18

I am having an issue with my openvpn server, running Debian Wheezy x64, and my client, running Ubuntu 14.10 x64. It seems no matter what configurations I try, I get this error, over and over, a couple times per minute at least:

Mon Mar  9 22:14:10 2015 Authenticate/Decrypt packet error: packet HMAC authentication failed
Mon Mar  9 22:14:10 2015 TLS Error: incoming packet authentication failed from [AF_INET] x.x.x.(clientip)

I am using this configuration on the server:

local x.x.x.x
port xxxx
proto udp
dev tun
ca /etc/openvpn/.certs/ca.crt
cert /etc/openvpn/.certs/[email protected]
key /etc/openvpn/.certs/[email protected]
dh /etc/openvpn/.certs/dh.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir clients
client-to-client
keepalive 7 80
tls-auth /etc/openvpn/.certs/ta.key 0
cipher AES-128-CBC
comp-lzo
max-clients 3
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log openvpn.log
verb 3
tun-mtu 1500
auth SHA256

And on the client, the configuration is managed by network-manager, but I have the key direction correct, the correct tls certificate, a matching mtu, the auth SHA256 directive, and it's set to verify the DN, etc... Is there something I am missing?

I tried different auth ciphers, regenerating the tls key (with --gen-key --secret ta.key), and the error persists. The VPN works okay, although my speeds are slightly lower than they ought to be. Any help would be appreciated.

Improve this question
1

2 Answers 2

Reset to default
17

Actually, the solution in my case was to add these directives to the server.conf:

mode server
tls-server

And than to the client config:

 tls-client

And if you use an embedded tls key via <tls-auth>, add

key-direction 1

If using network manager, make sure the 'expect tls authentication' is checked.

Improve this answer
3
  • 2
    I followed your post but nothing happened : (
    – t q
    Nov 5, 2017 at 11:15
  • 1
    Ran in to same issue today. This seems correct, make sure your key direction is set accordingly. Using the above config, if your client has key-direction 1 then set your server to have key-direction 0. This solved my issue
    – Kevin
    Nov 9, 2018 at 15:20
  • Another source of error might be specifying cipher explicitly and setting it to wrong value.
    – arrowd
    Jan 10, 2020 at 9:39
3

Adding auth and cipher lines matching the ones in the server.conf file, to the client's .conf file should be sufficient. Or if you are using Network Manager for the client, click on Cipher and HMAC Authentication, and add the settings in the cipher and auth lines from on the server.conf. It should work.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .