Hello all:
Server: OpenVPN 2.4.3 amd64-portbld-freebsd11.0
Client: Windows OpenVPN 2.4.3
I get an error when I have tls-auth enabled, if I comment out this option in the server and client, the connection works.
I also tried to regenerate the ta.key file, I deleted the old key, went and generated a new one: openvpn --genkey --secret ta.key copied it in the server folder and also on the client device withe the same result:
Server log + error:
Thu Aug 24 13:29:32 2017 us=362795 OpenVPN 2.4.3 amd64-portbld-freebsd11.0 [SSL (OpenSSL)] [LZO] [LZ4] [MH/RECVDA] [AEAD] built on Aug 22 2017
Thu Aug 24 13:29:32 2017 us=362805 library versions: OpenSSL 1.0.2j-freebsd 26 Sep 2016, LZO 2.10
Thu Aug 24 13:29:32 2017 us=362931 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Thu Aug 24 13:29:32 2017 us=363320 Diffie-Hellman initialized with 2048 bit key
Thu Aug 24 13:29:32 2017 us=364024 Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Thu Aug 24 13:29:32 2017 us=364043 Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Thu Aug 24 13:29:32 2017 us=364056 TLS-Auth MTU parms [ L:1622 D:1172 EF:78 EB:0 ET:0 EL:3 ]
Thu Aug 24 13:29:32 2017 us=364159 ROUTE_GATEWAY 192.168.0.1/255.255.255.0 IFACE=epair2b HWADDR=5e:75:6a:06:ce:30
Thu Aug 24 13:29:32 2017 us=364220 TUN/TAP device /dev/tun0 opened
Thu Aug 24 13:29:32 2017 us=364232 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Thu Aug 24 13:29:32 2017 us=364249 /sbin/ifconfig tun0 172.16.8.1 172.16.8.2 mtu 1500 netmask 255.255.255.255 up
Thu Aug 24 13:29:32 2017 us=366383 /sbin/route add -net 172.16.8.0 172.16.8.2 255.255.255.0
add net 172.16.8.0: gateway 172.16.8.2
Thu Aug 24 13:29:32 2017 us=367698 Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ]
Thu Aug 24 13:29:32 2017 us=368246 Could not determine IPv4/IPv6 protocol. Using AF_INET6
Thu Aug 24 13:29:32 2017 us=368276 Socket Buffers: R=[42080->42080] S=[9216->9216]
Thu Aug 24 13:29:32 2017 us=368283 setsockopt(IPV6_V6ONLY=0)
Thu Aug 24 13:29:32 2017 us=368310 UDPv6 link local (bound): [AF_INET6][undef]:443
Thu Aug 24 13:29:32 2017 us=368318 UDPv6 link remote: [AF_UNSPEC]
Thu Aug 24 13:29:32 2017 us=368328 GID set to nobody
Thu Aug 24 13:29:32 2017 us=368341 UID set to nobody
Thu Aug 24 13:29:32 2017 us=368353 MULTI: multi_init called, r=256 v=256
Thu Aug 24 13:29:32 2017 us=368383 IFCONFIG POOL: base=172.16.8.4 size=62, ipv6=0
Thu Aug 24 13:29:32 2017 us=368424 ifconfig_pool_read(), in='danny.vpn,172.16.8.4', TODO: IPv6
Thu Aug 24 13:29:32 2017 us=368437 succeeded -> ifconfig_pool_set()
Thu Aug 24 13:29:32 2017 us=368448 IFCONFIG POOL LIST
Thu Aug 24 13:29:32 2017 us=368457 danny.vpn,172.16.8.4
Thu Aug 24 13:29:32 2017 us=368496 Initialization Sequence Completed
Thu Aug 24 13:31:49 2017 us=89983 TLS Error: cannot locate HMAC in incoming packet from [AF_INET6]::ffff:213.223.83.51:59398
Thu Aug 24 13:31:51 2017 us=537219 TLS Error: cannot locate HMAC in incoming packet from [AF_INET6]::ffff:213.223.83.51:59398
Thu Aug 24 13:31:56 2017 us=309858 TLS Error: cannot locate HMAC in incoming packet from [AF_INET6]::ffff:213.223.83.51:59398
Thu Aug 24 13:32:03 2017 us=625917 TLS Error: cannot locate HMAC in incoming packet from [AF_INET6]::ffff:213.223.83.51:59398
server config:
port 443
proto udp
dev tun
ca ca.crt
cert openvpn-server.crt #Server public key
key openvpn-server.key #Server private key
dh dh.pem #Diffie-Hellman parameters
server 172.16.8.0 255.255.255.0 #Purple network
ifconfig-pool-persist ipp.txt
push "route 192.168.0.0 255.255.255.0" #Yellow network
tls-auth ta.key 0
#crl-verify crl.pem
keepalive 10 120
cipher AES-256-CBC
auth SHA256
group nobody
user nobody
comp-lzo
persist-key
persist-tun
verb 4
client config:
client
dev tun
proto udp
remote myddns.com 443
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert danny.vpn.crt
key danny.vpn.key
remote-cert-tls server
cipher AES-256-CBC
tls-auth ta.key 1
#dhcp-option DNS 0.0.0.0
#redirect-gateway def1
comp-lzo
verb 4
