Skip to content
Register

openvpn still relevant? My client mandate nightmare

VPS Hosting by blogfranck 22 replies 3.2K views
blogfranck

Member OP

6 #1

My employer, a financial consultancy, mandates OpenVPN for all client-facing remote access. The clients are banks with compliance departments living in 2012. I have spent three weeks making OpenVPN coexist with my modern WireGuard mesh for internal tools.

The nightmare: OpenVPN needs the legacy cipher suites (BF-CBC, SHA1) for one client's ancient Windows 7 endpoints. The other client requires the specific tls-auth key from 2019. I maintain four separate server profiles now. It is not elegant. It is employment.

Has anyone found a compatibility layer? A wrapper? Or must I simply accept this as the cost of billing hours? Voilà.

ronwit

Member

Budget King

#2

Basically you can run openvpn in tls-cryptv2 mode for modern clients and legacy tls-auth for old ones same daemon actually, different ports (´・ω・｀)

Actually I did this for my old company basically:

  • Port 1194 udp = tls-cryptv2, aes-256-gcm, modern
  • Port 1195 udp = legacy, bf-cbc, sha1, windows 7 happy

But basically the real answer is tell your client to get better IT policy (´・ω・｀) no amount of backward compatibility is worth supporting EOL os

Actually sorry if my english is weird

instant noodles, instant deploys
PacketpunkUma

Member

1 #3

TELL THE CLIENT TO GET BETTER IT POLICY!!!

SERIOUSLY!!! RUNNING WINDOWS 7 IN 2026 IS A SELF-OWN!!! COMPLIANCE DEPARTMENTS LOVE PAPERWORK BUT HATE ACTUAL SECURITY!!! YOU ARE PATCHING A SINKING SHIP WITH CHEWING GUM!!!

ALTERNATIVE: OPENVPN-ACCESS-SERVER HAS A CLIENT COMPATIBILITY MODE THAT AUTO-NEGOTIATES DOWN!!! COSTS MONEY BUT SAVES SANITY!!!

sarahjey

Member

#4

Can't you just use a jump host?? Like the clients connect openvpn to a locked-down box, then that box connects wireguard to your real network??

I did something similar for my university project and it worked!! Double nat but who cares for a few clients??

Sorry if im missing something obvious!!

learning on $5 VPS and prayers
randyaround

Member

ZFS zealot

#5

WRONG. Jump host adds latency. WRONG. Compliance auditors HATE extra hops. WRONG.

Franck already has four profiles. Adding FIFTH layer is INSANE.

Better answer: EMPLOYMENT OVER PRINCIPLES. Bill the hours. Let client pay for their own technical debt.

Arguing with myself: BUT PRINCIPLES MATTER. No they DON'T. Rent is DUE!

olespete

Member

Trust No One

#6

Windows 7 in 2026 and banks still sign the cheques

airgapped, encrypted, faraday'd, still worried
PA

Member

#7

Which OpenVPN version handles both tls-cryptv2 and legacy?

ronwit

Member

Budget King

#8
Paul76 said:
Which OpenVPN version handles both tls-cryptv2 and legacy?

2.6.x handles both but you need to compile with --enable-legacy-cipher or grab the community edition from openvpn.net repos. The stock debian/ubuntu package disables BF-CBC now.

Actually my config used server 2.5.8 because the company was too cheap to pay for access server licenses. Worked fine.

instant noodles, instant deploys
blogfranck

Member OP

#9
ronwit said:
2.6.x handles both but you need to compile with --enable-legacy-cipher

Merci. I am on 2.6.12 from Debian backports but BF-CBC is runtime-disabled. Recompiling is... not impossible but then I am maintaining a custom package for one client. The Access Server route is starting to look economical at 15 USD per user per year when I bill my time at 120 EUR hourly.

sarahjey said:
Can't you just use a jump host??

The compliance auditors already flagged my "four profiles" as "architectural complexity." A fifth hop would give them a stroke. Appreciate the thought though.

randyaround

Member

ZFS zealot

#10
blogfranck said:
The Access Server route is starting to look economical at 15 USD per user per year

WRONG. 15 USD per user TIMES how many users? WRONG to call that economical. WRONG to let client externalize their Windows 7 debt onto YOUR infrastructure bill.

Bill them 300 EUR hourly for "legacy compatibility engineering." Make the pain VISIBLE.

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft