I'm getting the "Authenticate/Decrypt packet error: packet HMAC authentication failed" error. I've double checked my keys are the same, and tried removing TLS from both server and client (which gave a different error), but I'm still receiving the following error on the server.
*
Server *
Operating System:
$ uname -a
Linux 4.4.0-93-generic #116-Ubuntu SMP Fri Aug 11 21:17:51 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
Network setup:
eth0 Link encap:Ethernet HWaddr 00:16:3e:02:bb:3a
inet addr:server.IP.address Bcast:server.IP.address Mask:255.255.255.128
inet6 addr: server.IP.address/48 Scope:Global
inet6 addr: server.IP.address/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:60141 errors:0 dropped:0 overruns:0 frame:0
TX packets:664 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:7754179 (7.7 MB) TX bytes:133514 (133.5 KB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.8.0.1 P-t-P:10.8.0.2 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
port 2017
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 10 120
tls-auth ta.key 0
key-direction 0
cipher AES-128-CBC
auth SHA256
comp-lzo
max-clients 5
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 4
mode server
tls-server
Server log (at --verb 4 and client IP address removed)
Thu Aug 31 00:28:41 2017 us=967330 Current Parameter Settings:
Thu Aug 31 00:28:41 2017 us=967396 config = '/etc/openvpn/server.conf'
Thu Aug 31 00:28:41 2017 us=967704 mode = 1
Thu Aug 31 00:28:41 2017 us=967724 persist_config = DISABLED
Thu Aug 31 00:28:41 2017 us=967732 persist_mode = 1
Thu Aug 31 00:28:41 2017 us=967740 show_ciphers = DISABLED
Thu Aug 31 00:28:41 2017 us=967747 show_digests = DISABLED
Thu Aug 31 00:28:41 2017 us=967754 show_engines = DISABLED
Thu Aug 31 00:28:41 2017 us=967761 genkey = DISABLED
Thu Aug 31 00:28:41 2017 us=967768 key_pass_file = '[UNDEF]'
Thu Aug 31 00:28:41 2017 us=967779 show_tls_ciphers = DISABLED
Thu Aug 31 00:28:41 2017 us=967802 Connection profiles [default]:
Thu Aug 31 00:28:41 2017 us=967817 proto = udp
Thu Aug 31 00:28:41 2017 us=967829 local = '[UNDEF]'
Thu Aug 31 00:28:41 2017 us=967836 local_port = 2017
Thu Aug 31 00:28:41 2017 us=967843 remote = '[UNDEF]'
Thu Aug 31 00:28:41 2017 us=967850 remote_port = 2017
Thu Aug 31 00:28:41 2017 us=967857 remote_float = DISABLED
Thu Aug 31 00:28:41 2017 us=967864 bind_defined = DISABLED
Thu Aug 31 00:28:41 2017 us=967871 bind_local = ENABLED
Thu Aug 31 00:28:41 2017 us=967878 connect_retry_seconds = 5
Thu Aug 31 00:28:41 2017 us=967885 connect_timeout = 10
Thu Aug 31 00:28:41 2017 us=967892 connect_retry_max = 0
Thu Aug 31 00:28:41 2017 us=967900 socks_proxy_server = '[UNDEF]'
Thu Aug 31 00:28:41 2017 us=967907 socks_proxy_port = 0
Thu Aug 31 00:28:41 2017 us=967914 socks_proxy_retry = DISABLED
Thu Aug 31 00:28:41 2017 us=967921 tun_mtu = 1500
Thu Aug 31 00:28:41 2017 us=967928 tun_mtu_defined = ENABLED
Thu Aug 31 00:28:41 2017 us=967935 link_mtu = 1500
Thu Aug 31 00:28:41 2017 us=967942 link_mtu_defined = DISABLED
Thu Aug 31 00:28:41 2017 us=967948 tun_mtu_extra = 0
Thu Aug 31 00:28:41 2017 us=967955 tun_mtu_extra_defined = DISABLED
Thu Aug 31 00:28:41 2017 us=967963 mtu_discover_type = -1
Thu Aug 31 00:28:41 2017 us=967970 fragment = 0
Thu Aug 31 00:28:41 2017 us=967977 mssfix = 1450
Thu Aug 31 00:28:41 2017 us=967984 explicit_exit_notification = 0
Thu Aug 31 00:28:41 2017 us=967990 Connection profiles END
Thu Aug 31 00:28:41 2017 us=967998 remote_random = DISABLED
Thu Aug 31 00:28:41 2017 us=968005 ipchange = '[UNDEF]'
Thu Aug 31 00:28:41 2017 us=968012 dev = 'tun'
Thu Aug 31 00:28:41 2017 us=968018 dev_type = '[UNDEF]'
Thu Aug 31 00:28:41 2017 us=968025 dev_node = '[UNDEF]'
Thu Aug 31 00:28:41 2017 us=968032 lladdr = '[UNDEF]'
Thu Aug 31 00:28:41 2017 us=968045 topology = 1
Thu Aug 31 00:28:41 2017 us=968052 tun_ipv6 = DISABLED
Thu Aug 31 00:28:41 2017 us=968059 ifconfig_local = '10.8.0.1'
Thu Aug 31 00:28:41 2017 us=968066 ifconfig_remote_netmask = '10.8.0.2'
Thu Aug 31 00:28:41 2017 us=968073 ifconfig_noexec = DISABLED
Thu Aug 31 00:28:41 2017 us=968079 ifconfig_nowarn = DISABLED
Thu Aug 31 00:28:41 2017 us=968086 ifconfig_ipv6_local = '[UNDEF]'
Thu Aug 31 00:28:41 2017 us=968093 ifconfig_ipv6_netbits = 0
Thu Aug 31 00:28:41 2017 us=968100 ifconfig_ipv6_remote = '[UNDEF]'
Thu Aug 31 00:28:41 2017 us=968107 shaper = 0
Thu Aug 31 00:28:41 2017 us=968114 mtu_test = 0
Thu Aug 31 00:28:41 2017 us=968121 mlock = DISABLED
Thu Aug 31 00:28:41 2017 us=968128 keepalive_ping = 10
Thu Aug 31 00:28:41 2017 us=968135 keepalive_timeout = 120
Thu Aug 31 00:28:41 2017 us=968142 inactivity_timeout = 0
Thu Aug 31 00:28:41 2017 us=968150 ping_send_timeout = 10
Thu Aug 31 00:28:41 2017 us=968156 ping_rec_timeout = 240
Thu Aug 31 00:28:41 2017 us=968163 ping_rec_timeout_action = 2
Thu Aug 31 00:28:41 2017 us=968170 ping_timer_remote = DISABLED
Thu Aug 31 00:28:41 2017 us=968177 remap_sigusr1 = 0
Thu Aug 31 00:28:41 2017 us=968184 persist_tun = ENABLED
Thu Aug 31 00:28:41 2017 us=968191 persist_local_ip = DISABLED
Thu Aug 31 00:28:41 2017 us=968198 persist_remote_ip = DISABLED
Thu Aug 31 00:28:41 2017 us=968868 persist_key = ENABLED
Thu Aug 31 00:28:41 2017 us=968880 passtos = DISABLED
Thu Aug 31 00:28:41 2017 us=968887 resolve_retry_seconds = 1000000000
Thu Aug 31 00:28:41 2017 us=968901 username = 'nobody'
Thu Aug 31 00:28:41 2017 us=968909 groupname = 'nogroup'
Thu Aug 31 00:28:41 2017 us=968916 chroot_dir = '[UNDEF]'
Thu Aug 31 00:28:41 2017 us=968926 cd_dir = '/etc/openvpn'
Thu Aug 31 00:28:41 2017 us=968933 writepid = '/run/openvpn/server.pid'
Thu Aug 31 00:28:41 2017 us=968940 up_script = '[UNDEF]'
Thu Aug 31 00:28:41 2017 us=968947 down_script = '[UNDEF]'
Thu Aug 31 00:28:41 2017 us=968954 down_pre = DISABLED
Thu Aug 31 00:28:41 2017 us=968961 up_restart = DISABLED
Thu Aug 31 00:28:41 2017 us=968968 up_delay = DISABLED
Thu Aug 31 00:28:41 2017 us=968975 daemon = ENABLED
Thu Aug 31 00:28:41 2017 us=968982 inetd = 0
Thu Aug 31 00:28:41 2017 us=968989 log = ENABLED
Thu Aug 31 00:28:41 2017 us=968997 suppress_timestamps = DISABLED
Thu Aug 31 00:28:41 2017 us=969004 nice = 0
Thu Aug 31 00:28:41 2017 us=969011 verbosity = 4
Thu Aug 31 00:28:41 2017 us=969018 mute = 0
Thu Aug 31 00:28:41 2017 us=969025 gremlin = 0
Thu Aug 31 00:28:41 2017 us=969032 status_file = 'openvpn-status.log'
Thu Aug 31 00:28:41 2017 us=969039 status_file_version = 1
Thu Aug 31 00:28:41 2017 us=969046 status_file_update_freq = 10
Thu Aug 31 00:28:41 2017 us=969053 occ = ENABLED
Thu Aug 31 00:28:41 2017 us=969060 rcvbuf = 0
Thu Aug 31 00:28:41 2017 us=969067 sndbuf = 0
Thu Aug 31 00:28:41 2017 us=969074 mark = 0
Thu Aug 31 00:28:41 2017 us=969081 sockflags = 0
Thu Aug 31 00:28:41 2017 us=969088 fast_io = DISABLED
Thu Aug 31 00:28:41 2017 us=969095 lzo = 7
Thu Aug 31 00:28:41 2017 us=969102 route_script = '[UNDEF]'
Thu Aug 31 00:28:41 2017 us=969113 route_default_gateway = '[UNDEF]'
Thu Aug 31 00:28:41 2017 us=969120 route_default_metric = 0
Thu Aug 31 00:28:41 2017 us=969128 route_noexec = DISABLED
Thu Aug 31 00:28:41 2017 us=969135 route_delay = 0
Thu Aug 31 00:28:41 2017 us=969142 route_delay_window = 30
Thu Aug 31 00:28:41 2017 us=969150 route_delay_defined = DISABLED
Thu Aug 31 00:28:41 2017 us=969509 route_nopull = DISABLED
Thu Aug 31 00:28:41 2017 us=969531 route_gateway_via_dhcp = DISABLED
Thu Aug 31 00:28:41 2017 us=969541 max_routes = 100
Thu Aug 31 00:28:41 2017 us=969548 allow_pull_fqdn = DISABLED
Thu Aug 31 00:28:41 2017 us=969565 route 10.8.0.0/255.255.255.0/nil/nil
Thu Aug 31 00:28:41 2017 us=969574 management_addr = '[UNDEF]'
Thu Aug 31 00:28:41 2017 us=969581 management_port = 0
Thu Aug 31 00:28:41 2017 us=969588 management_user_pass = '[UNDEF]'
Thu Aug 31 00:28:41 2017 us=969596 management_log_history_cache = 250
Thu Aug 31 00:28:41 2017 us=969627 management_echo_buffer_size = 100
Thu Aug 31 00:28:41 2017 us=969639 management_write_peer_info_file = '[UNDEF]'
Thu Aug 31 00:28:41 2017 us=969647 management_client_user = '[UNDEF]'
Thu Aug 31 00:28:41 2017 us=969654 management_client_group = '[UNDEF]'
Thu Aug 31 00:28:41 2017 us=969662 management_flags = 0
Thu Aug 31 00:28:41 2017 us=969669 shared_secret_file = '[UNDEF]'
Thu Aug 31 00:28:41 2017 us=969676 key_direction = 1
Thu Aug 31 00:28:41 2017 us=969684 ciphername_defined = ENABLED
Thu Aug 31 00:28:41 2017 us=969691 ciphername = 'AES-128-CBC'
Thu Aug 31 00:28:41 2017 us=969698 authname_defined = ENABLED
Thu Aug 31 00:28:41 2017 us=969705 authname = 'SHA256'
Thu Aug 31 00:28:41 2017 us=969712 prng_hash = 'SHA1'
Thu Aug 31 00:28:41 2017 us=969720 prng_nonce_secret_len = 16
Thu Aug 31 00:28:41 2017 us=969727 keysize = 0
Thu Aug 31 00:28:41 2017 us=969734 engine = DISABLED
Thu Aug 31 00:28:41 2017 us=969742 replay = ENABLED
Thu Aug 31 00:28:41 2017 us=969749 mute_replay_warnings = DISABLED
Thu Aug 31 00:28:41 2017 us=969756 replay_window = 64
Thu Aug 31 00:28:41 2017 us=969763 replay_time = 15
Thu Aug 31 00:28:41 2017 us=969770 packet_id_file = '[UNDEF]'
Thu Aug 31 00:28:41 2017 us=969777 use_iv = ENABLED
Thu Aug 31 00:28:41 2017 us=969785 test_crypto = DISABLED
Thu Aug 31 00:28:41 2017 us=969792 tls_server = ENABLED
Thu Aug 31 00:28:41 2017 us=969799 tls_client = DISABLED
Thu Aug 31 00:28:41 2017 us=970126 key_method = 2
Thu Aug 31 00:28:41 2017 us=970141 ca_file = 'ca.crt'
Thu Aug 31 00:28:41 2017 us=970149 ca_path = '[UNDEF]'
Thu Aug 31 00:28:41 2017 us=970156 dh_file = 'dh2048.pem'
Thu Aug 31 00:28:41 2017 us=970164 cert_file = 'server.crt'
Thu Aug 31 00:28:41 2017 us=970171 extra_certs_file = '[UNDEF]'
Thu Aug 31 00:28:41 2017 us=970178 priv_key_file = 'server.key'
Thu Aug 31 00:28:41 2017 us=970186 pkcs12_file = '[UNDEF]'
Thu Aug 31 00:28:41 2017 us=970193 cipher_list = '[UNDEF]'
Thu Aug 31 00:28:41 2017 us=970200 tls_verify = '[UNDEF]'
Thu Aug 31 00:28:41 2017 us=970207 tls_export_cert = '[UNDEF]'
Thu Aug 31 00:28:41 2017 us=971127 verify_x509_type = 0
Thu Aug 31 00:28:41 2017 us=971145 verify_x509_name = '[UNDEF]'
Thu Aug 31 00:28:41 2017 us=971153 crl_file = '[UNDEF]'
Thu Aug 31 00:28:41 2017 us=971161 ns_cert_type = 0
Thu Aug 31 00:28:41 2017 us=971168 remote_cert_ku[i] = 0
Thu Aug 31 00:28:41 2017 us=971176 remote_cert_ku[i] = 0
Thu Aug 31 00:28:41 2017 us=971183 remote_cert_ku[i] = 0
Thu Aug 31 00:28:41 2017 us=971190 remote_cert_ku[i] = 0
Thu Aug 31 00:28:41 2017 us=971198 remote_cert_ku[i] = 0
Thu Aug 31 00:28:41 2017 us=971205 remote_cert_ku[i] = 0
Thu Aug 31 00:28:41 2017 us=971223 remote_cert_ku[i] = 0
Thu Aug 31 00:28:41 2017 us=971231 remote_cert_ku[i] = 0
Thu Aug 31 00:28:41 2017 us=971238 remote_cert_ku[i] = 0
Thu Aug 31 00:28:41 2017 us=971245 remote_cert_ku[i] = 0
Thu Aug 31 00:28:41 2017 us=971252 remote_cert_ku[i] = 0
Thu Aug 31 00:28:41 2017 us=971259 remote_cert_ku[i] = 0
Thu Aug 31 00:28:41 2017 us=971266 remote_cert_ku[i] = 0
Thu Aug 31 00:28:41 2017 us=971273 remote_cert_ku[i] = 0
Thu Aug 31 00:28:41 2017 us=971280 remote_cert_ku[i] = 0
Thu Aug 31 00:28:41 2017 us=971287 remote_cert_ku[i] = 0
Thu Aug 31 00:28:41 2017 us=971294 remote_cert_eku = '[UNDEF]'
Thu Aug 31 00:28:41 2017 us=971302 ssl_flags = 0
Thu Aug 31 00:28:41 2017 us=971309 tls_timeout = 2
Thu Aug 31 00:28:41 2017 us=971316 renegotiate_bytes = 0
Thu Aug 31 00:28:41 2017 us=971324 renegotiate_packets = 0
Thu Aug 31 00:28:41 2017 us=971331 renegotiate_seconds = 3600
Thu Aug 31 00:28:41 2017 us=971338 handshake_window = 60
Thu Aug 31 00:28:41 2017 us=971529 transition_window = 3600
Thu Aug 31 00:28:41 2017 us=971552 single_session = DISABLED
Thu Aug 31 00:28:41 2017 us=971570 push_peer_info = DISABLED
Thu Aug 31 00:28:41 2017 us=971581 tls_exit = DISABLED
Thu Aug 31 00:28:41 2017 us=971588 tls_auth_file = 'ta.key'
Thu Aug 31 00:28:41 2017 us=971596 pkcs11_protected_authentication = DISABLED
Thu Aug 31 00:28:41 2017 us=971603 pkcs11_protected_authentication = DISABLED
Thu Aug 31 00:28:41 2017 us=971610 pkcs11_protected_authentication = DISABLED
Thu Aug 31 00:28:41 2017 us=971617 pkcs11_protected_authentication = DISABLED
Thu Aug 31 00:28:41 2017 us=971625 pkcs11_protected_authentication = DISABLED
Thu Aug 31 00:28:41 2017 us=971632 pkcs11_protected_authentication = DISABLED
Thu Aug 31 00:28:41 2017 us=971639 pkcs11_protected_authentication = DISABLED
Thu Aug 31 00:28:41 2017 us=971646 pkcs11_protected_authentication = DISABLED
Thu Aug 31 00:28:41 2017 us=971653 pkcs11_protected_authentication = DISABLED
Thu Aug 31 00:28:41 2017 us=971660 pkcs11_protected_authentication = DISABLED
Thu Aug 31 00:28:41 2017 us=971667 pkcs11_protected_authentication = DISABLED
Thu Aug 31 00:28:41 2017 us=971674 pkcs11_protected_authentication = DISABLED
Thu Aug 31 00:28:41 2017 us=971681 pkcs11_protected_authentication = DISABLED
Thu Aug 31 00:28:41 2017 us=971688 pkcs11_protected_authentication = DISABLED
Thu Aug 31 00:28:41 2017 us=971695 pkcs11_protected_authentication = DISABLED
Thu Aug 31 00:28:41 2017 us=971702 pkcs11_protected_authentication = DISABLED
Thu Aug 31 00:28:41 2017 us=971710 pkcs11_private_mode = 00000000
Thu Aug 31 00:28:41 2017 us=971717 pkcs11_private_mode = 00000000
Thu Aug 31 00:28:41 2017 us=971724 pkcs11_private_mode = 00000000
Thu Aug 31 00:28:41 2017 us=971732 pkcs11_private_mode = 00000000
Thu Aug 31 00:28:41 2017 us=971753 pkcs11_private_mode = 00000000
Thu Aug 31 00:28:41 2017 us=971762 pkcs11_private_mode = 00000000
Thu Aug 31 00:28:41 2017 us=971769 pkcs11_private_mode = 00000000
Thu Aug 31 00:28:41 2017 us=971777 pkcs11_private_mode = 00000000
Thu Aug 31 00:28:41 2017 us=971784 pkcs11_private_mode = 00000000
Thu Aug 31 00:28:41 2017 us=971791 pkcs11_private_mode = 00000000
Thu Aug 31 00:28:41 2017 us=971798 pkcs11_private_mode = 00000000
Thu Aug 31 00:28:41 2017 us=971805 pkcs11_private_mode = 00000000
Thu Aug 31 00:28:41 2017 us=971812 pkcs11_private_mode = 00000000
Thu Aug 31 00:28:41 2017 us=971819 pkcs11_private_mode = 00000000
Thu Aug 31 00:28:41 2017 us=971826 pkcs11_private_mode = 00000000
Thu Aug 31 00:28:41 2017 us=971833 pkcs11_private_mode = 00000000
Thu Aug 31 00:28:41 2017 us=971840 pkcs11_cert_private = DISABLED
Thu Aug 31 00:28:41 2017 us=971847 pkcs11_cert_private = DISABLED
Thu Aug 31 00:28:41 2017 us=971854 pkcs11_cert_private = DISABLED
Thu Aug 31 00:28:41 2017 us=971861 pkcs11_cert_private = DISABLED
Thu Aug 31 00:28:41 2017 us=971868 pkcs11_cert_private = DISABLED
Thu Aug 31 00:28:41 2017 us=971875 pkcs11_cert_private = DISABLED
Thu Aug 31 00:28:41 2017 us=971882 pkcs11_cert_private = DISABLED
Thu Aug 31 00:28:41 2017 us=971889 pkcs11_cert_private = DISABLED
Thu Aug 31 00:28:41 2017 us=971896 pkcs11_cert_private = DISABLED
Thu Aug 31 00:28:41 2017 us=971903 pkcs11_cert_private = DISABLED
Thu Aug 31 00:28:41 2017 us=971910 pkcs11_cert_private = DISABLED
Thu Aug 31 00:28:41 2017 us=971916 pkcs11_cert_private = DISABLED
Thu Aug 31 00:28:41 2017 us=971924 pkcs11_cert_private = DISABLED
Thu Aug 31 00:28:41 2017 us=971930 pkcs11_cert_private = DISABLED
Thu Aug 31 00:28:41 2017 us=971937 pkcs11_cert_private = DISABLED
Thu Aug 31 00:28:41 2017 us=971945 pkcs11_cert_private = DISABLED
Thu Aug 31 00:28:41 2017 us=971952 pkcs11_pin_cache_period = -1
Thu Aug 31 00:28:41 2017 us=971959 pkcs11_id = '[UNDEF]'
Thu Aug 31 00:28:41 2017 us=976285 pkcs11_id_management = DISABLED
Thu Aug 31 00:28:41 2017 us=976301 server_network = 10.8.0.0
Thu Aug 31 00:28:41 2017 us=976311 server_netmask = 255.255.255.0
Thu Aug 31 00:28:41 2017 us=976336 server_network_ipv6 = ::
Thu Aug 31 00:28:41 2017 us=976346 server_netbits_ipv6 = 0
Thu Aug 31 00:28:41 2017 us=976355 server_bridge_ip = 0.0.0.0
Thu Aug 31 00:28:41 2017 us=976363 server_bridge_netmask = 0.0.0.0
Thu Aug 31 00:28:41 2017 us=976372 server_bridge_pool_start = 0.0.0.0
Thu Aug 31 00:28:41 2017 us=976380 server_bridge_pool_end = 0.0.0.0
Thu Aug 31 00:28:41 2017 us=976388 push_entry = 'redirect-gateway def1 bypass-dhcp'
Thu Aug 31 00:28:41 2017 us=976396 push_entry = 'dhcp-option DNS 208.67.222.222'
Thu Aug 31 00:28:41 2017 us=976404 push_entry = 'dhcp-option DNS 208.67.220.220'
Thu Aug 31 00:28:41 2017 us=976411 push_entry = 'route 10.8.0.1'
Thu Aug 31 00:28:41 2017 us=976419 push_entry = 'topology net30'
Thu Aug 31 00:28:41 2017 us=976426 push_entry = 'ping 10'
Thu Aug 31 00:28:41 2017 us=976434 push_entry = 'ping-restart 120'
Thu Aug 31 00:28:41 2017 us=976441 ifconfig_pool_defined = ENABLED
Thu Aug 31 00:28:41 2017 us=976449 ifconfig_pool_start = 10.8.0.4
Thu Aug 31 00:28:41 2017 us=976457 ifconfig_pool_end = 10.8.0.251
Thu Aug 31 00:28:41 2017 us=976465 ifconfig_pool_netmask = 0.0.0.0
Thu Aug 31 00:28:41 2017 us=976472 ifconfig_pool_persist_filename = 'ipp.txt'
Thu Aug 31 00:28:41 2017 us=978773 ifconfig_pool_persist_refresh_freq = 600
Thu Aug 31 00:28:41 2017 us=978783 ifconfig_ipv6_pool_defined = DISABLED
Thu Aug 31 00:28:41 2017 us=978792 ifconfig_ipv6_pool_base = ::
Thu Aug 31 00:28:41 2017 us=978800 ifconfig_ipv6_pool_netbits = 0
Thu Aug 31 00:28:41 2017 us=978808 n_bcast_buf = 256
Thu Aug 31 00:28:41 2017 us=978815 tcp_queue_limit = 64
Thu Aug 31 00:28:41 2017 us=978822 real_hash_size = 256
Thu Aug 31 00:28:41 2017 us=978830 virtual_hash_size = 256
Thu Aug 31 00:28:41 2017 us=978838 client_connect_script = '[UNDEF]'
Thu Aug 31 00:28:41 2017 us=978867 learn_address_script = '[UNDEF]'
Thu Aug 31 00:28:41 2017 us=978877 client_disconnect_script = '[UNDEF]'
Thu Aug 31 00:28:41 2017 us=978884 client_config_dir = '[UNDEF]'
Thu Aug 31 00:28:41 2017 us=978892 ccd_exclusive = DISABLED
Thu Aug 31 00:28:41 2017 us=978899 tmp_dir = '/tmp'
Thu Aug 31 00:28:41 2017 us=978907 push_ifconfig_defined = DISABLED
Thu Aug 31 00:28:41 2017 us=978915 push_ifconfig_local = 0.0.0.0
Thu Aug 31 00:28:41 2017 us=978923 push_ifconfig_remote_netmask = 0.0.0.0
Thu Aug 31 00:28:41 2017 us=978931 push_ifconfig_ipv6_defined = DISABLED
Thu Aug 31 00:28:41 2017 us=978946 push_ifconfig_ipv6_local = ::/0
Thu Aug 31 00:28:41 2017 us=978963 push_ifconfig_ipv6_remote = ::
Thu Aug 31 00:28:41 2017 us=978980 enable_c2c = DISABLED
Thu Aug 31 00:28:41 2017 us=981088 duplicate_cn = DISABLED
Thu Aug 31 00:28:41 2017 us=981121 cf_max = 0
Thu Aug 31 00:28:41 2017 us=981137 cf_per = 0
Thu Aug 31 00:28:41 2017 us=981152 max_clients = 5
Thu Aug 31 00:28:41 2017 us=981167 max_routes_per_client = 256
Thu Aug 31 00:28:41 2017 us=981181 auth_user_pass_verify_script = '[UNDEF]'
Thu Aug 31 00:28:41 2017 us=981195 auth_user_pass_verify_script_via_file = DISABLED
Thu Aug 31 00:28:41 2017 us=981226 port_share_host = '[UNDEF]'
Thu Aug 31 00:28:41 2017 us=981244 port_share_port = 0
Thu Aug 31 00:28:41 2017 us=981258 client = DISABLED
Thu Aug 31 00:28:41 2017 us=981273 pull = DISABLED
Thu Aug 31 00:28:41 2017 us=981287 auth_user_pass_file = '[UNDEF]'
Thu Aug 31 00:28:41 2017 us=981308 OpenVPN 2.3.10 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jun 22 2017
Thu Aug 31 00:28:41 2017 us=981377 library versions: OpenSSL 1.0.2g 1 Mar 2016, LZO 2.08
Thu Aug 31 00:28:41 2017 us=991585 Diffie-Hellman initialized with 2048 bit key
Thu Aug 31 00:28:41 2017 us=996467 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Thu Aug 31 00:28:41 2017 us=996525 Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Thu Aug 31 00:28:41 2017 us=996548 Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Thu Aug 31 00:28:41 2017 us=996576 TLS-Auth MTU parms [ L:1570 D:1172 EF:78 EB:0 ET:0 EL:3 ]
Thu Aug 31 00:28:41 2017 us=996611 Socket Buffers: R=[212992->212992] S=[212992->212992]
Thu Aug 31 00:28:41 2017 us=996747 ROUTE: default_gateway=UNDEF
Thu Aug 31 00:28:41 2017 us=997183 TUN/TAP device tun0 opened
Thu Aug 31 00:28:41 2017 us=997228 TUN/TAP TX queue length set to 100
Thu Aug 31 00:28:41 2017 us=997264 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Aug 31 00:28:41 2017 us=997305 /sbin/ip link set dev tun0 up mtu 1500
Thu Aug 31 00:28:42 2017 us=22745 /sbin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2
Thu Aug 31 00:28:42 2017 us=26819 /sbin/ip route add 10.8.0.0/24 via 10.8.0.2
Thu Aug 31 00:28:42 2017 us=37104 Data Channel MTU parms [ L:1570 D:1450 EF:70 EB:143 ET:0 EL:3 AF:3/1 ]
Thu Aug 31 00:28:42 2017 us=52169 GID set to nogroup
Thu Aug 31 00:28:42 2017 us=52205 UID set to nobody
Thu Aug 31 00:28:42 2017 us=52236 UDPv4 link local (bound): [undef]
Thu Aug 31 00:28:42 2017 us=52255 UDPv4 link remote: [undef]
Thu Aug 31 00:28:42 2017 us=52273 MULTI: multi_init called, r=256 v=256
Thu Aug 31 00:28:42 2017 us=52356 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Thu Aug 31 00:28:42 2017 us=52469 IFCONFIG POOL LIST
Thu Aug 31 00:28:42 2017 us=52568 Initialization Sequence Completed
This is the error:
Thu Aug 31 01:27:23 2017 us=551394 Authenticate/Decrypt packet error: packet HMAC authentication failed
Thu Aug 31 01:27:23 2017 us=551607 TLS Error: incoming packet authentication failed from [AF_INET]client.IP.address:60915
*
Client *
Operating system:
Software:
System Software Overview:
System Version: macOS 10.12.6 (16G29)
Kernel Version: Darwin 16.7.0
Boot Volume: Macintosh HD
Boot Mode: Normal
Computer Name: Porterhouse
User Name: user
Secure Virtual Memory: Enabled
System Integrity Protection: Enabled
Time since boot: 2 days 23:10
Network setup:
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
options=1203<RXCSUM,TXCSUM,TXSTATUS,SW_TIMESTAMP>
inet 127.0.0.1 netmask 0xff000000
inet6 ::1 prefixlen 128
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1
nd6 options=201<PERFORMNUD,DAD>
gif0: flags=8010<POINTOPOINT,MULTICAST> mtu 1280
stf0: flags=0<> mtu 1280
en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
options=10b<RXCSUM,TXCSUM,VLAN_HWTAGGING,AV>
ether ac:87:a3:0b:f5:ae
media: autoselect (1000baseT <full-duplex>)
status: active
en5: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
options=b<RXCSUM,TXCSUM,VLAN_HWTAGGING>
ether ac:87:a3:0b:f5:ae
media: autoselect (1000baseT <full-duplex>)
status: active
en1: flags=8823<UP,BROADCAST,SMART,SIMPLEX,MULTICAST> mtu 1500
ether b8:09:8a:c9:6f:fb
nd6 options=201<PERFORMNUD,DAD>
media: autoselect (<unknown type>)
status: inactive
en2: flags=963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX> mtu 1500
options=60<TSO4,TSO6>
ether 0a:00:00:30:ff:b0
media: autoselect <full-duplex>
status: inactive
en3: flags=963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX> mtu 1500
options=60<TSO4,TSO6>
ether 0a:00:00:30:ff:b1
media: autoselect <full-duplex>
status: inactive
p2p0: flags=8802<BROADCAST,SIMPLEX,MULTICAST> mtu 2304
ether 0a:09:8a:c9:6f:fb
media: autoselect
status: inactive
awdl0: flags=8902<BROADCAST,PROMISC,SIMPLEX,MULTICAST> mtu 1484
ether c6:41:06:b8:77:93
nd6 options=201<PERFORMNUD,DAD>
media: autoselect
status: inactive
bond0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
options=b<RXCSUM,TXCSUM,VLAN_HWTAGGING>
ether ac:87:a3:0b:f5:ae
inet6 fe80::8cc:7bce:bf4d:abf3%bond0 prefixlen 64 secured scopeid 0xb
inet 192.168.30.40 netmask 0xffff0000 broadcast 192.168.255.255
nd6 options=201<PERFORMNUD,DAD>
media: autoselect (1000baseT <full-duplex>)
status: active
bond interfaces: en0 en5
ham0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1404
ether 7a:79:19:0d:0f:d5
inet 25.13.15.213 netmask 0xff000000 broadcast 25.255.255.255
inet6 fe80::7879:19ff:fe0d:fd5%ham0 prefixlen 64 scopeid 0xc
inet6 2620:9b::190d:fd5 prefixlen 96
nd6 options=201<PERFORMNUD,DAD>
open (pid 90)
utun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 2000
inet6 fe80::82ff:ecb5:c860:6c61%utun0 prefixlen 64 scopeid 0xd
nd6 options=201<PERFORMNUD,DAD>
bridge0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
options=63<RXCSUM,TXCSUM,TSO4,TSO6>
ether 0a:00:00:30:ff:b0
Configuration:
id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0
maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200
root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0
ipfilter disabled flags 0x2
member: en2 flags=3<LEARNING,DISCOVER>
ifmaxaddr 0 port 7 priority 0 path cost 0
member: en3 flags=3<LEARNING,DISCOVER>
ifmaxaddr 0 port 8 priority 0 path cost 0
nd6 options=201<PERFORMNUD,DAD>
media: <unknown type>
status: inactive
utun1: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1380
inet6 fe80::472c:6a1a:5673:14d1%utun1 prefixlen 64 scopeid 0xf
nd6 options=201<PERFORMNUD,DAD>
utun2: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1380
inet6 fe80::fa05:4f46:f4bd:1382%utun2 prefixlen 64 scopeid 0x10
nd6 options=201<PERFORMNUD,DAD>
utun3: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1380
inet6 fe80::26d6:c447:a50a:c99e%utun3 prefixlen 64 scopeid 0x11
nd6 options=201<PERFORMNUD,DAD>
client
dev tun
proto udp
remote server.IP.address 2017
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
# ca ca.crt
# cert client.crt
# key client.key
remote-cert-tls server
tls-auth ta.key 1
key-direction 1
auth SHA256
comp-lzo
verb 4
tls-client
# script-security 2
# up /etc/openvpn/update-resolv-conf
# down /etc/openvpn/update-resolv-conf
<ca>
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</ca>
<cert>
Certificate:
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
-----END PRIVATE KEY-----
</key>
<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
</tls-auth>
Client log (at --verb 4 and server name and IP address removed)
2017-08-31 13:27:16: Viscosity Mac 1.7.3 (1412)
2017-08-31 13:27:16: Viscosity OpenVPN Engine Started
2017-08-31 13:27:16: Running on macOS 10.12.6
2017-08-31 13:27:16: ---------
2017-08-31 13:27:16: State changed to Connecting
2017-08-31 13:27:16: Checking reachability status of connection...
2017-08-31 13:27:16: Connection is reachable. Starting connection attempt.
2017-08-31 13:27:16: OpenVPN 2.4.3 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [MH/RECVDA] [AEAD] built on Jun 21 2017
2017-08-31 13:27:16: library versions: OpenSSL 1.0.2l 25 May 2017, LZO 2.09
2017-08-31 13:27:16: TCP/UDP: Preserving recently used remote address: [AF_INET]server.IP.address:2017
2017-08-31 13:27:16: UDP link local: (not bound)
2017-08-31 13:27:16: UDP link remote: [AF_INET]server.IP.address:2017
2017-08-31 13:28:17: TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
2017-08-31 13:28:17: TLS Error: TLS handshake failed
2017-08-31 13:28:17: SIGUSR1[soft,tls-error] received, process restarting
2017-08-31 13:28:17: TCP/UDP: Preserving recently used remote address: [AF_INET]server.IP.address:2017
2017-08-31 13:28:17: UDP link local: (not bound)
2017-08-31 13:28:17: UDP link remote: [AF_INET]server.IP.address:2017
2017-08-31 13:28:21: State changed to Disconnecting
2017-08-31 13:28:21: SIGTERM[hard,] received, process exiting
2017-08-31 13:28:21: State changed to Disconnected
This is the error:
2017-08-31 14:32:15: TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
2017-08-31 14:32:15: TLS Error: TLS handshake failed
Thank you for your help.
