mute-replay-warnings seems to be ignored on v2.2.1-8+deb7

ml35

root@vpn:~# grep -vE '^#|^;|^$' /etc/openvpn/server.conf
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh2048.pem
server 192.168.18.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.10.0 255.255.255.0"
client-config-dir ccd
push "dhcp-option DNS 192.168.10.1"
push "dhcp-option WINS 192.168.10.1"
keepalive 10 120
tls-auth ta.key 0 # This file is secret
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 1
mssfix
mute-replay-warnings

I keep getting this noise in logs (cause: android openvpn-connect client switching from cellular to wifi and back or hoping through various wifi networks):

Oct 26 22:50:32 relaysrv1 ovpn-server[2989]: 15.112.214.210:41113 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #2 / time = (1414356603) Sun Oct 26 22:50:03 2014 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings

So I tried using mute-replay-warnings option and restart the service but it seems to be ignored.
What I am missing?
This bothers me when logcheck runs. I know I can create an exception rule in logcheck for openvpn, but I'd prefer to silence it using the way the manual says.

innogen

ml35 wrote What I am missing?

If you prefer, please surf to https://lists.sourceforge.net/lists/listinfo/openvpn-users, subscribe to the mailing list and then re-post your question there.

You will get a response from the OpenVPN experts in no time.

P.S.:

1. What OS are you using?
2. Why are you not using the backported OpenVPN package?

ml35

innogen wrote
ml35 wrote What I am missing?
If you prefer, please surf to https://lists.sourceforge.net/lists/listinfo/openvpn-users, subscribe to the mailing list and then re-post your question there.

You will get a response from the OpenVPN experts in no time.

P.S.:

1. What OS are you using?
2. Why are you not using the backported OpenVPN package?

Thanks, I did not know about the mailing lists (all googling give results from this forum instead so I assumed I am in the right place 🙂 )
I wrongly also assumed OS can be guessed from the package name in the subject; is Debian stable release (codenamed "Wheezy"), x86 version.
I am on distribution-specific version because I use unattended-upgrades to update for security packages so I can enjoy a holiday if a severe vulnerability happens to be revealed right during those few holiday days 🙂

innogen

ml35 wrote I wrongly also assumed OS can be guessed from the package name in the subject; is Debian stable release (codenamed "Wheezy"), x86 version.
I am on distribution-specific version because I use unattended-upgrades to update for security packages so I can enjoy a holiday if a severe vulnerability happens to be revealed right during those few holiday days 🙂

I don't use Debian and am not at all familiar with its packages.

However I suggest you subscribe to the mailing list indicated in my previous post and re-post your question in plain text there.

ml35

innogen wrote However I suggest you subscribe to the mailing list indicated in my previous post and re-post your question in plain text there.

I tried that, but my mail keep getting rejected. First indeed I just copy/pasted, but then even a second plaintext gets rejected with message:

"You are not allowed to post to this mailing list, and your message has
been automatically rejected. If you think that your messages are
being rejected in error, contact the mailing list owner at
openvpn-users-owner@lists.sourceforge.net."

Sending mail to openvpn-users-owner@lists.sourceforge.net is rejected, too. The same when trying to notify info@openvpn.net about the error 🙁

innogen

ml35 wrote I tried that, but my mail keep getting rejected. First indeed I just copy/pasted, but then even a second plaintext gets rejected with message:

"You are not allowed to post to this mailing list, and your message has
been automatically rejected. If you think that your messages are
being rejected in error, contact the mailing list owner at
openvpn-users-owner@lists.sourceforge.net."

Sending mail to openvpn-users-owner@lists.sourceforge.net is rejected, too. The same when trying to notify info@openvpn.net about the error 🙁

Please post here, in plaintext, the full replies, including mail headers, that you have received from:

openvpn-users@lists.sourceforge.net
openvpn-users-owner@lists.sourceforge.net

Thanks for your co-operation.

ml35

hope it's not too late. email replaced to prevent spam harvesting.

Delivered-To: ml35@gmail.com
Received: by 10.194.237.230 with SMTP id vf6csp461599wjc;
Tue, 28 Oct 2014 08:42:41 -0700 (PDT)
X-Received: by 10.107.163.142 with SMTP id m136mr4660751ioe.32.1414510960665;
Tue, 28 Oct 2014 08:42:40 -0700 (PDT)
Return-Path: <openvpn-users-bounces@lists.sourceforge.net>
Received: from lists.sourceforge.net (lists.sourceforge.net. [216.34.181.88])
by mx.google.com with ESMTPS id s5si3034090icf.11.2014.10.28.08.42.40
for <ml35@gmail.com>
(version=TLSv1 cipher=RC4-SHA bits=128/128);
Tue, 28 Oct 2014 08:42:40 -0700 (PDT)
Received-SPF: pass (google.com: domain of openvpn-users-bounces@lists.sourceforge.net designates 216.34.181.88 as permitted sender) client-ip=216.34.181.88;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of openvpn-users-bounces@lists.sourceforge.net designates 216.34.181.88 as permitted sender) smtp.mail=openvpn-users-bounces@lists.sourceforge.net;
dkim=pass header.i=@lists.sourceforge.net
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta;
h=List-Id:Date:Message-ID:Content-Type:MIME-Version:To:From:Subject; bh=wHuAZATzHjP3E19Z6vWfZ4pqvyXOArp8AZcEyY2Wzcc=;
b=SVzE8TrQkue1lqJdKHLHdHN/SfuGPrk4+zrYyfZN2OG/Btl01ZhAX67iLLgEgXdnj6x/xobnS57fSl6Cf3tYDKpVOv3yOJmExo9QaNnSz2rFP1hWrMVMpli8ag8PmbbmsyJzm9u491J8cILBzL+HghXZEJJyabWWDMxDUyGMNIo=;
Received: from localhost ([127.0.0.1] helo=sfs-ml-1.v29.ch3.sourceforge.com)
by sfs-ml-1.v29.ch3.sourceforge.com with esmtp (Exim 4.76)
(envelope-from <openvpn-users-bounces@lists.sourceforge.net>)
id 1Xj8ut-0002ch-UA
for ml35@gmail.com; Tue, 28 Oct 2014 15:42:39 +0000
Subject: mute-replay-warnings seems to be ignored on v2.2.1-8+deb7
From: openvpn-users-owner@lists.sourceforge.net
To: ml35@gmail.com
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============4936583317419659056=="
Message-ID: <mailman.412526.1414510958.2171.openvpn-users@lists.sourceforge.net>
Date: Tue, 28 Oct 2014 15:42:38 +0000
Precedence: bulk
X-BeenThere: openvpn-users@lists.sourceforge.net
X-Mailman-Version: 2.1.9
List-Id: <openvpn-users.lists.sourceforge.net>
X-List-Administrivia: yes
Errors-To: openvpn-users-bounces@lists.sourceforge.net

--===============4936583317419659056==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit

You are not allowed to post to this mailing list, and your message has
been automatically rejected. If you think that your messages are
being rejected in error, contact the mailing list owner at
openvpn-users-owner@lists.sourceforge.net.

--===============4936583317419659056==
Content-Type: message/rfc822
MIME-Version: 1.0

Received: from sog-mx-3.v43.ch3.sourceforge.com ([172.29.43.193]
helo=mx.sourceforge.net)
by sfs-ml-1.v29.ch3.sourceforge.com with esmtp (Exim 4.76)
(envelope-from <ml35@gmail.com>) id 1Xj8uq-0002cQ-RS
for openvpn-users@lists.sourceforge.net; Tue, 28 Oct 2014 15:42:36 +0000
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
d=sourceforge.net; s=x;
h=Content-Type:To:From:Subject:Message-ID:Date:MIME-Version;
bh=NW6WpGMIifc6hO0aE9PFygXkbLSFLcgWYjE6roVCqTM=;
b=eStIDAP4hOgSYzrr9A77524tj6Oi0vFuBbBD11Y6dbIyFnCRS0KHxs1PMt30sYPU7gMHzqcjLgvDtfYMnJTIPNbng385S+L+ynabpgvlhp84jQsHCVOrs/PYsKavED71AHYV9E5XgGkPbit57oPClHXuF1ytdWvLILZhCLPWnQs=;
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x;
h=Content-Type:To:From:Subject:Message-ID:Date:MIME-Version;
bh=NW6WpGMIifc6hO0aE9PFygXkbLSFLcgWYjE6roVCqTM=;
b=MFe1/pof9tCJ+QPGH0hHYdTs63DgfSYi0SivWPiPGyHQ635beGB52nQpPHd417/Ljd1N+Z+tCZYUbQ3MkFvxC+e0+luUFOhAlyPSM+AODhe5gu0/N57so4EUERp7ku/5cFjVo51NTZVZD275J1Fijx85uSlQaqTTE1raXi0LOt8=;
Received-SPF: pass (sog-mx-3.v43.ch3.sourceforge.com: domain of gmail.com
designates 209.85.212.194 as permitted sender)
client-ip=209.85.212.194; envelope-from=ml35@gmail.com;
helo=mail-wi0-f194.google.com;
Received: from mail-wi0-f194.google.com ([209.85.212.194])
by sog-mx-3.v43.ch3.sourceforge.com with esmtps (TLSv1:RC4-SHA:128)
(Exim 4.76) id 1Xj8up-0001sf-HZ
for openvpn-users@lists.sourceforge.net; Tue, 28 Oct 2014 15:42:36 +0000
Received: by mail-wi0-f194.google.com with SMTP id ex7so503330wid.1
for <openvpn-users@lists.sourceforge.net>;
Tue, 28 Oct 2014 08:42:29 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;
h=mime-version:date:message-id:subject:from:to:content-type;
bh=NW6WpGMIifc6hO0aE9PFygXkbLSFLcgWYjE6roVCqTM=;
b=bAQLVH7Uldrc6ajaktL83WUN0MAjcazvl8wbsck5Dwbh14fxhPxwU1oUOzEkmDUqRm
9FYLyRry3owPL0dDGFs5VdKaSmQBFYsif6ftfsSWNuDQeRPLdGvy/F8TajOKs/wpP4D8
Ut3SV+/ze16jCpN4dCzFvV2RmOgZK8ZNpu6kiFIbbHjWNuJv/re+HlLqxNkEPOxDkDV4
jW5UuHVWbGh0jgnKYQdn1Qsb/jqVcyQ4gGxDXraAZbHXrw6/zGoCIk5LJXVv8dWJZWIj
NSejN0Z1IGI11H2Aj9hdZcuqwW5993hPtlLm2sEcUaKO7JzEcsLE8FvCaQPMUXMskjN+
jYhA==
MIME-Version: 1.0
X-Received: by 10.180.90.237 with SMTP id bz13mr29742466wib.50.1414510949255;
Tue, 28 Oct 2014 08:42:29 -0700 (PDT)
Received: by 10.194.237.230 with HTTP; Tue, 28 Oct 2014 08:42:29 -0700 (PDT)
Date: Tue, 28 Oct 2014 18:42:29 +0300
Message-ID: <CABjXrGFLV80NODN4XgW8_im45sAMTQqHAZ0e2pGtRCoPTssjzg@mail.gmail.com>
Subject: mute-replay-warnings seems to be ignored on v2.2.1-8+deb7
From: Mailing Lists <ml35@gmail.com>
To: openvpn-users@lists.sourceforge.net
Content-Type: multipart/alternative; boundary=f46d043c095ea94f2605067d7e03
X-Spam-Score: -0.3 (/)
X-Spam-Report: Spam Filtering performed by mx.sourceforge.net.
See http://spamassassin.org/tag/ for more details.
-1.5 SPF_CHECK_PASS SPF reports sender host as permitted sender for
sender-domain
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(ml35[at]gmail.com)
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit (ml35[at]gmail.com)
0.0 WEIRD_PORT URI: Uses non-standard port number for HTTP
0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4
address
1.0 HTML_MESSAGE BODY: HTML included in message
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
author's domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature,
not necessarily valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
X-Headers-End: 1Xj8up-0001sf-HZ

--f46d043c095ea94f2605067d7e03
Content-Type: text/plain; charset=UTF-8

I have posted this question to openvpn forums and someone suggested I
should try to this mailing list instead.

Here's the pasted message below. OS is debian wheezy x86.
I would appreciate cc-ing me as I'm not subscribed to the list.
Many thanks in advance!

*Code:*
root@vpn:~# grep -vE '^#|^;|^$' /etc/openvpn/server.conf
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh2048.pem
server 192.168.18.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.10.0 255.255.255.0"
client-config-dir ccd
push "dhcp-option DNS 192.168.10.1"
push "dhcp-option WINS 192.168.10.1"
keepalive 10 120
tls-auth ta.key 0 # This file is secret
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 1
mssfix
mute-replay-warnings

I keep getting this noise in logs (cause: android openvpn-connect client
switching from cellular to wifi and back or hoping through various wifi
networks):

*Code:*
Oct 26 22:50:32 relaysrv1 ovpn-server[2989]: 15.112.214.210:41113
Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #2 /
time = (1414356603) Sun Oct 26 22:50:03 2014 ] -- see the man page entry
for --no-replay and --replay-window for more info or silence this warning
with --mute-replay-warnings

So I tried using mute-replay-warnings option and restart the service but it
seems to be ignored.
What I am missing?
This bothers me when logcheck runs. I know I can create an exception rule
in logcheck for openvpn, but I'd prefer to silence it using the way the
manual says.
Setting "verb 0" effectively cancels all logging which is something I do
not want (I want to log when users connect and disconnect)

--f46d043c095ea94f2605067d7e03
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">I have posted this question to openvpn forums and someone =
suggested I should try to this mailing list instead.<div><br></div><div>Her=
e's the pasted message below. OS is debian wheezy x86.</div><div>I woul=
d appreciate cc-ing me as I'm not subscribed to the list.</div><div>Man=
y thanks in advance!<br><div><br></div><div><div class=3D"" style=3D"font-s=
ize:13px;margin:0px;padding:0px;color:rgb(0,0,0);font-family:'Lucida Gr=
ande','Trebuchet MS',Helvetica,Arial,sans-serif;line-height:18.=
2000007629395px;background-color:rgb(218,227,243)"><div class=3D"" style=3D=
"margin:10px 5px 0px;padding:2px 4px;border-width:1px 1px 0px;border-style:=
solid;border-color:rgb(169,184,194);font-family:'Lucida Grande',Ver=
dana,Helvetica,Arial,sans-serif;font-size:0.8em;background-color:rgb(217,23=
5,251)"><b style=3D"font-size:0.8em;line-height:18.2000007629395px;margin:0=
px;padding:0px">Code:</b><br></div><div class=3D"" style=3D"margin:0px 5px =
10px;padding:5px;direction:ltr;border-color:rgb(169,184,194);border-width:0=
px 1px 1px;border-style:solid;color:rgb(0,102,0);font-size:0.85em;font-fami=
ly:Monaco,'Courier New',monospace;background-color:rgb(250,250,250)=
">root@vpn:~# grep -vE '^#|^;|^$' /etc/openvpn/server.conf<br style=
=3D"margin:0px;padding:0px">port 1194<br style=3D"margin:0px;padding:0px">p=
roto udp<br style=3D"margin:0px;padding:0px">dev tun<br style=3D"margin:0px=
;padding:0px">ca ca.crt<br style=3D"margin:0px;padding:0px">cert server.crt=
<br style=3D"margin:0px;padding:0px">key server.key=C2=A0 # This file shoul=
d be kept secret<br style=3D"margin:0px;padding:0px">dh dh2048.pem<br style=
=3D"margin:0px;padding:0px">server 192.168.18.0 255.255.255.0<br style=3D"m=
argin:0px;padding:0px">ifconfig-pool-persist ipp.txt<br style=3D"margin:0px=
;padding:0px">push "route 192.168.10.0 255.255.255.0"<br style=3D=
"margin:0px;padding:0px">client-config-dir ccd<br style=3D"margin:0px;paddi=
ng:0px">push "dhcp-option DNS 192.168.10.1"<br style=3D"margin:0p=
x;padding:0px">push "dhcp-option WINS 192.168.10.1"<br style=3D"m=
argin:0px;padding:0px">keepalive 10 120<br style=3D"margin:0px;padding:0px"=
>tls-auth ta.key 0 # This file is secret<br style=3D"margin:0px;padding:0px=
">comp-lzo<br style=3D"margin:0px;padding:0px">user nobody<br style=3D"marg=
in:0px;padding:0px">group nogroup<br style=3D"margin:0px;padding:0px">persi=
st-key<br style=3D"margin:0px;padding:0px">persist-tun<br style=3D"margin:0=
px;padding:0px">status openvpn-status.log<br style=3D"margin:0px;padding:0p=
x">verb 1<br style=3D"margin:0px;padding:0px">mssfix<br style=3D"margin:0px=
;padding:0px">mute-replay-warnings<br style=3D"margin:0px;padding:0px"></di=
v></div><br style=3D"font-size:13px;margin:0px;padding:0px;color:rgb(0,0,0)=
;font-family:'Lucida Grande','Trebuchet MS',Helvetica,Arial=
,sans-serif;line-height:18.2000007629395px;background-color:rgb(218,227,243=
)"><span style=3D"font-size:13px;color:rgb(0,0,0);font-family:'Lucida G=
rande','Trebuchet MS',Helvetica,Arial,sans-serif;line-height:18=
.2000007629395px;background-color:rgb(218,227,243)">I keep getting this noi=
se in logs (cause: android openvpn-connect client switching from cellular t=
o wifi and back or hoping through various wifi networks):</span><br style=
=3D"font-size:13px;margin:0px;padding:0px;color:rgb(0,0,0);font-family:'=
;Lucida Grande','Trebuchet MS',Helvetica,Arial,sans-serif;line-=
height:18.2000007629395px;background-color:rgb(218,227,243)"><br style=3D"f=
ont-size:13px;margin:0px;padding:0px;color:rgb(0,0,0);font-family:'Luci=
da Grande','Trebuchet MS',Helvetica,Arial,sans-serif;line-heigh=
t:18.2000007629395px;background-color:rgb(218,227,243)"><div class=3D"" sty=
le=3D"font-size:13px;margin:0px;padding:0px;color:rgb(0,0,0);font-family:&#=
39;Lucida Grande','Trebuchet MS',Helvetica,Arial,sans-serif;lin=
e-height:18.2000007629395px;background-color:rgb(218,227,243)"><div class=
=3D"" style=3D"margin:10px 5px 0px;padding:2px 4px;border-width:1px 1px 0px=
;border-style:solid;border-color:rgb(169,184,194);font-family:'Lucida G=
rande',Verdana,Helvetica,Arial,sans-serif;font-size:0.8em;background-co=
lor:rgb(217,235,251)"><b style=3D"margin:0px;padding:0px">Code:</b></div><d=
iv class=3D"" style=3D"margin:0px 5px 10px;padding:5px;direction:ltr;border=
-color:rgb(169,184,194);border-width:0px 1px 1px;border-style:solid;color:r=
gb(0,102,0);font-size:0.85em;font-family:Monaco,'Courier New',monos=
pace;background-color:rgb(250,250,250)">Oct 26 22:50:32 relaysrv1 ovpn-serv=
er[2989]: <a href=3D"http://15.112.214.210:41113">15.112.214.210:41113</a> =
Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #2 / =
time =3D (1414356603) Sun Oct 26 22:50:03 2014 ] -- see the man page entry =
for --no-replay and --replay-window for more info or silence this warning w=
ith --mute-replay-warnings</div></div><br style=3D"font-size:13px;margin:0p=
x;padding:0px;color:rgb(0,0,0);font-family:'Lucida Grande','Tre=
buchet MS',Helvetica,Arial,sans-serif;line-height:18.2000007629395px;ba=
ckground-color:rgb(218,227,243)"><span style=3D"font-size:13px;color:rgb(0,=
0,0);font-family:'Lucida Grande','Trebuchet MS',Helvetica,A=
rial,sans-serif;line-height:18.2000007629395px;background-color:rgb(218,227=
,243)">So I tried using mute-replay-warnings option and restart the service=
but it seems to be ignored.</span><br style=3D"font-size:13px;margin:0px;p=
adding:0px;color:rgb(0,0,0);font-family:'Lucida Grande','Trebuc=
het MS',Helvetica,Arial,sans-serif;line-height:18.2000007629395px;backg=
round-color:rgb(218,227,243)"><span style=3D"font-size:13px;color:rgb(0,0,0=
);font-family:'Lucida Grande','Trebuchet MS',Helvetica,Aria=
l,sans-serif;line-height:18.2000007629395px;background-color:rgb(218,227,24=
3)">What I am missing?</span><br style=3D"font-size:13px;margin:0px;padding=
:0px;color:rgb(0,0,0);font-family:'Lucida Grande','Trebuchet MS=
',Helvetica,Arial,sans-serif;line-height:18.2000007629395px;background-=
color:rgb(218,227,243)"><span style=3D"font-size:13px;color:rgb(0,0,0);font=
-family:'Lucida Grande','Trebuchet MS',Helvetica,Arial,sans=
-serif;line-height:18.2000007629395px;background-color:rgb(218,227,243)">Th=
is bothers me when logcheck runs. I know I can create an exception rule in =
logcheck for openvpn, but I'd prefer to silence it using the way the ma=
nual says.</span><br></div></div><div>Setting "verb 0" effectivel=
y cancels all logging which is something I do not want (I want to log when =
users connect and disconnect)</div></div>

--f46d043c095ea94f2605067d7e03--

--===============4936583317419659056==--

Traffic

Did you actually subscribe to the mailing list as you are required to do before you can post to the list ?

ml35 wroteAuthenticate/Decrypt packet error: bad packet ID (may be a replay)

I get the same problem .. I believe it is because this is error is bad packet ID .. not a replay packet.

Also, see --no-replay and --replay-window in The Manual v23x

ml35

Traffic wroteDid you actually subscribe to the mailing list as you are required to do before you can post to the list ?

yes,

openvpn-users-request@lists.sourceforge.net
10/28/14
Reply
to me
Welcome to the Openvpn-users@lists.sourceforge.net mailing list! NOTE:
This list runs on autopilot, and does not have an active moderator.
If you have a problem with the list that requires human attention,
please send email to info@openvpn.net

Traffic wrote
ml35 wroteAuthenticate/Decrypt packet error: bad packet ID (may be a replay)
I get the same problem .. I believe it is because this is error is bad packet ID .. not a replay packet.

Also, see --no-replay and --replay-window in The Manual v23x

see above for what is causing the message: "(cause: android openvpn-connect client switching from cellular to wifi and back or hoping through various wifi networks)"