Hy,
I've an openvpn server on ubuntu configured using this guide:
https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-ubuntu-16-04#step-6-generate-a-client-certificate-and-key-pair
the server is the following:
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.0.0 255.255.255.0"
push "route 192.168.2.0 255.255.255.0"
client-config-dir ccd
route 192.168.0.0 255.255.255.0
route 192.168.2.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 10 120
tls-auth ta.key 0 # This file is secret
key-direction 0
cipher AES-256-CBC
auth SHA256
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log openvpn.log
verb 4
instead the base.conf to generate client .ovpn file is the following:
client
dev tun
proto udp
remote 212.xxx.3x.6x 1194
resolv-retry infinite
nobind
persist-key
persist-tun
tls-auth ta.key 1
cipher AES-256-CBC
auth SHA256
key-direction 1
comp-lzo
verb 3
I load this ovpn on a windows XP client "OpenVPN GUI"
this is the client log
Wed Oct 03 18:04:31 2018 OpenVPN 2.3.18 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Oct 26 2017
Wed Oct 03 18:04:31 2018 Windows version 5.1 (Windows XP) 32bit
Wed Oct 03 18:04:31 2018 library versions: OpenSSL 1.0.2l 25 May 2017, LZO 2.10
Wed Oct 03 18:04:31 2018 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Wed Oct 03 18:04:31 2018 Need hold release from management interface, waiting...
Wed Oct 03 18:04:32 2018 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Wed Oct 03 18:04:32 2018 MANAGEMENT: CMD 'state on'
Wed Oct 03 18:04:32 2018 MANAGEMENT: CMD 'log all on'
Wed Oct 03 18:04:32 2018 MANAGEMENT: CMD 'hold off'
Wed Oct 03 18:04:32 2018 MANAGEMENT: CMD 'hold release'
Wed Oct 03 18:04:32 2018 WARNING: No server certificate verification method has been enabled. See
http://openvpn.net/howto.html#mitm for more info.
Wed Oct 03 18:04:32 2018 Control Channel Authentication: tls-auth using INLINE static key file
Wed Oct 03 18:04:32 2018 Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Wed Oct 03 18:04:32 2018 Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Wed Oct 03 18:04:32 2018 Socket Buffers: R=[8192->8192] S=[8192->8192]
Wed Oct 03 18:04:32 2018 UDPv4 link local: [undef]
Wed Oct 03 18:04:32 2018 UDPv4 link remote: [AF_INET]212.237.33.65:1194
Wed Oct 03 18:04:32 2018 MANAGEMENT: >STATE:1538582672,WAIT,,,
instead teh server log is:
Wed Oct 3 17:50:34 2018 us=690971 Authenticate/Decrypt packet error: packet HMAC authentication failed
Wed Oct 3 17:50:34 2018 us=691206 TLS Error: incoming packet authentication failed from [AF_INET]xx.xxx.xxx.xx:4546
the two configuration seems to be ok, according to documentation,
can you help me discover where is the problem?
Thanks,
Antonio
