TLS errors

Lud3rik

Dear members,

I have some strange issue with the tls-auth option. So I'll try to give you some details :

1°) My OpenVPN Server is working fine without ta.key

Here is my configuration which is working correctly :

Server
mode server
proto udp
port 1194
dev tun

ca /etc/openvpn/ca.crt
cert /etc/openvpn/vpnsrv.crt
key ca /etc/openvpn/vpnsrv.key
cipher AES-256-CBC

server 172.56.21.0 255.255.255.0
ifconfig 172.56.21.1 255.255.255.0
push "dhcp-option DNS x.x.x.x"
push "redirect-gateway def1 bypass-dhcp"

keepalive 10 120
tls-server
comp-lzo
persist-tun
persist-tun
persist-key

status openvpn-status.log
log /var/log/openvpn.log

sndbuf 0
rcvbuf 0

verb 0

Client
client
proto udp
dev tun

ca ca.crt
cert johndoe.crt
key johndoe.key

cipher AES-256-CBC
remote mydomain.xx 1194

nobind
tls-client

comp-lzo

verb 7

So now I want to add the ta.key security to both sides : :mrgreen:

Server bis
mode server
proto udp
port 1194
dev tun

ca /etc/openvpn/ca.crt
cert /etc/openvpn/vpnsrv.crt
key ca /etc/openvpn/vpnsrv.key
cipher AES-256-CBC

server 172.56.21.0 255.255.255.0
ifconfig 172.16.21.1 255.255.255.0
push "dhcp-option DNS x.x.x.x"
push "redirect-gateway def1 bypass-dhcp"

keepalive 10 120
tls-server
tls-auth /etc/openvpn/ta.key 0

comp-lzo
persist-tun
persist-tun
persist-key

status openvpn-status.log
log /var/log/openvpn.log

sndbuf 0
rcvbuf 0

verb 0

Client bis
client
proto udp
dev tun

ca ca.crt
cert johndoe.crt
key johndoe.key

cipher AES-256-CBC
remote mydomain.xx 1194

nobind
tls-client
tls-auth ta.key 1
comp-lzo

verb 7

So now let's see what happens to the client logs :

Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Fri Apr 01 23:53:40 2016 us=227747 Local Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
Fri Apr 01 23:53:40 2016 us=227747 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
Fri Apr 01 23:53:40 2016 us=227747 Local Options hash (VER=V4): '9e7066d2'
Fri Apr 01 23:53:40 2016 us=227747 Expected Remote Options hash (VER=V4): '162b04de'
Fri Apr 01 23:53:40 2016 us=227747 UDPv4 link local: [undef]
Fri Apr 01 23:53:40 2016 us=227747 UDPv4 link remote: [AF_INET]MYIP
Fri Apr 01 23:53:40 2016 us=227747 MANAGEMENT: >STATE:1459547620,WAIT,,,
Fri Apr 01 23:53:40 2016 us=227747 UDPv4 WRITE [42] to [AF_INET]MYIP: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 pid=[ #1 ] [ ] pid=0 DATA len=0
Fri Apr 01 23:53:40 2016 us=227747 UDPv4 READ [0] from [undef]: DATA UNDEF len=-1
Fri Apr 01 23:53:40 2016 us=296625 UDPv4 READ [54] from [AF_INET]MYIP: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 pid=[ #1 ] [ 0 ] pid=0 DATA len=0
Fri Apr 01 23:53:40 2016 us=296625 MANAGEMENT: >STATE:1459547620,AUTH,,,
Fri Apr 01 23:53:40 2016 us=296625 TLS: Initial packet from [AF_INET]MYIP, sid=de722f63 d95e536b
Fri Apr 01 23:53:40 2016 us=296625 UDPv4 WRITE [50] to [AF_INET]MYIP: P_ACK_V1 kid=0 pid=[ #2 ] [ 0 ]
Fri Apr 01 23:53:40 2016 us=296625 UDPv4 WRITE [142] to [AF_INET]MYIP: P_CONTROL_V1 kid=0 pid=[ #3 ] [ ] pid=1 DATA len=100
Fri Apr 01 23:53:40 2016 us=296625 UDPv4 WRITE [142] to [AF_INET]MYIP: P_CONTROL_V1 kid=0 pid=[ #4 ] [ ] pid=2 DATA len=100
Fri Apr 01 23:53:40 2016 us=296625 UDPv4 WRITE [53] to [AF_INET]MYIP: P_CONTROL_V1 kid=0 pid=[ #5 ] [ ] pid=3 DATA len=11
Fri Apr 01 23:53:40 2016 us=296625 UDPv4 READ [54] from [AF_INET]MYIP: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 pid=[ #1 ] [ 0 ] pid=0 DATA len=0
Fri Apr 01 23:53:40 2016 us=296625 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1459547606) Fri Apr 01 23:53:26 2016 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Fri Apr 01 23:53:40 2016 us=296625 TLS Error: incoming packet authentication failed from [AF_INET]MYIP
Fri Apr 01 23:53:40 2016 us=396104 UDPv4 READ [50] from [AF_INET]MYIP: P_ACK_V1 kid=0 pid=[ #2 ] [ 1 ]
Fri Apr 01 23:53:40 2016 us=396104 UDPv4 READ [50] from [AF_INET]MYIP: P_ACK_V1 kid=0 pid=[ #2 ] [ 1 ]
Fri Apr 01 23:53:40 2016 us=396104 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #2 / time = (1459547606) Fri Apr 01 23:53:26 2016 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Fri Apr 01 23:53:40 2016 us=396104 TLS Error: incoming packet authentication failed from [AF_INET]MYIP
Fri Apr 01 23:53:40 2016 us=396104 UDPv4 READ [50] from [AF_INET]MYIP: P_ACK_V1 kid=0 pid=[ #3 ] [ 2 ]
Fri Apr 01 23:53:40 2016 us=396104 UDPv4 READ [50] from [AF_INET]MYIP: P_ACK_V1 kid=0 pid=[ #3 ] [ 2 ]
Fri Apr 01 23:53:40 2016 us=396104 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #3 / time = (1459547606) Fri Apr 01 23:53:26 2016 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Fri Apr 01 23:53:40 2016 us=396104 TLS Error: incoming packet authentication failed from [AF_INET]MYIP
Fri Apr 01 23:53:40 2016 us=443112 UDPv4 READ [154] from [AF_INET]MYIP: P_CONTROL_V1 kid=0 pid=[ #4 ] [ 3 ] pid=1 DATA len=100
Fri Apr 01 23:53:40 2016 us=443112 UDPv4 WRITE [50] to [AF_INET]MYIP: P_ACK_V1 kid=0 pid=[ #6 ] [ 1 ]
Fri Apr 01 23:53:40 2016 us=443112 UDPv4 READ [154] from [AF_INET]MYIP: P_CONTROL_V1 kid=0 pid=[ #4 ] [ 3 ] pid=1 DATA len=100
Fri Apr 01 23:53:40 2016 us=443112 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #4 / time = (1459547606) Fri Apr 01 23:53:26 2016 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Fri Apr 01 23:53:40 2016 us=443112 TLS Error: incoming packet authentication failed from [AF_INET]MYIP
Fri Apr 01 23:53:40 2016 us=443112 UDPv4 READ [142] from [AF_INET]MYIP: P_CONTROL_V1 kid=0 pid=[ #5 ] [ ] pid=2 DATA len=100
Fri Apr 01 23:53:40 2016 us=443112 UDPv4 WRITE [50] to [AF_INET]MYIP: P_ACK_V1 kid=0 pid=[ #7 ] [ 2 ]
.
.
.
.
.
.

:shock:

I precise that I only have the UDP 1194 opened in my box, which redirects all the traffic to my openvpn. Both files ta.key are exactly the same.

The consequencies of these errors with TLS are the following :

1°) Slow vpn connection (ping range is 1000-3000 ms)
2°) Packet loss
3°) Internet crashes

So here are my questions

1°)How must I configure OpenVPN with tls-auth option without any TLS errors?
2°)Will this configuration maintain the good quality of the connection?

Thank you for helping

Regards

Pippin

How about ping without VPN?
How about ping without tls?
How about time on both machines?

Maybe do a mtu-test?
https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage

Traffic

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

Pippin

Not sure if MTU would only effect --tls-auth ?

Not sure too, a "shot in the dark" suggestion 🙂

Lud3rik

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

Traffic

Lud3rik wroteYes of course, I have my VM on worsktation

Please provide details .. VirtualBox is known to cause Authenticate/Decrypt packet error: bad packet ID

Lud3rik

Traffic wrote
Lud3rik wroteYes of course, I have my VM on worsktation
Please provide details .. VirtualBox is known to cause Authenticate/Decrypt packet error: bad packet ID

I am using vmWare Workstation. But your suggestion solved the problem as tls-auth is not designed to work with UDP.
So now I need to choose :

OpenVPN running over UDP with no key security
OpenVPN running over TCP more secure, but with multiples DUP ACKs

Thank you for you help traffic

Traffic

If you are using Virtualbox you can sill use OpenVPN with these errors .. I do [edit: have done] ..
But I am not sure about other Virtualization.

Lud3rik wroteas tls-auth is not designed to work with UDP

--tls-auth is designed to be used with TCP and UDP !

Lud3rik

Traffic wroteIf you are using Virtualbox you can sill use OpenVPN with these errors .. I do [edit: have done] ..
But I am not sure about other Virtualization.

Lud3rik wroteas tls-auth is not designed to work with UDP
--tls-auth is designed to be used with TCP and UDP !

Ok but how do you explain that when I changed the listening port to TCP 1194, the ta.key passed whereas UDP 1194 made errors and troubles in the VPN?

Traffic

the Manual wrote--tls-auth file [direction]
Add an additional layer of HMAC authentication on top of the TLS control channel to protect against DoS attacks.

In a nutshell, --tls-auth enables a kind of "HMAC firewall" on OpenVPN's TCP/UDP port, where TLS control channel packets bearing an incorrect HMAC signature can be dropped immediately without response.

Uninstall your VM Software and try OpenVPN again .. :mrgreen:

Lud3rik

Traffic wrote
the Manual wrote--tls-auth file [direction]
Add an additional layer of HMAC authentication on top of the TLS control channel to protect against DoS attacks.

In a nutshell, --tls-auth enables a kind of "HMAC firewall" on OpenVPN's TCP/UDP port, where TLS control channel packets bearing an incorrect HMAC signature can be dropped immediately without response.

Uninstall your VM Software and try OpenVPN again .. :mrgreen:

LMAO man !

So I decided to boot from a liveCD and execute dd if=/dev/zero of=/dev/sda1 bs=1M on my hard drive which contains W10 🙂

This topic can be locked :mrgreen:

Traffic

Lud3rik wroteSo I decided to boot from a liveCD and execute dd if=/dev/zero of=/dev/sda1 bs=1M on my hard drive which contains W10

A little drastic for this thread don't you think ?

Lud3rik

Traffic wrote
Lud3rik wroteSo I decided to boot from a liveCD and execute dd if=/dev/zero of=/dev/sda1 bs=1M on my hard drive which contains W10
A little drastic for this thread don't you think ?

of course 🙂