sometimes i get HMAC failures

Skaperen

i have an OpenVPN tunnel between 2 AWS EC2 instances in different regions ... for now symmetric, shared key, NAT (because both VPCs use the same subnet), UDP. mostly it works OK, other instances can communicate between regions over it. when i restart one end, sometimes it fails and i am seeing messages about HMAC failures (-v 6). when i restart both ends it always works OK. any suggestions of what i should look at? do i need to set up a ping test that restarts when there is a failure? or should OpenVPN handle one end restarting?

the shared key does not change.

actually, i have 21 tunnels between/among 7 regions.

Traffic

Intermittent HMAC failures .. sounds like there is some network corruption somewhere.

Skaperen

Traffic wroteIntermittent HMAC failures .. sounds like there is some network corruption somewhere.

1. other traffic (not via the tunnel) goes through OK.
2. when the HMAC failures happen, they keep on happening. every packet is affected. nothing gets through the tunnel.
3. when i reboot both sides, the HMAC failures almost always go away.
4. the HMAC failures only start when OpenVPN is restarted on just ONE side.
5. the problem has been seen on several region-to-region pairs.

#4 suggested to me that the key changed. but the key files (referenced by --secret) were identical. i cannot see if the secret was mangled inside the process to see which end might be the culprit of a key corruption, if that was happening.

this is happening inside AWS cloud instances. i am working on trying to download logs and dumps to evaluate.

Traffic

I have been using OpenVPN for some years now and I can say with reasonable confidence;
OpenVPN does not randomly mess your --tls-auth key file up.

ste123

Do you use persist-key in your configs?

Paste your server and client configs.
State what OpenVPN version you're using on each end.