Ex2 ultra connecting to openvpn pivpn server problem

My Cloud OS 5 Personal & Network Attached Storage My Cloud EX Series
1

HI, I am trying to connect my ex2 ultra nas, running my cloud os 5 to an external vpn server. The vpn server is set up using pivpn, it is an openvpn tcp server running on a raspberry pi zero w. The server shoud be set up correctly, I can connect multiple clients and use ftp to my personal machine from an external machine within the vpn network.

I am trying to connect the nas (my cloud ex 2 ultra). I found online that the nas already has openvpn client installed. So I created a .ovpn file, copied it to the nas and used ‘openvpn nas.ovpn’.

It start connecting but then throws this error: note, my public ip had been covered by [EXTERNAL PUBLIC IP] (just for safety). I also tried connecting to free, public vpn’s, also no luck. Hopefully somebody can help me out, cause port forwarding isn’t allowed by the ISP from the nas network.

Tue Feb 2 03:38:17 2021 OpenVPN 2.4.7 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Feb 20 2019
Tue Feb 2 03:38:17 2021 library versions: OpenSSL 1.1.1d 10 Sep 2019, LZO 2.10
Tue Feb 2 03:38:26 2021 Outgoing Control Channel Authentication: Using 256 bit message hash ‘SHA256’ for HMAC authentication
Tue Feb 2 03:38:26 2021 Incoming Control Channel Authentication: Using 256 bit message hash ‘SHA256’ for HMAC authentication
Tue Feb 2 03:38:26 2021 TCP/UDP: Preserving recently used remote address: [AF_INET][EXTERNAL PUBLIC IP]:1111
Tue Feb 2 03:38:26 2021 Socket Buffers: R=[87380->87380] S=[16384->16384]
Tue Feb 2 03:38:26 2021 Attempting to establish TCP connection with [AF_INET][EXTERNAL PUBLIC IP]:1111 [nonblock]
Tue Feb 2 03:38:27 2021 TCP connection established with [AF_INET][EXTERNAL PUBLIC IP]:1111
Tue Feb 2 03:38:27 2021 TCP_CLIENT link local: (not bound)
Tue Feb 2 03:38:27 2021 TCP_CLIENT link remote: [AF_INET][EXTERNAL PUBLIC IP]:1111
Tue Feb 2 03:38:27 2021 TLS: Initial packet from [AF_INET][EXTERNAL PUBLIC IP]:1111, sid=08277483 a88acc65
Tue Feb 2 03:38:27 2021 VERIFY OK: depth=1, CN=ChangeMe
Tue Feb 2 03:38:27 2021 VERIFY KU OK
Tue Feb 2 03:38:27 2021 Validating certificate extended key usage
Tue Feb 2 03:38:27 2021 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Tue Feb 2 03:38:27 2021 VERIFY EKU OK
Tue Feb 2 03:38:27 2021 VERIFY X509NAME OK: CN=raspberrypizerow_ecfa10fd-9a67-49de-a833-5679e770577c
Tue Feb 2 03:38:27 2021 VERIFY OK: depth=0, CN=raspberrypizerow_ecfa10fd-9a67-49de-a833-5679e770577c
Tue Feb 2 03:38:27 2021 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
Tue Feb 2 03:38:27 2021 [raspberrypizerow_ecfa10fd-9a67-49de-a833-5679e770577c] Peer Connection Initiated with [AF_INET][EXTERNAL PUBLIC IP]:1111
Tue Feb 2 03:38:28 2021 SENT CONTROL [raspberrypizerow_ecfa10fd-9a67-49de-a833-5679e770577c]: ‘PUSH_REQUEST’ (status=1)
Tue Feb 2 03:38:28 2021 PUSH: Received control message: ‘PUSH_REPLY,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,block-outside-dns,redirect-gateway def1,route-gateway 10.8.0.1,topology subnet,ping 15,ping-restart 120,ifconfig 10.8.0.8 255.255.255.0,peer-id 0,cipher AES-256-GCM’
Tue Feb 2 03:38:28 2021 Options error: Unrecognized option or missing or extra parameter(s) in [PUSH-OPTIONS]:3: block-outside-dns (2.4.7)
Tue Feb 2 03:38:28 2021 OPTIONS IMPORT: timers and/or timeouts modified
Tue Feb 2 03:38:28 2021 OPTIONS IMPORT: --ifconfig/up options modified
Tue Feb 2 03:38:28 2021 OPTIONS IMPORT: route options modified
Tue Feb 2 03:38:28 2021 OPTIONS IMPORT: route-related options modified
Tue Feb 2 03:38:28 2021 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Feb 2 03:38:28 2021 OPTIONS IMPORT: peer-id set
Tue Feb 2 03:38:28 2021 OPTIONS IMPORT: adjusting link_mtu to 1626
Tue Feb 2 03:38:28 2021 OPTIONS IMPORT: data channel crypto options modified
Tue Feb 2 03:38:28 2021 Data Channel: using negotiated cipher ‘AES-256-GCM’
Tue Feb 2 03:38:28 2021 Outgoing Data Channel: Cipher ‘AES-256-GCM’ initialized with 256 bit key
Tue Feb 2 03:38:28 2021 Incoming Data Channel: Cipher ‘AES-256-GCM’ initialized with 256 bit key
Tue Feb 2 03:38:28 2021 ROUTE_GATEWAY 192.168.1.1/255.255.255.0 IFACE=egiga0 HWADDR=00:00:c0:2b:b8:98
Tue Feb 2 03:38:28 2021 TUN/TAP device tun0 opened
Tue Feb 2 03:38:28 2021 TUN/TAP TX queue length set to 100
Tue Feb 2 03:38:28 2021 /sbin/ip link set dev tun0 up mtu 1500
Tue Feb 2 03:38:28 2021 Linux ip link set failed: could not execute external program
Tue Feb 2 03:38:28 2021 Exiting due to fatal error

2

I have VPN’d into the system before.

If I am not mistaken; you might need to have the NAS unit on a “private” IP address (eg. 192.168.xx.xx or 10.xx.xx.xx or (I forget the third one)). (This might just be for dashboard access; not file access)

I am not aware of a openvpn client for the NAS? For my system, I use OpenVPN.
Server is my router.
Client is the machine from which I am dialing in.
Server assigns my client an IP address. This IP Address is usually in a different private subnet from the NAS and the rest of the nominal IP Pool for the server.

Hope this helps.

3

The nas router does not support OpenVPN server. From what I have read, the nas uses OpenVPN client to show the web interface. When ssh into the nas, OpenVPN is indeed installed. I have read some blog posts about it, so I guess it should work. Your answer was not exactly what I was looking for, but thanks anyway! All help is appreciated!

4

Hi, I’m getting the exact same error after migrating from OS3 to OS5 - have you had any luck?

5

Hi!
I had the same problem.
openvpn application looks for /sbin/ip; in the current MyCloudOS5 filesystem it is placed under
/usr/local/modules/usr/sbin/ip

Just create a symbolic link where openvpn is expected to find it:

root@Porcellino ~ #
root@Porcellino ~ # which ip
/usr/sbin/ip
root@Porcellino # cd /sbin    
root@Porcellino sbin # ls -la /usr/sbin/ip
lrwxrwxrwx    1 root     root            30 May 24 18:55 /usr/sbin/ip -> /usr/local/modules/usr/sbin/ip
root@Porcellino sbin #
root@Porcellino sbin # ln -sf /usr/local/modules/usr/sbin/ip ip

Afterwards the openvpn connection will successfully complete.

6

Hi, thanks everyone for the awesome replies!

I solved the problem by adding a raspberry pi to the same network as the nas. Set the pi as dmz-host, so I could connected externally (port forwarding is not allowed, but dmz host is for some reason). The pi runs the pivpn server and tunnels incoming Samba connections from inside the vpn-network to the nas. This way I am not relying on an external vpn server, this is better for performance, but same security.