problem with HMAC, MTU

mferlitsch

Hi,

I have two OpenVPN servers based on OpenWrt and OpenVPN 2.1.4-3.
On my Windows 7 64-bit client I use OpenVPN 2.2.2 for connect to two servers.

When I use UDP with static keyfile or TLS I get very often this error on client - server doesn't log any errors.
Authenticate/Decrypt packet error: packet HMAC authentication failed

When I use TCP the connection will be interrupted when the same error occurs (always on client side).

I also tried to change the HMAC alg from SHA1 to MD5.
I also tried OpenvPN 2.1.4 on Windows 7 client.
I also tried to set MTU to 1400 - then I get less HMAC-errors but it's not a solution.

What could I try to solve this problem?

I think it seems to be the problem which is described in OpenVPN 2 Cookbook on page 195/196 (Linux Server and Windows Client).
But how can I fix it?

Regards, Markus

janjust

The packets which the client receives seem to be mangled.
This could very well be a network issue with the equipment between the client and the server - perhaps a cheapo switch or router close to your openvpn client is mangling traffic.

The only way to debug this further is to play with the MTU and fragment size (in UDP mode); what happens if you throw in something ridiculous like
fragment 800
?

HTH,

JJK

mferlitsch

Now I set mtu to 1500 and fragment to 800. Then I also get HMAC errors on client-side but less than with fragment 1300.

You are right on DMZ, where the client is located I use a very cheap switch. I will try connect it directly to the router without switch.

This would also explain why in TCP-mode the client reconnects every 30 seconds.

mferlitsch

So, I tried the same config on a Windows XP client connected to same switch. :-)
Actually none error! :-)
Also Windows 7 64bit is the trouble-maker! But how can I solve it? :-(

Here my latest config I tested on Windows 7 (errors) and Windows XP (no errors)
Under Windows 7 I tried OpenVPN 2.1.4 and 2.2.2.
Under Windows XP I tried OpenVPN 2.2.2.

remote IP PORT
remote-cert-tls server
proto udp
dev tun
ping-timer-rem
keepalive 10 60
tls-client
ca FILE
cert FILE
key FILE
tls-auth FILE 1
;comp-lzo
verb 3
mute 20
status LOGFILE.log
auth md5
;mtu-test
tun-mtu 1500
fragment 800
mssfix
tun-mtu-extra 32
persist-key
persist-tun
no-replay
mute-replay-warnings
cipher AES-256-CBC
ns-cert-type server
resolv-retry infinite
nobind
pull
route-method exe
route-delay 5 5

mferlitsch

What a shit :-)
Now I tried to install OpenVPN 2.3 alpha (openvpn-install-2.3_alpha3-I001-x86_64).

The config-file with TLS connects without problems - not one error in logfile.
The config-file with only static secret-file doesn't connect - it's a bug in alpha I think.

Options error: Parameter tls_exit can only be specified in TLS-mode, i.e. where --tls-server or --tls-client is also specified.
Use --help for more information.

Also OpenVPN 2.2.2 on Windows 7 64bit has problems!

mferlitsch

So, now I use TLS for all my connections and I use OpenVPN 2.3 alpha - no errors on Windows 64-bit! :-)

Hope, that the problem with static-keyfiles will be fixed in final 2.3!

mferlitsch

Addon: The problem with static-keyfiles comes from new GUI. This will be fixed soon. :-)