TLS error on UDP but not TCP?

glc650

Hi,

I get the following TLS error when connecting to my OpenVPN server on UDP:

Mar 25 10:57:46 vpn openvpn[25591]: 10.0.0.42:42867 TLS: Initial packet from [AF_INET]10.0.0.42:42867, sid=6d4d1b7c ea1b435d
Mar 25 10:57:46 vpn openvpn[25591]: 10.0.0.42:42867 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1490467143) Sat Mar 25 11:39:03 2017 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Mar 25 10:57:46 vpn openvpn[25591]: 10.0.0.42:42867 TLS Error: incoming packet authentication failed from [AF_INET]10.0.0.42:42867
Mar 25 10:57:48 vpn openvpn[25591]: 10.0.0.42:42867 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #3 / time = (1490467143) Sat Mar 25 11:39:03 2017 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Mar 25 10:57:48 vpn openvpn[25591]: 10.0.0.42:42867 TLS Error: incoming packet authentication failed from [AF_INET]10.0.0.42:42867
Mar 25 10:57:50 vpn openvpn[25591]: 10.0.0.42:42867 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #49 / time = (1490467143) Sat Mar 25 11:39:03 2017 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Mar 25 10:57:50 vpn openvpn[25591]: 10.0.0.42:42867 TLS Error: incoming packet authentication failed from [AF_INET]10.0.0.42:42867

When connecting to the same server on TCP I do NOT get this error. Clients are an Android phone and iPad. Server and client configs are identical except for the TCP/UDP bits. Note: this is the server log. Clients logs don't report any errors. 10.0.0.42 is the Android client.

Thanks,

->g.

TinCanTech

glc650 wroteMar 25 10:57:46 vpn openvpn[25591]: 10.0.0.42:42867 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1490467143) Sat Mar 25 11:39:03 2017 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings

There are many things which can cause bad packet ID .. generally, it is just a side effect of UPD protocol and there is nothing to worry about.

If you log thousands of such errors in a short space of time then there is probably something worth worrying about .. but it could be almost any thing. :ugeek: