, but when i want to import a config he says :

" No endtag <//head> for startag </head> found "

Do you have a solution ?

thanks

Sounds like you downloaded the config from GitHub. Left click on the config file, then click "raw". Save that into a config file, and then import it.

Post by **marzametal** » Fri Jan 13, 2017 8:12 am

kakoulo wrote:Hi, For me it does not work anymore, I change smartphone

I installed open vpn, but when i want to import a config he says :

" No endtag <//head> for startag </head> found "

Do you have a solution ?

thanks

CS on my Samsung Galaxy S2, running LineageOS 14.1, build date 08/01 is working fine. But I use OpenVPN for Android by Arne Schwabe.

I just had a look at my .conf / .ovpn file, and I couldn't find any head tags in it.

Post by **kakoulo** » Fri Jan 13, 2017 1:09 am

Hi, For me it does not work anymore, I change smartphone

I installed open vpn, but when i want to import a config he says :

" No endtag <//head> for startag </head> found "

Do you have a solution ?

thanks

Post by **marzametal** » Wed Dec 28, 2016 7:25 am

Winehouse wrote:Hi.

Where can I find the .conf files for Android? I don't see them on Github.

Thanks.

https://github.com/cryptostorm/cryptost ... tion_files
The conf files you are looking for are located in the LINUX directory...

Post by **Winehouse** » Tue Dec 27, 2016 10:27 pm

Hi.

Where can I find the .conf files for Android? I don't see them on Github.

Thanks.

Post by **ipv6problem** » Tue Aug 30, 2016 12:28 am

Sorry about the double post before. I missed the moderation message before the page refreshed.

I wanted to add that I solved the IPv6 problem by doing the following workaround. I do not know if this works in all cases, but I tested it with www.ipv6leak.com and it reported that IPv6 is not leaking.

In OpenVPN under "Routing" tab, untick "Bypass VPN for local networks"

Under IPv6, untick "Use default Route" and enter a bogus local route under "Custom Routes".

This sends all IPv6 routing requests nowhere...

Post by **ipv6problem** » Tue Aug 30, 2016 12:13 am

How do I disable IPv6? OpenVPN leaks my IPv6, or at least the config files do. My phone is not rooted so I am relying on the VPN client to deal with this. Can OpenVPN do this?

Post by **ipv6problem** » Tue Aug 30, 2016 12:02 am

I have a problem with IPV6. Is there any way to block IPV6 connections on a non-rooted device? whatsmyipaddress.com sees my device IPV6 address and locates me precisely.

I know that cyrptostorm does not handle IPV6 addresses and that is not a problem on a PC, but on android this is an issue.

I just tried VyprVPN with whatsmyipaddress.com and it only showed my IPV4 address and the VPN assigned IP address.

How can I block IPV6 connections using OpenVPN/cyptostorm?

Post by **marzametal** » Mon Jun 20, 2016 2:47 pm

dfkt wrote:Made some fresh configs with the currently available nodes - https://github.com/dfkt/cryptostorm-and ... pn-configs

They include remote-random, which seems to work just fine with the current version of Arne Schwabe's client.

Just when I was looking to update mobile configs, I notice this. Thanks!

Post by **dfkt** » Sat Jun 11, 2016 6:33 pm

Made some fresh configs with the currently available nodes - https://github.com/dfkt/cryptostorm-and ... pn-configs

They include remote-random, which seems to work just fine with the current version of Arne Schwabe's client.

Post by **marzametal** » Sun Apr 03, 2016 8:09 am

Thanks for the work put to the Android confs... much appreciated Sir!

Post by **JTD121** » Sat Mar 12, 2016 8:19 pm

Ah, great. I recently upgraded my Nexus 5 to 5.1.1 (CM12.1), and haven't tested connection to CS yet. In a couple weeks I will probably be using CS connection heavily (at a con) so hopefully this will be a non-issue by then :p

Post by **Guest** » Sun Mar 06, 2016 11:38 am

wpaschukat wrote:
furryguest wrote:First time trying and I get an error on import :
no endtag <//button> for starttag </button> found
Nexus 6p on mm

You're making the same mistake that I made (downloading the conf files directly from within github).

Download the lot directly https://github.com/tealcavalon/OpenVPN_ ... master.zip and extract the necessary confs from there.

Aha. Thanks, this worked !!

Post by **wpaschukat** » Sat Mar 05, 2016 11:59 pm

furryguest wrote:First time trying and I get an error on import :
no endtag <//button> for starttag </button> found
Nexus 6p on mm

You're making the same mistake that I made (downloading the conf files directly from within github).

Download the lot directly https://github.com/tealcavalon/OpenVPN_ ... master.zip and extract the necessary confs from there.

Post by **Tealc** » Sat Mar 05, 2016 4:41 pm

furryguest wrote:First time trying and I get an error on import :
no endtag <//button> for starttag </button> found
Nexus 6p on mm

Are you using "OpenVPN for Android 0.6.47" application from Arne Schwabe ?

Post by **wpaschukat** » Sat Mar 05, 2016 3:33 am

Mr Tealc Sir,

works like a charm. Mille Gracie.

Post by **furryguest** » Sat Mar 05, 2016 1:34 am

First time trying and I get an error on import :
no endtag <//button> for starttag </button> found
Nexus 6p on mm

Post by **Tealc** » Fri Mar 04, 2016 11:00 pm

So once again an update... it works everywhere once again, download new conf's files from github

Post by **Tealc** » Tue Mar 01, 2016 7:51 am

This is really strange, I'm at 5.1.1 stock Sony android and it doesn't work.

Are we seeing once again the problem in non-root and rooted?

Post by **parityboy** » Tue Mar 01, 2016 5:41 am

@thread

Just tested this on a Google Nexus 4 running 5.1.1 (LMY48T), works fine connected to Cantus, Onyx and Turing.

Post by **Guest** » Sun Feb 28, 2016 11:10 pm

I have no problems at all on Cyanogenmod (all versions up to the current nightlies)

Post by **Tealc** » Sun Feb 28, 2016 6:33 pm

NEWS UPDATE

Hi there everyone, it seams that Android 5.0.1+ has problems with setting up routes that are pushed by the OpenVPN app, currently no OpenVPN app works, no matter what conf file or version of it you use.

I've already contacted Arne Schwabe and I'm waiting for some news about this problem.

Actually if we google the words "Android 5.1.1 OpenVPN" everyone can see that this is a well spoken subject.

Stay tuned on this topic (use "Notify me when a reply is posted") for more info

EDIT 01/03/2016: It appears that the problem isn't reproduce by everyone, and it currently afects mostly people with non-rooted devices, in my wife non-rooted Sony Z3 it doesn't work, in mine rooted it does work.
Tealc

Post by **col888** » Sun Feb 28, 2016 7:45 am

hi Tealc
Thanks for replying. i don't use any antivirus at all. i remember on my old phone the android cryptofree worked but i haven't been able to get it work for ages anymore. i tried the cryptofree ovpn from your git and Tealc's ovpn and always same says connection success but not data coming in. just network monitor shows data going out. no panda installed .
here is copy of log. I tried remove all personal info. you might want to recheck if i did:
log from Arnes OpenVPn :

Code: Select all

2016-02-28 12:27:57 Building configuration…
2016-02-28 12:27:58 MANAGEMENT: CMD 'signal SIGINT'
2016-02-28 12:27:58 SIGTERM received, sending exit notification to peer
2016-02-28 12:27:58 MANAGEMENT: Client disconnected
2016-02-28 12:27:58 NOTE: --mute triggered...
2016-02-28 12:27:58 1 variation(s) on previous 1 message(s) suppressed by --mute
2016-02-28 12:27:58 TCP/UDP: Closing socket
2016-02-28 12:27:58 Sorry, deleting routes on Android is not possible. The VpnService API allows routes to be set on connect only.
2016-02-28 12:27:58 Sorry, deleting routes on Android is not possible. The VpnService API allows routes to be set on connect only.
2016-02-28 12:27:58 Closing TUN/TAP interface
2016-02-28 12:27:58 SIGTERM[soft,management-exit] received, process exiting
2016-02-28 12:27:58 MANAGEMENT: >STATE:1456633678,EXITING,management-exit,,,,,
2016-02-28 12:27:59 started Socket Thread
2016-02-28 12:27:59 Current Parameter Settings:
2016-02-28 12:27:59 NOTE: --mute triggered...
2016-02-28 12:27:59 182 variation(s) on previous 1 message(s) suppressed by --mute
2016-02-28 12:27:59 OpenVPN 2.4-icsopenvpn [git:icsopenvpn-c75f06c933a596fb] android-21-arm64-v8a [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH] [IPv6] built on Feb 10 2016
2016-02-28 12:27:59 library versions: OpenSSL 1.0.2f  28 Jan 2016, LZO 2.09
2016-02-28 12:27:59 MANAGEMENT: Connected to management server at /data/data/de.blinkt.openvpn/cache/mgmtsocket
2016-02-28 12:27:59 Network Status: CONNECTED LTE to MOBILE live.xxxxxmyproviderinforemovedxx.com
2016-02-28 12:27:59 MANAGEMENT: CMD 'hold release'
2016-02-28 12:27:59 NOTE: --mute triggered...
2016-02-28 12:27:59 4 variation(s) on previous 1 message(s) suppressed by --mute
2016-02-28 12:27:59 MANAGEMENT: >STATE:1456633679,RESOLVE,,,,,,
2016-02-28 12:27:59 MANAGEMENT: CMD 'proxy NONE'
2016-02-28 12:28:00 LZO compression initializing
2016-02-28 12:28:00 Control Channel MTU parms [ L:1606 D:1212 EF:38 EB:0 ET:0 EL:3 ]
2016-02-28 12:28:00 NOTE: --mute triggered...
2016-02-28 12:28:00 2 variation(s) on previous 1 message(s) suppressed by --mute
2016-02-28 12:28:00 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1606,tun-mtu 1500,proto UDPv4,comp-lzo,mtu-dynamic,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-client'
2016-02-28 12:28:00 NOTE: --mute triggered...
2016-02-28 12:28:00 1 variation(s) on previous 1 message(s) suppressed by --mute
2016-02-28 12:28:00 TCP/UDP: Preserving recently used remote address: [AF_INET]212.129.10.40:443
2016-02-28 12:28:00 Socket Buffers: R=[212992->212992] S=[212992->212992]
2016-02-28 12:28:00 MANAGEMENT: CMD 'needok 'PROTECTFD' ok'
2016-02-28 12:28:00 UDP link local: (not bound)
2016-02-28 12:28:00 UDP link remote: [AF_INET]212.129.10.40:443
2016-02-28 12:28:00 MANAGEMENT: >STATE:1456633680,WAIT,,,,,,
2016-02-28 12:28:01 NOTE: --mute triggered...
2016-02-28 12:28:01 1 variation(s) on previous 1 message(s) suppressed by --mute
2016-02-28 12:28:01 TLS: Initial packet from [AF_INET]212.129.10.40:443, sid=4d027da4 e7da5b21
2016-02-28 12:28:01 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2016-02-28 12:28:07 VERIFY OK: depth=1, C=CA, ST=QC, L=Montreal, O=Katana Holdings Limite /  cryptostorm_darknet, OU=Tech Ops, CN=cryptostorm_is, emailAddress=certadmin@cryptostorm.is
2016-02-28 12:28:07 NOTE: --mute triggered...
2016-02-28 12:28:11 2 variation(s) on previous 1 message(s) suppressed by --mute
2016-02-28 12:28:11 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1606', remote='link-mtu 1602'
2016-02-28 12:28:11 WARNING: 'mtu-dynamic' is present in local config but missing in remote config, local='mtu-dynamic'
2016-02-28 12:28:11 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
2016-02-28 12:28:11 NOTE: --mute triggered...
2016-02-28 12:28:11 4 variation(s) on previous 1 message(s) suppressed by --mute
2016-02-28 12:28:11 [server] Peer Connection Initiated with [AF_INET]212.129.10.40:443
2016-02-28 12:28:12 MANAGEMENT: >STATE:1456633692,GET_CONFIG,,,,,,
2016-02-28 12:28:12 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
2016-02-28 12:28:14 NOTE: --mute triggered...
2016-02-28 12:28:14 7 variation(s) on previous 1 message(s) suppressed by --mute
2016-02-28 12:28:14 ROUTE_GATEWAY 127.100.103.119/255.0.0.0 IFACE=lo HWADDR=00:00:00:00:00:00
2016-02-28 12:28:14 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
2016-02-28 12:28:14 MANAGEMENT: >STATE:1456633694,ASSIGN_IP,,10.55.0.8,,,,
2016-02-28 12:28:14 MANAGEMENT: CMD 'needok 'IFCONFIG' ok'
2016-02-28 12:28:14 NOTE: --mute triggered...
2016-02-28 12:28:14 1 variation(s) on previous 1 message(s) suppressed by --mute
2016-02-28 12:28:14 MANAGEMENT: >STATE:1456633694,ADD_ROUTES,,,,,,
2016-02-28 12:28:14 MANAGEMENT: CMD 'needok 'ROUTE' ok'
2016-02-28 12:28:14 NOTE: --mute triggered...
2016-02-28 12:28:14 Opening tun interface:
2016-02-28 12:28:14 Local IPv4: 10.55.0.8/16 IPv6: null MTU: 1500
2016-02-28 12:28:14 DNS Server: 195.154.61.33, Domain: null
2016-02-28 12:28:14 Routes: 0.0.0.0/0, 10.55.0.0/16 
2016-02-28 12:28:14 Routes excluded:  
2016-02-28 12:28:14 VpnService routes installed: 0.0.0.0/0 
2016-02-28 12:28:14 Disallowed VPN apps: 
2016-02-28 12:28:14 3 variation(s) on previous 1 message(s) suppressed by --mute
2016-02-28 12:28:14 Initialization Sequence Completed
2016-02-28 12:28:14 MANAGEMENT: >STATE:1456633694,CONNECTED,SUCCESS,10.55.0.8,212.129.10.40,443,,

!	Message from: parityboy
	Edited for clarity

Post by **wpaschukat** » Sat Feb 27, 2016 3:18 am

Hey,

same problem here, Lollipop, not rooted. And no, no Panda or any other bs installed.

Gracias.

Verbose log:

2016-02-26 23:11:42 official build 0.6.47 running on samsung SM-G920F (universal7420), Android 5.1.1 (LMY47X) API 22, ABI arm64-v8a, (samsung/zerofltexx/zeroflte:5.1.1/LMY47X/G920FXXU3COI9:user/release-keys)
2016-02-26 23:11:42 Building configuration…
2016-02-26 23:11:42 started Socket Thread
2016-02-26 23:11:42 Current Parameter Settings:
2016-02-26 23:11:42 NOTE: --mute triggered...
2016-02-26 23:11:42 182 variation(s) on previous 1 message(s) suppressed by --mute
2016-02-26 23:11:42 OpenVPN 2.4-icsopenvpn [git:icsopenvpn-c75f06c933a596fb] android-21-arm64-v8a [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH] [IPv6] built on Feb 10 2016
2016-02-26 23:11:42 library versions: OpenSSL 1.0.2f 28 Jan 2016, LZO 2.09
2016-02-26 23:11:42 MANAGEMENT: Connected to management server at /data/data/de.blinkt.openvpn/cache/mgmtsocket
2016-02-26 23:11:42 MANAGEMENT: CMD 'hold release'
2016-02-26 23:11:42 NOTE: --mute triggered...
2016-02-26 23:11:42 3 variation(s) on previous 1 message(s) suppressed by --mute
2016-02-26 23:11:42 LZO compression initializing
2016-02-26 23:11:42 Control Channel MTU parms [ L:1606 D:1212 EF:38 EB:0 ET:0 EL:3 ]
2016-02-26 23:11:42 NOTE: --mute triggered...
2016-02-26 23:11:42 2 variation(s) on previous 1 message(s) suppressed by --mute
2016-02-26 23:11:42 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1606,tun-mtu 1500,proto UDPv4,comp-lzo,mtu-dynamic,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-client'
2016-02-26 23:11:42 NOTE: --mute triggered...
2016-02-26 23:11:42 1 variation(s) on previous 1 message(s) suppressed by --mute
2016-02-26 23:11:42 TCP/UDP: Preserving recently used remote address: [AF_INET]130.180.201.117:443
2016-02-26 23:11:42 Socket Buffers: R=[229376->229376] S=[229376->229376]
2016-02-26 23:11:42 MANAGEMENT: CMD 'state on'
2016-02-26 23:11:42 NOTE: --mute triggered...
2016-02-26 23:11:42 1 variation(s) on previous 1 message(s) suppressed by --mute
2016-02-26 23:11:42 UDP link local: (not bound)
2016-02-26 23:11:42 UDP link remote: [AF_INET]130.180.201.117:443
2016-02-26 23:11:42 MANAGEMENT: >STATE:1456524702,WAIT,,,,,,
2016-02-26 23:11:42 Network Status: CONNECTED to WIFI "home.fast"
2016-02-26 23:11:42 NOTE: --mute triggered...
2016-02-26 23:11:42 1 variation(s) on previous 1 message(s) suppressed by --mute
2016-02-26 23:11:42 TLS: Initial packet from [AF_INET]130.180.201.117:443, sid=d71e1efb 78a7c407
2016-02-26 23:11:42 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2016-02-26 23:11:42 VERIFY OK: depth=1, C=CA, ST=QC, L=Montreal, O=Katana Holdings Limite / cryptostorm_darknet, OU=Tech Ops, CN=cryptostorm_is, emailAddress=certadmin@cryptostorm.is
2016-02-26 23:11:42 NOTE: --mute triggered...
2016-02-26 23:11:42 2 variation(s) on previous 1 message(s) suppressed by --mute
2016-02-26 23:11:42 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1606', remote='link-mtu 1602'
2016-02-26 23:11:42 WARNING: 'mtu-dynamic' is present in local config but missing in remote config, local='mtu-dynamic'
2016-02-26 23:11:42 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
2016-02-26 23:11:42 NOTE: --mute triggered...
2016-02-26 23:11:42 4 variation(s) on previous 1 message(s) suppressed by --mute
2016-02-26 23:11:42 [server] Peer Connection Initiated with [AF_INET]130.180.201.117:443
2016-02-26 23:11:44 MANAGEMENT: >STATE:1456524704,GET_CONFIG,,,,,,
2016-02-26 23:11:44 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
2016-02-26 23:11:44 NOTE: --mute triggered...
2016-02-26 23:11:44 7 variation(s) on previous 1 message(s) suppressed by --mute
2016-02-26 23:11:44 ROUTE_GATEWAY 127.100.103.119/255.0.0.0 IFACE=lo HWADDR=00:00:00:00:00:00
2016-02-26 23:11:44 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
2016-02-26 23:11:44 MANAGEMENT: >STATE:1456524704,ASSIGN_IP,,10.33.90.106,,,,
2016-02-26 23:11:44 MANAGEMENT: CMD 'needok 'IFCONFIG' ok'
2016-02-26 23:11:44 NOTE: --mute triggered...
2016-02-26 23:11:44 1 variation(s) on previous 1 message(s) suppressed by --mute
2016-02-26 23:11:44 MANAGEMENT: >STATE:1456524704,ADD_ROUTES,,,,,,
2016-02-26 23:11:44 MANAGEMENT: CMD 'needok 'ROUTE' ok'
2016-02-26 23:11:44 NOTE: --mute triggered...
2016-02-26 23:11:44 Opening tun interface:
2016-02-26 23:11:44 Ignoring multicast route: 224.0.0.0/3
2016-02-26 23:11:44 Local IPv4: 10.33.90.106/16 IPv6: null MTU: 1500
2016-02-26 23:11:44 DNS Server: 31.24.34.50, Domain: null
2016-02-26 23:11:44 Routes: 0.0.0.0/0, 10.33.0.0/16
2016-02-26 23:11:44 Routes excluded: 192.168.1.17/24
2016-02-26 23:11:44 VpnService routes installed: 0.0.0.0/1, 128.0.0.0/2, 192.0.0.0/9, 192.128.0.0/11, 192.160.0.0/13, 192.168.0.0/24, 192.168.2.0/23, 192.168.4.0/22, 192.168.8.0/21, 192.168.16.0/20, 192.168.32.0/19, 192.168.64.0/18, 192.168.128.0/17, 192.169.0.0/16, 192.170.0.0/15, 192.172.0.0/14, 192.176.0.0/12, 192.192.0.0/10, 193.0.0.0/8, 194.0.0.0/7, 196.0.0.0/6, 200.0.0.0/5, 208.0.0.0/4, 224.0.0.0/3
2016-02-26 23:11:44 Disallowed VPN apps:
2016-02-26 23:11:44 3 variation(s) on previous 1 message(s) suppressed by --mute
2016-02-26 23:11:44 Initialization Sequence Completed
2016-02-26 23:11:44 MANAGEMENT: >STATE:1456524704,CONNECTED,SUCCESS,10.33.90.106,130.180.201.117,443,,

Post by **Tealc** » Fri Feb 26, 2016 8:22 pm

Can you post here the complete log of the openvpn connection status?
Just print screen the "bitch", the link mtu has nothing to do with it :-)

Btw do you have any kind of those "Internet Protection Suite" like "Panda Antivirus PRO"?

Tealc

col883 wrote:[Help] I cannot seem to get Cryptofree Android working. Tried Tealc's cryptofree.but no internet.for me strange, It says connection "success" but I got no data coming "in" on network monitor. Data going out seems ok. So cant even browse. Arnes OpenVPn says "WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1606', remote='link-mtu 1602'"
I am on Lollipop 5.1, rooted. Any advice please? what am I doing wrong? I would like to get this free one able to working on my android before I next step buy token for non-free.

Post by **col883** » Fri Feb 26, 2016 4:45 pm

[Help] I cannot seem to get Cryptofree Android working. Tried Tealc's cryptofree.but no internet.for me strange, It says connection "success" but I got no data coming "in" on network monitor. Data going out seems ok. So cant even browse. Arnes OpenVPn says "WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1606', remote='link-mtu 1602'"
I am on Lollipop 5.1, rooted. Any advice please? what am I doing wrong? I would like to get this free one able to working on my android before I next step buy token for non-free.

Post by **Tealc** » Sat Dec 12, 2015 9:15 pm

jlg wrote:Tealc's owncloud at the top of this page is currently down/offline. He needs to physically get to the server to get it back up and is currently on vacation. This will be fixed within a week or so.

It's working just fine now! Thank you @jlg

Post by **jlg** » Fri Nov 27, 2015 1:57 pm

Tealc's owncloud at the top of this page is currently down/offline. He needs to physically get to the server to get it back up and is currently on vacation. This will be fixed within a week or so.

Post by **jlg** » Thu Nov 26, 2015 6:27 am

Here is a copy of germany_cantus.ovpn for Android I have stored on my Google Drive.

I hope it helps some others.

https://drive.google.com/file/d/0BwjaRP ... sp=sharing

Post by **Filius** » Thu Nov 26, 2015 1:40 am

Tealc, do you have a mirror for the config files? The server seems to be down.

Thanks for your work!

Post by **parityboy** » Wed Oct 21, 2015 9:48 pm

@phugiyama

Can you post logs of what the OpenVPN client(s) are doing?

Post by **phugiyama** » Tue Oct 20, 2015 8:03 am

Well, I've read this whole thread and tried various things, but can't get neither OpenVPN for Android or OpenVPN Connect to work on 4.4.2

I can connect but I can't receive data.

I'm about to pull the plug on this trial.

BTW, I'm trying from China.

Any ideas?

Post by **Tokumei Nanashi** » Mon Oct 19, 2015 8:23 am

Fermi wrote:Hi,

my bad.
Please try with fragment 1400 commented out.

Regards,

/Fermi

I can confirm that this works. Thanks!

Post by **Fermi** » Mon Oct 19, 2015 12:00 am

Hi,

my bad.
Please try with fragment 1400 commented out.

Regards,

/Fermi

Post by **Tokumei Nanashi** » Sun Oct 18, 2015 9:53 pm

Fermi wrote:Hi,

When having:
2015-09-27 05:41:01 FRAG_IN error flags=0xfa2a187b: FRAG_TEST not implemented

in the logfile, try commenting the following directive in the .ovpn file:
mssfix 1400

Regards,

/Fermi

I checked the .ovpn file for Singapore I got from Tealc's OwnCloud, and I can't find a "mssfix 1400" line to comment out.

This is what it looks like when I open it in a text editor:

# Enables connection to GUI
management /data/data/de.blinkt.openvpn/cache/mgmtsocket unix
management-client
management-query-passwords
management-hold
setenv IV_GUI_VER "de.blinkt.openvpn 0.6.17"
machine-readable-output
client
verb 4
connect-retry-max 5
connect-retry 5
resolv-retry 60
dev tun
remote 103.254.153.243 443 udp
auth-user-pass
auth-retry nointeract
<ca>
-----BEGIN CERTIFICATE-----
*cert gobbledygook here*
-----END CERTIFICATE-----
</ca>
comp-lzo
redirect-private unblock-local
route 0.0.0.0 0.0.0.0 vpn_gateway
nobind
cipher AES-256-CBC
auth SHA512
float
persist-tun
preresolve
management-query-proxy
key-method 2
down-pre
ns-cert-type server
explicit-exit-notify 3
fragment 1400
mute 1
tls-cipher TLS-DHE-RSA-WITH-AES-256-CBC-SHA
replay-window 128 30
resolv-retry 17
hand-window 37

I see a "fragment 1400", should that be commented out?

Post by **Fermi** » Sat Oct 17, 2015 4:37 pm

Hi,

When having:

2015-09-27 05:41:01 FRAG_IN error flags=0xfa2a187b: FRAG_TEST not implemented

in the logfile, try commenting the following directive in the .ovpn file:

mssfix 1400

Regards,

/Fermi

Post by **Tokumei Nanashi** » Sat Oct 17, 2015 3:59 pm

abadonna wrote:Well, I have problems with running it on my mobile phones... I have tried on Nexus4 (CM 11-stable) and OnePlus One (CM 12.1-Nightly). On both phones I have the same behaviour:
OpenVPN connects, authenticates, connection is established. And few seconds later:

2015-09-27 05:40:40 MANAGEMENT: >STATE:1443296440,CONNECTED,SUCCESS,10.33.24.120,103.254.153.243
2015-09-27 05:41:01 FRAG_IN error flags=0xfa2a187b: FRAG_TEST not implemented
2015-09-27 05:41:06 MANAGEMENT: CMD 'signal SIGINT'
2015-09-27 05:41:06 SIGTERM received, sending exit notification to peer
2015-09-27 05:41:07 MANAGEMENT: Client disconnected
2015-09-27 05:41:07 NOTE: --mute triggered...
2015-09-27 05:41:07 1 variation(s) on previous 1 message(s) suppressed by --mute
2015-09-27 05:41:07 TCP/UDP: Closing socket

I'm having a similar issue on an HTC J Butterfly running Android 4.1.1 It's vendor modified version I'm sure, not pure stock Android, but attempting to connect with OpenVPN as per this tutorial seems to connect successfully, then disconnects, then reconnects, then disconnects, etc etc.

Even when the device is in a connected state, it doesn't receive any data. It seems to send, but nothing comes back. I've tried with both Singapore and Cryptofree and both give the same result.

I don't know if this'd be the same problem with OpenVPN or something completely different, but not being able to Cryptostorm on my phone is, like, bumming me out dude

Post by **Phugiyama** » Sat Oct 17, 2015 5:21 am

Sorry for the noob request for help.

Having problems logging in with OpenVPN. I'm using OpenVPN Connect 1.1.16 (Core 3.0.3) on Android 4.4.2.

I get the error:

OpenVPN core error : option_error:
sorry, 'fragment' directive is not supported, nor is connecting to a server that uses 'fragment' directive

What does this mean?

How to resolve?

Thanks.

Post by **JTD121** » Mon Oct 12, 2015 11:37 pm

Curious; why don't we use the official OVPN app? I read through part of the thread, but saw no mention of it, other than to use the app from Arne Schwabe

Post by **Tealc** » Sat Oct 03, 2015 12:28 am

It apears this is a know bug with Android 5.0+ and more specifically with the One Plus:

https://github.com/schwabe/ics-openvpn/issues/393

I was told in DM with Arne that is going to address this issue in the next version of the program, he didn't have a ETA, but he told me that it was soon.

Post by **abadonna** » Fri Oct 02, 2015 2:11 pm

@parityboy, sorry for a delay (I've been off-line for last few days).
Not really... Both are CyanogenMod... Maybe you could suggest what else might I try?

Post by **parityboy** » Mon Sep 28, 2015 3:42 pm

@abadonna

Do you have a vanilla Android device you can use as a "control" during testing?

Post by **abadonna** » Sun Sep 27, 2015 3:00 am

Well, I have problems with running it on my mobile phones... I have tried on Nexus4 (CM 11-stable) and OnePlus One (CM 12.1-Nightly). On both phones I have the same behaviour:
OpenVPN connects, authenticates, connection is established. And few seconds later:

2015-09-27 05:40:40 MANAGEMENT: >STATE:1443296440,CONNECTED,SUCCESS,10.33.24.120,103.254.153.243
2015-09-27 05:41:01 FRAG_IN error flags=0xfa2a187b: FRAG_TEST not implemented
2015-09-27 05:41:06 MANAGEMENT: CMD 'signal SIGINT'
2015-09-27 05:41:06 SIGTERM received, sending exit notification to peer
2015-09-27 05:41:07 MANAGEMENT: Client disconnected
2015-09-27 05:41:07 NOTE: --mute triggered...
2015-09-27 05:41:07 1 variation(s) on previous 1 message(s) suppressed by --mute
2015-09-27 05:41:07 TCP/UDP: Closing socket

The full log is here: https://cryptobin.org/r1z5j6p4
Decrypt password: mylog

Help! SOS!

Post by **kittenrocketTEMP** » Tue Sep 01, 2015 11:49 am

anyone had any routing issues using android cyanogenmod? works great on my ph but my custom tablet dont worky

Post by **parityboy** » Thu Aug 06, 2015 11:16 pm

@FrostyLV

See my signature for the separate certificate files - "post-Heartbleed". Clients seem to have trouble loading the in-line certificate in the configuration file.

Post by **FrostyLV** » Wed Aug 05, 2015 8:13 am

I'm having trouble connecting, I get an error message asking me to download a certificate.

Post by **VirtuosicVagabond** » Mon Mar 16, 2015 10:44 am

So I couldn't really get either option to hold a decent connection. Don't think I successfully loaded a single thing while connected.
Oh well.

Post by **Tealc** » Wed Mar 11, 2015 11:09 pm

VirtuosicVagabond wrote:So what's the difference between the .ovpn file you posted and the .conf file posted in that other thread?

If you open with a text editor both of them you will see that there are a LOT a differences, the main configuration parameters in my ovpn file are the same has the recommended by Staff from the 1.4 version.

Actually the main differences are:

1) I don't use FQDN to try to connect to the server (be warned that this isn't recommended by Staff), the main purpose of putting only the naked IP is that many devices, and it doesn't matter what version of Android you're running, have some problems trying to figure out the FQDN and tend to leak the real IP address to 3rd party for the dns resolve of the FQDN.
It's been documented here in the forum that you can fix the dns resolve problem of sending the real ip address before connecting to CS with ipblock or AFwall+ or something like this, but has you can figure we would need a lot more work to do that, it's simple and easier to put the naked IP, just sayinging :-D

.
Just a small remark, if you use a naked IP, if that server is down or something there will be no dynamic balancing of your connection to another server and that could be a potential security risk?!

2) Since the beginning of my involvement in CS the "main ovpn file" used with RAW linux connections wasn't really accepted in a lot of the configuration parameters by the default ovpn android app, I know that since then the parameters have change and the normal 1.4 conf CS ovpn file can be imported to the ovpn android app without critical errors, but still with some.

You know, this comes down to your choice, my config files for android are here for everyone see and test, there are no hidden parameters (is that even possible?) and they are hassle free, they just work out-of-the-box (or owncloud :-D

)

Stay awesome,

Tealc

Post by **VirtuosicVagabond** » Tue Mar 10, 2015 9:54 pm

So what's the difference between the .ovpn file you posted and the .conf file posted in that other thread?

Post by **Tealc** » Tue Mar 10, 2015 7:57 pm

VirtuosicVagabond wrote:
Tealc wrote:
VirtuosicVagabond wrote:How about the Cryptofree.ovpn file?

"Your request is my command"

Check my Owncloud, it's there

*tips hat*

Any chance that you know the full Cryptofree token?
It doesn't let me copy it. It starts with "4a8....etc"

According to this viewtopic.php?f=58&t=6528 it doesn't matter what you put in.

When it asks for a user/password, type "snowden" "rocks!" (actually it doesn't matter what you type, but type something)

Post by **VirtuosicVagabond** » Tue Mar 10, 2015 3:40 pm

Tealc wrote:
VirtuosicVagabond wrote:How about the Cryptofree.ovpn file?

"Your request is my command"

Check my Owncloud, it's there

*tips hat*

Any chance that you know the full Cryptofree token?
It doesn't let me copy it. It starts with "4a8....etc"

Post by **Tealc** » Tue Mar 10, 2015 1:06 am

VirtuosicVagabond wrote:How about the Cryptofree.ovpn file?

"Your request is my command" :-D

Check my Owncloud, it's there :-)

Post by **VirtuosicVagabond** » Mon Mar 09, 2015 9:14 pm

How about the Cryptofree.ovpn file?

Post by **Tealc** » Mon Sep 22, 2014 2:53 am

Jarmer wrote:Recently I upgraded to a 4.4.4 ROM and am currently using the standard configs posted in the op. Things at first work great then I start getting the attached error messages over and over again. I'm using a token I purchased in April for one year so I know its not that, and it connects fine to begin with. Just after a while it starts disconnecting and erroring out with the auth failure messages. Any ideas here? I saw some comments above that 4.4.2+ have issues with openvpn, that still the case now?

What's your OpenVPN version? You should only use the 0.6.17 or up, anything older will give several bizarre errors.
All versions of Android now work fine, no problems even with 4.4.2 :-D

Which exit node are you using? This auth error get's reproduced in others exit nodes?

Post by **marzametal** » Sat Sep 20, 2014 10:30 am

OpenVPN works fine on 4.4.4, provided you are using the latest OpenVPN for Android build... The latest stable is .6.17, although I just noticed there is a beta (up to you). You can download it from here Full List of OpenVPN for Android releases

May I ask what ROM you are using? I am using SlimSaber 4.4.4

The errors also might have to do with the recent disruptions on the UNSAE exit node. I had to resort to Onyx and haven't looked back. Do you get the errors on other cluster choices?

Post by **Jarmer** » Fri Sep 19, 2014 11:02 pm

Recently I upgraded to a 4.4.4 ROM and am currently using the standard configs posted in the op. Things at first work great then I start getting the attached error messages over and over again. I'm using a token I purchased in April for one year so I know its not that, and it connects fine to begin with. Just after a while it starts disconnecting and erroring out with the auth failure messages. Any ideas here? I saw some comments above that 4.4.2+ have issues with openvpn, that still the case now?

Post by **Tealc** » Tue Aug 19, 2014 12:24 am

Main topic updated.

Outdated exit nodes removed, added other links for the OpenVPN for Android app for the ones that don't like the Play Store :-D

Post by **Tealc** » Sun Jul 27, 2014 3:30 am

Updated conf's with patch for correcting tls error

Post by **Tealc** » Sat Jul 12, 2014 12:09 am

marzametal wrote:...
... small request, can you add a little line at the beginning of the first post to indicate when it was last updated, instead of relying solely on the update dates inside it?

Do you mean this?

It's been here since day one :-D

Post by **marzametal** » Fri Jul 11, 2014 6:59 am

Tealc wrote:
marzametal wrote:Has anyone noticed a new entry in the OpenVPN for Android log?
When the VPN profile is clicked, and it begins to load... I see an entry called "Initializing Google Breakpad".
It seems to be a crash reporting system, copied/borrows/lent from Mozilla Firefox/Google Chrome's Crash Reporter. Just wondering if the latest stable OfA has it, or Arnie includes it just on beta's...

Which beta version are you running? Because, the OLD Android OVPN config's where for the 0.6.11 stable,this ones will only work with 0.6.17 stable or bigger

Yeah, I was on 0.6.15 when I saw the Google Breakpad stuff pop up... so jumped to 0.6.17, been about a week or so since the upgrade.
Ahhh, I see the step I missed. It wasn't enough to just upgrade to 0.6.17. I have to also upgrade the config file too... small request, can you add a little line at the beginning of the first post to indicate when it was last updated, instead of relying solely on the update dates inside it?

Post by **kelltech** » Fri Jul 11, 2014 2:14 am

Tealc wrote:So everything updated... this time there are all the "exit nodes" available, if you find some kind of error let me know.

Works perfectly, a million thanks!! :clap:

Post by **Tealc** » Thu Jul 10, 2014 11:56 pm

marzametal wrote:Has anyone noticed a new entry in the OpenVPN for Android log?
When the VPN profile is clicked, and it begins to load... I see an entry called "Initializing Google Breakpad".
It seems to be a crash reporting system, copied/borrows/lent from Mozilla Firefox/Google Chrome's Crash Reporter. Just wondering if the latest stable OfA has it, or Arnie includes it just on beta's...

Which beta version are you running? Because, the OLD Android OVPN config's where for the 0.6.11 stable,this ones will only work with 0.6.17 stable or bigger :-D

Post by **Tealc** » Thu Jul 10, 2014 11:52 pm

kelltech wrote:
Tealc wrote:Since this tutorial has the old cert's and the old OVPN settings from the very first conf's that got to see the light of day, it's more them possible that something got broken on the way, so.... I'm making new conf's for this OpenVPN Android app, specific for the most current cert's and conf's.

Thank you Tealc, very much appreciated. Will the new confs be in the same place when they're ready?

So everything updated... this time there are all the "exit nodes" available, if you find some kind of error let me know.

BTW to everyone that's going to check the config file BEFORE using, YES I've removed the hostname of the "exit node" and left only the IP, I actually don't know why, but I've got a bunch of errors with the hostname in place. If you do not want this, just change it back to the hostname

Post by **marzametal** » Thu Jul 10, 2014 5:32 am

Has anyone noticed a new entry in the OpenVPN for Android log?
When the VPN profile is clicked, and it begins to load... I see an entry called "Initializing Google Breakpad".
It seems to be a crash reporting system, copied/borrows/lent from Mozilla Firefox/Google Chrome's Crash Reporter. Just wondering if the latest stable OfA has it, or Arnie includes it just on beta's...

Post by **kelltech** » Tue Jul 08, 2014 10:30 pm

Tealc wrote:Since this tutorial has the old cert's and the old OVPN settings from the very first conf's that got to see the light of day, it's more them possible that something got broken on the way, so.... I'm making new conf's for this OpenVPN Android app, specific for the most current cert's and conf's.

Thank you Tealc, very much appreciated. Will the new confs be in the same place when they're ready?

Post by **Tealc** » Sun Jul 06, 2014 1:14 am

Since this tutorial has the old cert's and the old OVPN settings from the very first conf's that got to see the light of day, it's more them possible that something got broken on the way, so.... I'm making new conf's for this OpenVPN Android app, specific for the most current cert's and conf's.

And BTW, it works with non rooted phones, but I've found out that some "branded" android versions doesn't allow OpenVPN to make their magic, for example with my non-rooted HTC M8 (also in my M7 :-D

) I've got it working in a heart beat, with my wife's non rooted Samsung Galaxy S5 no such luck, at first the app crashed, them after several re-install I got to the import config file part and it crashed, but got to add the conf to the profiles page (??) but wen I try to connect it just doesn't work saying something about "... severe damage to your device" I've already sent a but report to the man in charge of producing this amazing app, let's see what he have to say :-D

Post by **vpnDarknet** » Sat Jul 05, 2014 8:17 am

kelltech wrote:So this is for rooted devices?

I've just updated OpenVPN via F-Droid, and it states:

OpenVPN without root
with the VPNService in Android 4.0+ it is possible to create a VPN that doesn't need root access

I haven't tested it as yet though

Post by **kelltech** » Sat Jun 28, 2014 3:26 am

So this is for rooted devices? How about non rooted? My new tablet isn't rooted yet. I used to be able to connect on this tablet but since buying a new token I can't connect any more. I started from the beginning and still get "Auth failed" every time. I even reinstalled the OpenVPN app. Any suggestions?

Post by **Guest** » Wed Jun 25, 2014 8:39 pm

marzametal wrote:In regards to Also activate VPN at "all applications". On its face, it's worth activating to force everything through the VPN. My thought on this is, rather block access than allow access? For example, in the firewall log, crap pops up left right and center. I'd rather see things being blocked than allowing it through the VPN for the sole reason it is a secure path. I'm not saying take this as gospel, but would like your opinion if possible.

Well... This heavily depends on how you handle security on your phone. I use AFWall+ as a simple leakblock that I set up and "forget". I very rarely open it up; mostly when a new version got released to check on new options.
I like to manage all my security at one place and this is the XPrivacy module. I can block internet access there as well and do this actively. My default settings are to block everything by default (even the red system permissions) and then allow individual permissions as they are actually needed for the app to work. (emphasis on "actually"! Not what it requests! :lol:

)
But that is just how I do things.

You could very well do a different approach in managing different things at different places. You could also use AFWall+ as a second line of defense for the very unpleasant case that XPrivacy for some reason fails to block internet access. So yes: Your approach is very reasonable. Just be careful with the system services. There may be cases where you want to block some of those but this should only be done by people who very well know what the individual system services do.

As to your gapps incident... There still are (and always will be) some resources with google in their name if you use an android based rom but gapps should not be there. The only explanation I have is that some app requested access to it not knowing that it doesn't reside on your phone.

But anyways: Always glad to see that people actually care and get rid of GAPPs and the Google Services Framework! You really rarely (or never) need those as you can grab your Apps anyways. With it all security efforts are pretty useless in my opinion.

Post by **Guest** » Wed Jun 25, 2014 8:17 pm

Guest wrote:{ Standard warnings apply with caution being required when installing apks from unknown sources - cryptostorm_support }

Sorry for my late reply. I was really busy and still am.

This shows how considerate our friends at CryptoStorm are! Good thinking but I can give an all-clear signal on this source: It's provided by the maker himself, Arne Schwabe.
I grabbed the link from his own google-code page so it should be more than fine.

Proof: https://code.google.com/p/ics-openvpn/
At the bottom under footnotes you find "If you cannot or do not want to use the Play Store you can download the apk files directly."

Glad I was able help some folks out with that even though the whole post was very rushed.

PS: I forgot another great XPosed Module --> Auto VPN Dialog Confirm. It helps you get rid of the annoying "do you trust this VPN?" dialog. With this you can create a 100% automatic VPN environment if you also tell Arne Schwabes OpenVPN that it should connect at startup and on network change.

Post a reply

Expand view Topic review: HOWTO: cryptostorm on Android non-root | cryptostorm.org/android

Login