Hi, Just after upgrading to 1.2.5, I can't connect to my server any more. On the iPhone the app tries to connect as if there's no internet, on the server I see: Tue Jan 9 03:18:19 2018 TLS Error: incoming packet authentication failed from [AF_INET]xxx:yyy Tue Jan 9 03:18:20 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed I tried to re-deploy the config again (xxx.ovpn), same problem.

Is this the client or the server log? IS it possible to have both? Could you please also post both configurations (please omit private information such as keys, etc).

The log from server (OpenVPN community 2.3.17) every second while iPhone tries to connect: [code]Tue Jan 9 04:23:33 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed Tue Jan 9 04:23:33 2018 TLS Error: incoming packet authentication failed from [AF_INET]xx:yy [/code] The log from the client with OpenVPN Connect 1.2.5 on iPhone 6S with iOS 11.2.1: [code]2018-01-09 04:23:29 Server poll timeout, trying next remote entry... 2018-01-09 04:23:29 EVENT: RECONNECTING 2018-01-09 04:23:29 Contacting [xx]:yy/UDP via UDP 2018-01-09 04:23:29 EVENT: WAIT 2018-01-09 04:23:29 Connecting to [xx]:yy (xx) via UDPv4 2018-01-09 04:23:34 EVENT: DISCONNECTED [/code] Server config: [code]local xx lport yy dev tun mode server topology subnet push "topology subnet" tun-mtu 1500 ifconfig xx yy ifconfig-pool xx yy fast-io push "route-gateway xx" push "redirect-gateway def1 autolocal bypass-dhcp" push "dhcp-option DNS xx" client-config-dir client_cfg user xx group yy chroot /zz script-security 2 tls-server tls-auth keys/xx tls-version-min 1.2 tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384 cipher AES-256-CBC auth SHA512 dh keys/xx ca keys/xx cert keys/yy key keys/zz crl-verify crl 'dir' remote-cert-ku a0 remote-cert-eku "TLS Web Client Authentication" verify-x509-name xx name-prefix comp-lzo ping 5 push "ping 5" push "ping-restart 15" persist-tun persist-key push "persist-key" push "explicit-exit-notify" [/code] Client config: [code]remote xx resolv-retry infinite server-poll-timeout 5 nobind dev tun tun-mtu 1500 allow-pull-fqdn pull tls-client -----BEGIN OpenVPN Static key V1----- xxx -----END OpenVPN Static key V1----- tls-version-min 1.2 tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384 cipher AES-256-CBC auth SHA512 -----BEGIN PRIVATE KEY----- xxx -----END PRIVATE KEY----- -----BEGIN CERTIFICATE----- xxx -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- xxx -----END CERTIFICATE----- remote-cert-tls server verify-x509-name xx name comp-lzo [/code]

ordex, could you please confirm you can reproduce the error? The problem is starting to affect the users as, despite the warning not to update the app, most of them have autoupdate turned on. Maybe you could publish the previous (1.1.1) version as a new version for the moment so everything is back again?

[quote=anatoli post_id=75596 time=1515507558 user_id=25293] ordex, could you please confirm you can reproduce the error? The problem is starting to affect the users as, despite the warning not to update the app, most of them have autoupdate turned on. [/quote] we have tested tls-auth and tis-crypt and they both work as expected. The log message you reported from the server is printed *after* the tis-auth/crypt mechanism has already performed its check. You could try verifying this by temporary disabling tis-auth and see if the error is still the same. Actually this error is more related to the authentication of the packets performed with SHA512 in your case. Is it possible for you to temporary comment that line on client and server and see if the error persists? That would help understanding where the problem is. [quote=anatoli post_id=75596 time=1515507558 user_id=25293] Maybe you could publish the previous (1.1.1) version as a new version for the moment so everything is back again? [/quote] Unfortunately the AppStore does not allow that. That why we are striving to collect as much information as possible and fix the bugs.

[quote=ordex post_id=75599 time=1515508653 user_id=39103] Unfortunately the AppStore does not allow that. That why we are striving to collect as much information as possible and fix the bugs. [/quote] This isn't good enough. Applications can _absolutely_ be pulled. You need to pull this application; re-submit the previous version with an incremental version release and put back a working version until you can fix the absolute piss up that is 1.2.5.

[quote=ordex post_id=75599 time=1515508653 user_id=39103] [quote=anatoli post_id=75596 time=1515507558 user_id=25293] ordex, could you please confirm you can reproduce the error? The problem is starting to affect the users as, despite the warning not to update the app, most of them have autoupdate turned on. [/quote] we have tested tls-auth and tis-crypt and they both work as expected. The log message you reported from the server is printed *after* the tis-auth/crypt mechanism has already performed its check. You could try verifying this by temporary disabling tis-auth and see if the error is still the same. Actually this error is more related to the authentication of the packets performed with SHA512 in your case. Is it possible for you to temporary comment that line on client and server and see if the error persists? That would help understanding where the problem is. [/quote] After digging deeper, it seems this might be related to tls-auth. Would it be possible for you to re-test without "auth SHA512" in the configuration? Thanks a lot

I only have this setup at production, I'll make the tests today COB.

Hi, I have exactly the same trouble. server side (ipfire with OpenSSL 1.0.2n) [code] 18:56:09 openvpnserver[25602]: x.x.x.x:55555 Fatal TLS error (check_tls_errors_co), restarting 18:56:09 openvpnserver[25602]: x.x.x.x:55555 TLS Error: incoming packet authentication failed from [AF_INET ]x.x.x.x:55555 18:56:09 openvpnserver[25602]: x.x.x.x:55555 Authenticate/Decrypt packet error: packet HMAC authentication failed 18:56:09 openvpnserver[25602]: TCP connection established with [AF_INET]x.x.x.x:55555 [/code] client side [code] 2018-01-09 18:56:09 EVENT: RESOLVE 2018-01-09 18:56:09 Contacting [y.y.y.y]::1234 /TCP via TCP 2018-01-09 18:56:09 EVENT: WAIT 2018-01-09 18:56:09 Connecting to [y.y.y.y]:1234 (y.y.y.y) via TCPv4 2018-01-09 18:56:09 TCP recv EOF 2018-01-09 18:56:09 Transport Error: Transport error on 'y.y.y.y: NETWORK_EOF_ERROR 2018-01-09 18:56:09 EVENT: TRANSPORT_ERROR Transport error on 'y.y.y.y: NETWORK_EOF_ERROR [ERR] 2018-01-09 18:56:09 Client terminated, restarting in 5000 ms... [/code] my server is still working fine with another device with the openVPN 1.2.4 can you help me? Thank you

[quote=Tg92 post_id=75632 time=1515522128 user_id=42885] Hi, I have exactly the same trouble. server side (ipfire with OpenSSL 1.0.2n) [code] 18:56:09 openvpnserver[25602]: x.x.x.x:55555 Fatal TLS error (check_tls_errors_co), restarting 18:56:09 openvpnserver[25602]: x.x.x.x:55555 TLS Error: incoming packet authentication failed from [AF_INET ]x.x.x.x:55555 18:56:09 openvpnserver[25602]: x.x.x.x:55555 Authenticate/Decrypt packet error: packet HMAC authentication failed 18:56:09 openvpnserver[25602]: TCP connection established with [AF_INET]x.x.x.x:55555 [/code] client side [code] 2018-01-09 18:56:09 EVENT: RESOLVE 2018-01-09 18:56:09 Contacting [y.y.y.y]::1234 /TCP via TCP 2018-01-09 18:56:09 EVENT: WAIT 2018-01-09 18:56:09 Connecting to [y.y.y.y]:1234 (y.y.y.y) via TCPv4 2018-01-09 18:56:09 TCP recv EOF 2018-01-09 18:56:09 Transport Error: Transport error on 'y.y.y.y: NETWORK_EOF_ERROR 2018-01-09 18:56:09 EVENT: TRANSPORT_ERROR Transport error on 'y.y.y.y: NETWORK_EOF_ERROR [ERR] 2018-01-09 18:56:09 Client terminated, restarting in 5000 ms... [/code] my server is still working fine with another device with the openVPN 1.2.4 can you help me? Thank you [/quote] I guess you mean v1.1.1? The app that was in AppStore earlier? By the way, could you please post the client config? thanks

yes version 1.1.1 I can complete my client log with [code] OpenVPN core 3.1.2 ios arm64 64-bit built on Jan 5 2018 23:09:59 2018-01-09 19:22:56 Keychain Cert Extraction: 1 certificate(s) found 2018-01-09 19:22:56 Frame=512/2048/512 mssfix-ctrl=1250 2018-01-09 19:22:56 UNUSED OPTIONS 0 [tls-client] 2 [nobind] 9 [verb] [3] 13 [verify-x509-name] [a.mydomain.com] [name] [/code] client config [code] #OpenVPN Client conf tls-client client nobind dev tun proto tcp tun-mtu 1400 remote a.mydomain.com 1234 cipher AES-256-CBC auth SHA256 verb 3 ns-cert-type server redirect-gateway def1 tls-remote a.mydomain.com verify-x509-name a.mydomain.com name #mssfix ##optional! [/code]

Upgrade to OpenVPN 1.2.5 (iOS): tls-auth not working

ordex

Sure, I'll keep you posted by updating this thread!

ordex

Can any of you confirm that this error exists also when the server is running OpenVPN 2.4.x ?
Or have you seen it only against 2.3.x servers?

thanks

markymarrow

Getting the Authenticate/Decrypt packet error on a server running 2.4.4

I've been using a mobileconfig for VoD, have just switched to embedding the cert/key in the vendor config instead of a payload (as that no longer works).
If I set vpn-on-demand:0, I can connect without a problem via the OpenVPN app, but I get the above issue when trying to connect via the settings app.

ordex

Regarding the tls-auth issue: I believe we have found the root cause. It is a subtle change in behaviour that diverted from the community edition.

As far as I can see from the posted configurations, those of you having the issue are using the *tls-auth* option without *key-direction*.
The *key-direction* is a number (either 0 or 1) that is specified after the tls-auth file. Would you please specify it and see if it works?
An option is to have 0 on the server and 1 on the client, like this:

server:

tls-auth file.key 0

client:

tls-auth file.key 1

Those of you using an embedded tls-auth, can specify the key direction with an additional config option like this:

<tls-auth>
XXXXXXX
xxxxxxxxx
XXXXXXX
</tls-auth>
key-direction Z

where Z is either 0 or 1 like above.

ordex

markymarrow wrote Getting the Authenticate/Decrypt packet error on a server running 2.4.4

I've been using a mobileconfig for VoD, have just switched to embedding the cert/key in the vendor config instead of a payload (as that no longer works).
If I set vpn-on-demand:0, I can connect without a problem via the OpenVPN app, but I get the above issue when trying to connect via the settings app.

could you please open another thread and paste the full log? Given what you are saying it seems like a different problem.
Thanks!

Tg92

hi,

I have solve my trouble. On server side I replace
tls-auth /path/ta.key
by
tls-auth /path/ta.key 1

and in the ovpn client configuration file I add
key-direction 0

It is just the opposite of the documentation found on https://gist.github.com/frengky/79597bad4eda1a3f1f24

In the server configuration, add:
    tls-auth ta.key 0
In the client configuration, add:
    tls-auth ta.key 1

but it is working.

Now, I have another trouble. When I establish the connection and lock my iPhone version 11.2.2. When I unlock it after 2-3 minutes, the vpn connection is not established automatically like before.
I have sometimes this behavior with the old version but with the new one it is systematic

anatoli

I can confirm that with 'tls-auth file.key 0/1' and/or 'key-direction X' on *both* client and server 1.2.5 works fine. When do you expect the new release to be available in the AppStore?

anatoli

With respect to what @Tg92 reports at the bottom of his/her latest message that:

when I unlock it after 2-3 minutes, the vpn connection is not established automatically like before

I'm testing this for more than a hour already and everything looks fine (I have in the iOS settings: Seamless tunnel, Reconnect on wakeup, Timeout none, NW state detection active and Layer 2 reachability). Moreover, it looks to work better than the 1.1.1 version in the sense that 1.1.1 was dropping the connection on sleep and reconnecting on wakeup, but this version maintains it permanently on, so push notifications while on WiFi and some apps that depend on the tunnel (e.g. VoIP with inside-VPN PBX) are working better now.

I can imagine this should have some impact on battery, but in my case the latest phones have enough energy for a working day so no problem.

Anyway, I'm waiting for a fix to the 'tls-auth' option requiring the direction in 1.2.5 as it's not feasible to update all the endpoints currently in production. BTW, according to the official documentation, the direction is an optional param both in 2.3 and 2.4.

ordex

anatoli wrote With respect to what @Tg92 reports at the bottom of his/her latest message that:
when I unlock it after 2-3 minutes, the vpn connection is not established automatically like before
I'm testing this for more than a hour already and everything looks fine (I have in the iOS settings: Seamless tunnel, Reconnect on wakeup, Timeout none, NW state detection active and Layer 2 reachability). Moreover, it looks to work better than the 1.1.1 version in the sense that 1.1.1 was dropping the connection on sleep and reconnecting on wakeup, but this version maintains it permanently on, so push notifications while on WiFi and some apps that depend on the tunnel (e.g. VoIP with inside-VPN PBX) are working better now.

Glad to hear that. However, if anybody wants to continue this topic, please let's open another thread so we can continue the discussion there.

anatoli wrote I can imagine this should have some impact on battery, but in my case the latest phones have enough energy for a working day so no problem.

Yeah, that's the drawback.

anatoli wrote Anyway, I'm waiting for a fix to the 'tls-auth' option requiring the direction in 1.2.5 as it's not feasible to update all the endpoints currently in production. BTW, according to the official documentation, the direction is an optional param both in 2.3 and 2.4.

Yeah, it's optional. That's why a fix is required 🙂

anatoli

ordex, now that the root causes for most of the reported bugs are identified, any ETA for the new release?

ordex

anatoli wrote ordex, now that the root causes for most of the reported bugs are identified, any ETA for the new release?

We're already rolling out a beta release including what we have fixed so far. If you are interested in joining the beta program, please drop me a PM.

Thanks

peter_sm

ordex wrote [
We're already rolling out a beta release including what we have fixed so far. If you are interested in joining the beta program, please drop me a PM.

Thanks

Hi , I'm not authorised to send private messages.
Can you add me to the beta program?

Thanks

Tg92

ordex wrote
anatoli wrote With respect to what @Tg92 reports at the bottom of his/her latest message that:
when I unlock it after 2-3 minutes, the vpn connection is not established automatically like before
I'm testing this for more than a hour already and everything looks fine (I have in the iOS settings: Seamless tunnel, Reconnect on wakeup, Timeout none, NW state detection active and Layer 2 reachability). Moreover, it looks to work better than the 1.1.1 version in the sense that 1.1.1 was dropping the connection on sleep and reconnecting on wakeup, but this version maintains it permanently on, so push notifications while on WiFi and some apps that depend on the tunnel (e.g. VoIP with inside-VPN PBX) are working better now.
Glad to hear that. However, if anybody wants to continue this topic, please let's open another thread so we can continue the discussion there.

anatoli wrote I can imagine this should have some impact on battery, but in my case the latest phones have enough energy for a working day so no problem.
Yeah, that's the drawback.

anatoli wrote Anyway, I'm waiting for a fix to the 'tls-auth' option requiring the direction in 1.2.5 as it's not feasible to update all the endpoints currently in production. BTW, according to the official documentation, the direction is an optional param both in 2.3 and 2.4.
Yeah, it's optional. That's why a fix is required 🙂

I have still the trouble. I have an iPhone SE with the last version of IOS.
I put my openVPN configuration below

anatoli

I suggest you open a new post with the detailed description of the problem, the steps to reproduce it (if you know) and the server and client configs and logs, as this thread is about a different problem.

anatoli

For me this issue is solved in the 1.2.6.1-3 betas. Waiting for the release in AppStore.

samide

ordex wrote
We're already rolling out a beta release including what we have fixed so far. If you are interested in joining the beta program, please drop me a PM.

Thanks

Hi , I tried to message you but I’m still not allowed to send private messages.

can you add me to the beta program ?

Thanks

ordex

OpenVPN Connect for iOS 1.2.6 is out!

Please refer to this post if you want to submit bugs of feature requests: https://forums.openvpn.net/viewtopic.php?f=36&t=25650

Thanks!

« Previous Page